microsoft / microsoft/WinAppVSCE

Security: Scope webview localResourceRoots to manifest package root only

Open
#107 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
TypeScript
Stars
13
Forks
3
Avg merge
6d 1h
Merged PRs (30d)
11

Description

Description

The manifest editor webview adds all workspace folder roots to \localResourceRoots, widening file access beyond the manifest's package directory.

Impact

A crafted manifest with ..\ paths in image references could read files from any workspace folder root through the webview.

Recommendation

Keep \localResourceRoots\ scoped to the manifest directory/package root only. Handle out-of-package assets through an explicit copy/import flow.

Context

Identified during PR review of #68. Pre-existing manifest editor behavior, not introduced by the IntelliSense feature.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Locate the manifest editor webview setup that assigns localResourceRoots and inspect how workspace folder roots are added. Reproduce the crafted manifest path traversal described in the issue, then verify resources are limited to the manifest package root and that out-of-package assets use an explicit copy/import flow.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
frontend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.