microsoft / microsoft/WinAppVSCE
Security: Scope webview localResourceRoots to manifest package root only
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 13
- Forks
- 3
- Avg merge
- 6d 1h
- Merged PRs (30d)
- 11
Description
Description
The manifest editor webview adds all workspace folder roots to \localResourceRoots, widening file access beyond the manifest's package directory.
Impact
A crafted manifest with ..\ paths in image references could read files from any workspace folder root through the webview.
Recommendation
Keep \localResourceRoots\ scoped to the manifest directory/package root only. Handle out-of-package assets through an explicit copy/import flow.
Context
Identified during PR review of #68. Pre-existing manifest editor behavior, not introduced by the IntelliSense feature.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate the manifest editor webview setup that assigns localResourceRoots and inspect how workspace folder roots are added. Reproduce the crafted manifest path traversal described in the issue, then verify resources are limited to the manifest package root and that out-of-package assets use an explicit copy/import flow.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- frontend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100