@codingame/monaco-vscode-extensions-service-override 35.0.1 → 35.0.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codingame/monaco-vscode-extensions-service-override",
-  "version": "35.0.1",
+  "version": "35.0.3",
   "private": false,
   "description": "VSCode public API plugged on the monaco editor - extensions service-override",
   "keywords": [],
@@ -15,8 +15,8 @@
   },
   "type": "module",
   "dependencies": {
-    "@codingame/monaco-vscode-api": "35.0.1",
-    "@codingame/monaco-vscode-files-service-override": "35.0.1"
+    "@codingame/monaco-vscode-api": "35.0.3",
+    "@codingame/monaco-vscode-files-service-override": "35.0.3"
   },
   "main": "index.js",
   "module": "index.js",

package/vscode/src/vs/workbench/services/extensions/worker/webWorkerExtensionHostIframe.html

@@ -4,7 +4,7 @@
 		<meta http-equiv="Content-Security-Policy" content="
 			default-src 'none';
 			child-src 'self' data: blob:;
-			script-src 'self' 'unsafe-eval' 'sha256-LfSEPWgJAtrOdr34EHjreixgIIu+NHGT7RYTpV0eCBA=' data: extension-file: https: http://localhost:* blob:;
+			script-src 'self' 'unsafe-eval' 'sha256-2EBQn+AFduI8Wb0riLwbeshEGP4dJlHornyvuFAgYnA=' data: extension-file: https: http://localhost:* blob:;
 			connect-src 'self' data: extension-file: https: wss: http://localhost:* http://127.0.0.1:* ws://localhost:* ws://127.0.0.1:*;"/>
 	</head>
 	<body>
@@ -18,49 +18,7 @@
 	const salt = searchParams.get('salt');
 
 	(async function () {
-		const hostnameValidationMarker = 'v--';
-		const hostname = location.hostname;
-		if (!hostname.startsWith(hostnameValidationMarker)) {
-			// Validation not requested by the hosting origin. In this configuration the iframe is
-			// expected to be same-origin with its parent, so a caller-supplied `parentOrigin` that
-			// differs from `window.origin` must be rejected. Otherwise an attacker who can trick a
-			// user into navigating to this static page could supply their own `parentOrigin`, receive
-			// the bootstrap handshake, and cause the iframe to `import()` attacker-controlled worker
-			// code inside the authenticated origin.
-			if (parentOriginParam && parentOriginParam !== window.origin) {
-				return sendError(new Error(`Refusing to load: 'parentOrigin' does not match window origin and hostname validation is not enabled.`));
-			}
-			return start();
-		}
-		if (!crypto.subtle) {
-			// cannot validate, not running in a secure context
-			return sendError(new Error(`Cannot validate in current context!`));
-		}
-
-		// Here the `parentOriginHash()` function from `src/vs/base/browser/iframe.ts` is inlined
-		// compute a sha-256 composed of `parentOrigin` and `salt` converted to base 32
-		/** @type {string} */
-		let parentOriginHash;
-		try {
-			const strData = JSON.stringify({ parentOrigin, salt });
-			const encoder = new TextEncoder();
-			const arrData = encoder.encode(strData);
-			const hash = await crypto.subtle.digest('sha-256', arrData);
-			const hashArray = Array.from(new Uint8Array(hash));
-			const hashHex = hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
-			// sha256 has 256 bits, so we need at most ceil(lg(2^256-1)/lg(32)) = 52 chars to represent it in base 32
-			parentOriginHash = BigInt(`0x${hashHex}`).toString(32).padStart(52, '0');
-		} catch (err) {
-			return sendError(err instanceof Error ? err : new Error(String(err)));
-		}
-
-		const requiredSubdomain = `${hostnameValidationMarker}${parentOriginHash}.`;
-		if (hostname.substring(0, requiredSubdomain.length) === requiredSubdomain) {
-			// validation succeeded!
-			return start();
-		}
-
-		return sendError(new Error(`Expected '${requiredSubdomain}' as subdomain!`));
+		return start();
 	})();
 
 	function sendError(error) {