[cherry-pick] Adopt security fixes on main - #330350
Merged
Merged
Conversation
Contributor
Author
📬 CODENOTIFYThe following users are being notified based on files changed in this PR: Kyle Cutler (@kycutler)Matched files:
Joaquín Ruales (@jruales)Matched files:
Anthony Kim (@anthonykim1)Matched files:
|
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.
This PR tightens network/domain and environment safety checks across web tooling, remote terminal/extension host env handling, and adds coverage for related edge cases (notably IPv6 literals and unsafe schemes).
Changes:
- Enforce stricter network policy handling (IPv6 literal canonicalization, unsafe scheme blocking, frame/request filtering) with expanded test coverage.
- Harden environment handling for browser smoke tests and remote terminal environment propagation (scrub dangerous env vars, gate payload-only dev options).
- Fix/control flow around terminal process creation gating (workspace trust + empty workspace cwd) and align integration smoke-test driver enablement.
Reviewed changes
Copilot reviewed 22 out of 22 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| test/integration/browser/src/index.ts | Enables smoke test driver flag for integration server launch. |
| src/vs/workbench/services/extensions/test/browser/extensionUrlHandler.test.ts | Adds tests for override URL handlers under trust policy. |
| src/vs/workbench/services/extensions/browser/extensionUrlHandler.ts | Reorders override handling and preserves trust behavior when extensions are absent. |
| src/vs/workbench/services/environment/test/browser/environmentService.test.ts | Adds tests ensuring privileged payload is only honored in dev/smoke-test scenarios. |
| src/vs/workbench/services/environment/browser/environmentService.ts | Gates extension host dev options from payload to dev or smoke-test driver builds. |
| src/vs/workbench/contrib/webview/browser/webviewElement.ts | Adjusts chunk buffering to avoid problematic transfers/detaches. |
| src/vs/workbench/contrib/terminal/test/browser/terminalInstance.test.ts | Adds tests to assert no process spawn when trust denied / unexpected cwd in empty workspace. |
| src/vs/workbench/contrib/terminal/browser/terminalInstance.ts | Adds early returns after terminal launch denial checks. |
| src/vs/workbench/contrib/chat/test/electron-browser/tools/builtinTools/fetchPageTool.test.ts | Adds test to ensure IPv6 literals are blocked before extraction. |
| src/vs/workbench/contrib/browserView/test/electron-browser/tools/openBrowserTool.test.ts | Adds test to ensure IPv6 literals are blocked before opening pages. |
| src/vs/workbench/api/common/extHostCommands.ts | Copies VSBuffer payload ArrayBuffers to avoid reuse/aliasing across calls. |
| src/vs/server/node/remoteTerminalChannel.ts | Scrubs dangerous env variables from resolver env before building terminal env. |
| src/vs/server/node/extensionHostConnection.ts | Ensures extension-host-required vars override start params env. |
| src/vs/platform/webContentExtractor/test/electron-main/webPageLoader.test.ts | Adds extensive tests for request/frame scheme filtering and domain policy enforcement. |
| src/vs/platform/webContentExtractor/electron-main/webPageLoader.ts | Adds request interception + frame-navigation blocking + child window denial + frame extraction filtering. |
| src/vs/platform/networkFilter/test/common/networkFilterService.test.ts | Adds tests for IPv6 literal handling and malformed authorities “fail closed” behavior. |
| src/vs/platform/networkFilter/test/common/domainMatcher.test.ts | Adds tests for IPv6 extraction/canonicalization and matching. |
| src/vs/platform/networkFilter/common/networkFilterService.ts | Fails closed for malformed http/https authorities; uses scheme matcher. |
| src/vs/platform/networkFilter/common/domainMatcher.ts | Canonicalizes URI authorities (incl IPv6) and improves pattern matching. |
| src/vs/platform/browserView/test/node/playwrightTab.test.ts | Adds test ensuring IPv4-mapped IPv6 normalization remains blocked. |
| src/vs/base/test/common/processes.test.ts | Adds test coverage for dangerous env var removal (case-insensitive). |
| src/vs/base/common/processes.ts | Makes dangerous env var removal cross-platform and case-insensitive. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Paul (pwang347)
approved these changes
Aug 11, 2026
Paul (pwang347)
enabled auto-merge (squash)
August 11, 2026 22:03
Raymond Zhao (rzhao271)
approved these changes
Aug 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry-pick of #330308 from
main.