microsoft / microsoft/vscode

ResolvedAuthority allows ports outside the valid TCP range

Open Beginner friendly
#328,037 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
193k
Forks
42.4k
PR merge metrics
PR metrics pending

Description

Does this issue occur when all extensions are disabled?: N/A

- VS Code Version: Current `main` branch
- OS Version: N/A

## Description

The `ResolvedAuthority` constructor validates that the supplied port is a nonzero integer, but it does not appear to validate that the port falls within the valid TCP port range.

The current check is:

if (typeof port !== 'number' || port === 0 || Math.round(port) !== port) {
throw illegalArgument('port');
}

This rejects `0` and fractional values, but values such as `-1` and `65536` appear to pass the constructor validation.

## Relevant code path

A resolver can construct values such as:

new vscode.ResolvedAuthority('localhost', -1);
new vscode.ResolvedAuthority('localhost', 65536);

The accepted port is then used to create a `WebSocketRemoteConnection`.

That connection data is passed to `RemoteAuthorities.set(...)`, which stores the port without additional range validation.

The stored value is later used when constructing the remote resource authority:

authority: `${host}:${port}`

This can produce invalid authorities such as:

localhost:-1
localhost:65536

## Expected behavior

`ResolvedAuthority` should reject port values outside the range `1` through `65535`.

## Possible validation

if (
typeof port !== 'number'
|| !Number.isInteger(port)
|| port < 1
|| port > 65535
) {
throw illegalArgument('port');
}

## Suggested tests

Constructor tests could cover:

- `-1`, rejected
- `0`, rejected
- `1`, accepted
- `65535`, accepted
- `65536`, rejected
- fractional values, rejected

Contributor guide

Open the contributing guide

Research direction

Start at the TypeScript ResolvedAuthority constructor and trace how its port reaches WebSocketRemoteConnection and RemoteAuthorities.set. Add or update constructor tests for -1, 0, 1, 65535, 65536, and fractional values; done means only ports from 1 through 65535 are accepted and invalid authorities cannot be produced.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
networking
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.