From b85a272298404dd7e168a2c576fa31bfa28decc7 Mon Sep 17 00:00:00 2001 From: Matt Bierner Date: Fri, 15 Oct 2021 14:12:31 -0700 Subject: [PATCH] Fix csp for CDN extension locations This rule needs to end in a `/` so that all files under the extension are allowed --- src/vs/workbench/api/common/extHostWebview.ts | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/vs/workbench/api/common/extHostWebview.ts b/src/vs/workbench/api/common/extHostWebview.ts index 020f7633504..d472ed4414d 100644 --- a/src/vs/workbench/api/common/extHostWebview.ts +++ b/src/vs/workbench/api/common/extHostWebview.ts @@ -78,7 +78,12 @@ export class ExtHostWebview implements vscode.Webview { if (extensionLocation.scheme === Schemas.https || extensionLocation.scheme === Schemas.http) { // The extension is being served up from a CDN. // Also include the CDN in the default csp. - return extensionLocation + ' ' + webviewGenericCspSource; + let extensionCspRule = extensionLocation.toString(); + if (!extensionCspRule.endsWith('/')) { + // Always treat the location as a directory so that we allow all content under it + extensionCspRule += '/'; + } + return extensionCspRule + ' ' + webviewGenericCspSource; } return webviewGenericCspSource; }