Skip to content

fix(security): address VS Code extension vulnerabilities — prototype pollution, token exposure, ReDoS, missing CSP #489

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
imran-siddique merged 5 commits into from
Mar 28, 2026
Merged

fix(security): address VS Code extension vulnerabilities — prototype pollution, token exposure, ReDoS, missing CSP #489

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
6ab05fa
fix: npm build failures + NuGet publish via NuGetCommand
imran-siddique Mar 27, 2026
553d921
Merge branch 'main' of https://github.com/microsoft/agent-governance-…
imran-siddique Mar 28, 2026
e51eb0e
fix(security): address 5 VS Code extension vulnerabilities (#486, #48…
imran-siddique Mar 28, 2026
968c2d5
Merge branch 'main' into fix/vscode-security-issues
imran-siddique Mar 28, 2026
abec448
Merge branch 'main' into fix/vscode-security-issues
imran-siddique Mar 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4,120 changes: 4,120 additions & 0 deletions packages/agent-os/extensions/vscode/package-lock.json
View file
Open in desktop

Large diffs are not rendered by default.

20 changes: 18 additions & 2 deletions packages/agent-os/extensions/vscode/src/enterprise/auth/ssoProvider.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ export class EnterpriseAuthProvider {
this._registerProviders();
}

private _loadState(): void {
private async _loadState(): Promise<void> {
const savedState = this._context.globalState.get<AuthState>('agent-os.authState');
if (savedState) {
this._state = savedState;
Expand All @@ -59,6 +59,13 @@ export class EnterpriseAuthProvider {
this._state = { isAuthenticated: false };
}
}
// Restore token from SecretStorage
if (this._state?.user) {
const token = await this._context.secrets.get('agent-os.authToken');
if (token) {
this._state.user.token = token;
}
}
}

private _registerProviders(): void {
Expand Down Expand Up @@ -185,7 +192,16 @@ export class EnterpriseAuthProvider {
}

private async _saveState(): Promise<void> {
await this._context.globalState.update('agent-os.authState', this._state);
// Store token in SecretStorage, not globalState
if (this._state?.user?.token) {
await this._context.secrets.store('agent-os.authToken', this._state.user.token);
}
// Strip token from globalState persistence
const safeState = this._state ? {
...this._state,
user: this._state.user ? { ...this._state.user, token: undefined } : undefined,
} : null;
await this._context.globalState.update('agent-os.authState', safeState);
}

hasRole(role: string): boolean {
Expand Down
9 changes: 7 additions & 2 deletions packages/agent-os/extensions/vscode/src/extension.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@
*/

import * as vscode from 'vscode';
import * as crypto from 'crypto';
import { PolicyEngine } from './policyEngine';
import { CMVKClient } from './cmvkClient';
import { AuditLogger } from './auditLogger';
Expand Down Expand Up @@ -481,7 +482,7 @@ async function reviewCodeWithCMVK(code: string, language: string): Promise<void>
{ enableScripts: true }
);

panel.webview.html = generateCMVKResultsHTML(result);
panel.webview.html = generateCMVKResultsHTML(result, panel.webview);

// Log the review
auditLogger.log({
Expand All @@ -501,7 +502,9 @@ async function reviewCodeWithCMVK(code: string, language: string): Promise<void>
});
}

function generateCMVKResultsHTML(result: any): string {
function generateCMVKResultsHTML(result: any, webview: vscode.Webview): string {
const nonce = crypto.randomBytes(16).toString('base64');
const cspSource = webview.cspSource;
const consensusColor = result.consensus >= 0.8 ? '#28a745'
: result.consensus >= 0.5 ? '#ffc107'
: '#dc3545';
Expand All @@ -522,6 +525,8 @@ function generateCMVKResultsHTML(result: any): string {
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src ${cspSource} 'unsafe-inline'; script-src 'nonce-${nonce}'; img-src ${cspSource} https:; font-src ${cspSource};">
<style>
body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; padding: 20px; }
.consensus { font-size: 24px; font-weight: bold; color: ${consensusColor}; }
Expand Down
Loading
Loading