ResolvedAuthority allows ports outside the valid TCP range
- Dominant language
- TypeScript
- Stars
- 193k
- Forks
- 42.4k
- PR merge metrics
- PR metrics pending
Description
Does this issue occur when all extensions are disabled?: N/A
- VS Code Version: Current `main` branch
- OS Version: N/A
## Description
The `ResolvedAuthority` constructor validates that the supplied port is a nonzero integer, but it does not appear to validate that the port falls within the valid TCP port range.
The current check is:
if (typeof port !== 'number' || port === 0 || Math.round(port) !== port) {
throw illegalArgument('port');
}
This rejects `0` and fractional values, but values such as `-1` and `65536` appear to pass the constructor validation.
## Relevant code path
A resolver can construct values such as:
new vscode.ResolvedAuthority('localhost', -1);
new vscode.ResolvedAuthority('localhost', 65536);
The accepted port is then used to create a `WebSocketRemoteConnection`.
That connection data is passed to `RemoteAuthorities.set(...)`, which stores the port without additional range validation.
The stored value is later used when constructing the remote resource authority:
authority: `${host}:${port}`
This can produce invalid authorities such as:
localhost:-1
localhost:65536
## Expected behavior
`ResolvedAuthority` should reject port values outside the range `1` through `65535`.
## Possible validation
if (
typeof port !== 'number'
|| !Number.isInteger(port)
|| port < 1
|| port > 65535
) {
throw illegalArgument('port');
}
## Suggested tests
Constructor tests could cover:
- `-1`, rejected
- `0`, rejected
- `1`, accepted
- `65535`, accepted
- `65536`, rejected
- fractional values, rejected
Contributor guide
Research direction
Start at the TypeScript ResolvedAuthority constructor and trace how its port reaches WebSocketRemoteConnection and RemoteAuthorities.set. Add or update constructor tests for -1, 0, 1, 65535, 65536, and fractional values; done means only ports from 1 through 65535 are accepted and invalid authorities cannot be produced.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- networking
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 72/100