@codingame/monaco-vscode-extensions-service-override 35.0.0 → 35.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codingame/monaco-vscode-extensions-service-override",
-  "version": "35.0.0",
+  "version": "35.0.1",
   "private": false,
   "description": "VSCode public API plugged on the monaco editor - extensions service-override",
   "keywords": [],
@@ -15,8 +15,8 @@
   },
   "type": "module",
   "dependencies": {
-    "@codingame/monaco-vscode-api": "35.0.0",
-    "@codingame/monaco-vscode-files-service-override": "35.0.0"
+    "@codingame/monaco-vscode-api": "35.0.1",
+    "@codingame/monaco-vscode-files-service-override": "35.0.1"
   },
   "main": "index.js",
   "module": "index.js",

package/vscode/src/vs/workbench/services/extensions/worker/webWorkerExtensionHostIframe.html

@@ -4,7 +4,7 @@
 		<meta http-equiv="Content-Security-Policy" content="
 			default-src 'none';
 			child-src 'self' data: blob:;
-			script-src 'self' 'unsafe-eval' 'sha256-YenIR0w2uOJMq12UhbL15PlQWd7gf4v3ThVTe/nvZZE=' data: extension-file: https: http://localhost:* blob:;
+			script-src 'self' 'unsafe-eval' 'sha256-LfSEPWgJAtrOdr34EHjreixgIIu+NHGT7RYTpV0eCBA=' data: extension-file: https: http://localhost:* blob:;
 			connect-src 'self' data: extension-file: https: wss: http://localhost:* http://127.0.0.1:* ws://localhost:* ws://127.0.0.1:*;"/>
 	</head>
 	<body>
@@ -13,14 +13,23 @@
 	const searchParams = new URL(document.location.href).searchParams;
 	const vscodeWebWorkerExtHostId = searchParams.get('vscodeWebWorkerExtHostId') || '';
 	const name = searchParams.get('debugged') ? 'DebugExtensionHostWorker' : 'ExtensionHostWorker';
-	const parentOrigin = searchParams.get('parentOrigin') || window.origin;
+	const parentOriginParam = searchParams.get('parentOrigin');
+	const parentOrigin = parentOriginParam || window.origin;
 	const salt = searchParams.get('salt');
 
 	(async function () {
 		const hostnameValidationMarker = 'v--';
 		const hostname = location.hostname;
 		if (!hostname.startsWith(hostnameValidationMarker)) {
-			// validation not requested
+			// Validation not requested by the hosting origin. In this configuration the iframe is
+			// expected to be same-origin with its parent, so a caller-supplied `parentOrigin` that
+			// differs from `window.origin` must be rejected. Otherwise an attacker who can trick a
+			// user into navigating to this static page could supply their own `parentOrigin`, receive
+			// the bootstrap handshake, and cause the iframe to `import()` attacker-controlled worker
+			// code inside the authenticated origin.
+			if (parentOriginParam && parentOriginParam !== window.origin) {
+				return sendError(new Error(`Refusing to load: 'parentOrigin' does not match window origin and hostname validation is not enabled.`));
+			}
 			return start();
 		}
 		if (!crypto.subtle) {