From 0089fbe63abb619a7f7fcca070cbc6d0ad90bbb1 Mon Sep 17 00:00:00 2001
From: Anthony Kim <anthonykim@microsoft.com>
Date: Tue, 9 Sep 2025 15:21:16 -0700
Subject: [PATCH] Only allow open with user permission

---
 .../links/browser/terminalLinkManager.ts      | 33 ++++++++++++-------
 1 file changed, 21 insertions(+), 12 deletions(-)

diff --git a/src/vs/workbench/contrib/terminalContrib/links/browser/terminalLinkManager.ts b/src/vs/workbench/contrib/terminalContrib/links/browser/terminalLinkManager.ts
index a862d2146db..5514d5ab725 100644
--- a/src/vs/workbench/contrib/terminalContrib/links/browser/terminalLinkManager.ts
+++ b/src/vs/workbench/contrib/terminalContrib/links/browser/terminalLinkManager.ts
@@ -105,7 +105,7 @@ export class TerminalLinkManager extends DisposableStore {
 		}));
 		this._xterm.options.linkHandler = {
 			allowNonHttpProtocols: true,
-			activate: (event, text) => {
+			activate: async (event, text) => {
 				if (!this._isLinkActivationModifierDown(event)) {
 					return;
 				}
@@ -115,18 +115,27 @@ export class TerminalLinkManager extends DisposableStore {
 				}
 				const scheme = text.substring(0, colonIndex);
 				if (terminalConfigurationService.config.allowedLinkSchemes.indexOf(scheme) === -1) {
-					notificationService.prompt(Severity.Warning, nls.localize('scheme', 'Opening URIs can be insecure, do you want to allow opening links with the scheme {0}?', scheme), [
-						{
-							label: nls.localize('allow', 'Allow {0}', scheme),
-							run: () => {
-								const allowedLinkSchemes = [
-									...terminalConfigurationService.config.allowedLinkSchemes,
-									scheme
-								];
-								this._configurationService.updateValue(`terminal.integrated.allowedLinkSchemes`, allowedLinkSchemes);
+					const userAllowed = await new Promise<boolean>((resolve) => {
+						notificationService.prompt(Severity.Warning, nls.localize('scheme', 'Opening URIs can be insecure, do you want to allow opening links with the scheme {0}?', scheme), [
+							{
+								label: nls.localize('allow', 'Allow {0}', scheme),
+								run: () => {
+									const allowedLinkSchemes = [
+										...terminalConfigurationService.config.allowedLinkSchemes,
+										scheme
+									];
+									this._configurationService.updateValue(`terminal.integrated.allowedLinkSchemes`, allowedLinkSchemes);
+									resolve(true);
+								}
 							}
-						}
-					]);
+						], {
+							onCancel: () => resolve(false)
+						});
+					});
+
+					if (!userAllowed) {
+						return;
+					}
 				}
 				this._openers.get(TerminalBuiltinLinkType.Url)?.open({
 					type: TerminalBuiltinLinkType.Url,