Security: Multiple vulnerabilities found via Snyk Code Analysis (XSS, Path Traversal, ReDoS, Open Redirect)

Inizia rieseguendo Snyk Code Analysis sul main branch in prossimità di v4.112.0, quindi esamina le posizioni segnalate in src/node/routes/errors.ts, login.ts, vscode.ts, domainProxy.ts, index.ts e src/node/app.ts. Separa i rilievi di produzione dai rilievi a bassa gravità nei file di test, conferma ogni vulnerabilità e considera le mitigazioni suggerite. Il lavoro è concluso quando i rilievi di produzione confermati sono stati risolti e l'analisi non li segnala più.

Summary

Snyk Code Analysis identified 65 issues across 92 analyzed files in code-server. The High severity findings affect production deployments.

High Severity (7 issues)

Cross-site Scripting (XSS) — CWE-79, Score 807

• src/node/routes/errors.ts line 56
• src/node/routes/login.ts lines 68, 119

User-controlled input may be rendered without proper HTML escaping in error and login responses.

Path Traversal — CWE-23, Score 804

• src/node/routes/vscode.ts lines 149, 219

User-supplied path components may allow reading files outside the intended directory.

Regular Expression Denial of Service (ReDoS) — CWE-400, Score 752

• src/node/routes/domainProxy.ts line 46

A regex pattern may cause catastrophic backtracking with crafted input.

Medium Severity (14 issues)

Open Redirect — CWE-601, Score 557

• src/node/routes/login.ts lines 62, 99
• src/node/routes/index.ts line 94

Allocation of Resources Without Limits — CWE-770, Score 555

• src/node/routes/errors.ts line 37
• src/node/routes/vscode.ts line 213

Information Exposure via X-Powered-By — CWE-200, Score 554

• src/node/app.ts line 70

Sensitive Cookie Without Secure/HttpOnly Flags — CWE-614/CWE-1004, Score 402

• src/node/routes/login.ts line 96

Low Severity (44 issues)

Primarily in test files (hardcoded passwords, cleartext HTTP). Not production concerns.

Reproduction

Scanned with Snyk Code Analysis on code-server main branch (commit near v4.112.0).

Suggested Fixes

• XSS: HTML-encode user input before rendering in error/login templates
• Path Traversal: Resolve and validate paths against intended root directory
• ReDoS: Simplify or replace the vulnerable regex pattern
• Open Redirect: Validate redirect URLs against an allowlist
• X-Powered-By: Disable with app.disable('x-powered-by')
• Cookie flags: Add Secure and HttpOnly to session cookies

Happy to submit PRs for any of these if the team confirms the approach.