Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support Workspace Trust #259

Closed
SchoofsKelvin opened this issue May 14, 2021 · 1 comment
Closed

Support Workspace Trust #259

SchoofsKelvin opened this issue May 14, 2021 · 1 comment
Labels
enhancement New feature or request good first issue Issues/features involving simple code changes

Comments

@SchoofsKelvin
Copy link
Owner

Information: microsoft/vscode#120251

For this extension, limited mode should be fine. We should probably block sshfs.configs and sshfs.configpaths from being read from untrusted workspaces, using the restrictedConfigurations field mentioned in the issue above.

Should double-check the extension for places where workspace trust might be an issue, but as far as I know, the only workspace "resources" the extension uses are the aforementioned settings. One edge case might be where the User Settings' sshfs.configpaths might have relative paths, which might thus reference the workspace folder. Actually unsure whether relative paths would be relative to the workspace folder, to wherever VS Code got opened or to the installation directory of VS Code.

@SchoofsKelvin SchoofsKelvin added enhancement New feature or request good first issue Issues/features involving simple code changes labels May 14, 2021
@SchoofsKelvin
Copy link
Owner Author

Support added in cca8be2.

Went with full support. Originally planned on going with limited support, which would disable config scanning for workspace folders, but that feature has already been disabled due to complexities in the past.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request good first issue Issues/features involving simple code changes
Projects
None yet
Development

No branches or pull requests

1 participant