Files
vscode/extensions/github/src/credentialProvider.ts
dileepyavan 7422e06ada [main] Cherry-pick MSRC fixes (#320659)
* OTel visibility in Copilot Chat UI (#47)

* [msrc/1.123] 114763

* Add maxAttributeSizeChars configuration to OpenTelemetry settings

---------

Co-authored-by: Zhichao Li <zhichli@microsoft.com>
(cherry picked from commit 042dc59dbb51f58ef03a6909d5dfb0292a6b2576)
(cherry picked from commit be6ab8b589)

* Prompt before connecting to non-loopback remote host:port authorities (#46)

A direct `<host>:<port>` remote authority (no resolver `+` prefix) bypasses
resolver extensions and connects straight to the given server. Since this form
can originate from untrusted sources (e.g. the `remoteAuthority` of a
`.code-workspace` file), a crafted workspace could silently point the window's
extension host backend at an attacker-controlled server.

Centralize a confirmation prompt at the connection point in the renderer:
when resolving a direct authority whose host is not loopback (localhost,
127.0.0.1, ::1), ask the user to confirm before connecting and abort if
declined. Add `isLoopbackHost` helper and tests.

(cherry picked from commit 9505d0fca49eadb707c450d18dcb41a46b720a9e)
(cherry picked from commit 9673132502)

* GitHub - improve host parsing (#48)

(cherry picked from commit 4b6e2467dbd828018d602f73cc25d1b11f699d2c)
(cherry picked from commit 9fea92e141)

* path traversal fix (#50)

* fix path traversal

* fix compilation

(cherry picked from commit 9b31ff896671125cbfc65f33731c4a99660d6201)
(cherry picked from commit a703741497)

* Path - improve isEqualOrParent calculation (#49)

(cherry picked from commit 0f1ba1ea103757f3023cc1f9c3eb7327c3ec4b02)
(cherry picked from commit 5927baa7af)

---------

Co-authored-by: Zhichao Li <Li.Zhichao@microsoft.com>
Co-authored-by: Zhichao Li <zhichli@microsoft.com>
Co-authored-by: Alexandru Dima <alexdima@microsoft.com>
Co-authored-by: Ladislau Szomoru <lszomoru@microsoft.com>
Co-authored-by: Sandeep Somavarapu <sasomava@microsoft.com>
2026-06-09 14:26:48 -07:00

66 lines
1.9 KiB
TypeScript

/*---------------------------------------------------------------------------------------------
* Copyright (c) Microsoft Corporation. All rights reserved.
* Licensed under the MIT License. See License.txt in the project root for license information.
*--------------------------------------------------------------------------------------------*/
import type { CredentialsProvider, Credentials, API as GitAPI } from './typings/git.d.ts';
import { workspace, Uri, Disposable } from 'vscode';
import { getSession } from './auth.js';
const EmptyDisposable: Disposable = { dispose() { } };
class GitHubCredentialProvider implements CredentialsProvider {
async getCredentials(host: Uri): Promise<Credentials | undefined> {
const hostname = host.authority.replace(/:\d+$/, '').toLowerCase();
if (hostname !== 'github.com') {
return;
}
const session = await getSession();
return { username: session.account.id, password: session.accessToken };
}
}
export class GithubCredentialProviderManager {
private providerDisposable: Disposable = EmptyDisposable;
private readonly disposable: Disposable;
private _enabled = false;
private set enabled(enabled: boolean) {
if (this._enabled === enabled) {
return;
}
this._enabled = enabled;
if (enabled) {
this.providerDisposable = this.gitAPI.registerCredentialsProvider(new GitHubCredentialProvider());
} else {
this.providerDisposable.dispose();
}
}
constructor(private gitAPI: GitAPI) {
this.disposable = workspace.onDidChangeConfiguration(e => {
if (e.affectsConfiguration('github')) {
this.refresh();
}
});
this.refresh();
}
private refresh(): void {
const config = workspace.getConfiguration('github', null);
const enabled = config.get<boolean>('gitAuthentication', true);
this.enabled = !!enabled;
}
dispose(): void {
this.enabled = false;
this.disposable.dispose();
}
}