Normalize webview resources when checking roots

[mjbvz]

VS Code - Information Disclosure Vulnerability

An information disclosure vulnerability exists in VS Code 1.71 and earlier versions. If an attacker is able to run arbitrary scripts inside of a webview (either created by extension or by core VS Code), the attacker could bypass the local resource roots check to read arbitrary files on the user's system

Patches

The fix is available starting with VS Code 1.71.1. The fix mitigates this attack by performing input validation on the URL pointing to the repository to be cloned.

Workarounds

Only use webviews from extensions that follow proper security measures to block script injection

Do not disable VS Code's default security measures in the built-in markdown preview

References

• The patch for this can be found at fad9089
• An advisory for this can be found at GHSA-fj7x-w8c2-xx4c
• MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41042

[gjsjohnmurray]

Should the references to 1.71 in fact be 1.72?