From 9c216cef7f5a0ab17dd21ed24d4d955eae440c1c Mon Sep 17 00:00:00 2001 From: anupamme Date: Fri, 31 Jul 2026 00:08:40 +0000 Subject: [PATCH 1/4] fix: V-001 security vulnerability Automated security fix generated by OrbisAI Security --- src/node/routes/vscode.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/node/routes/vscode.ts b/src/node/routes/vscode.ts index 3ff64a179604..6eda3cc718a9 100644 --- a/src/node/routes/vscode.ts +++ b/src/node/routes/vscode.ts @@ -210,7 +210,7 @@ router.get("/manifest.json", async (req, res) => { }) let mintKeyPromise: Promise | undefined -router.post("/mint-key", async (req, res) => { +router.post("/mint-key", ensureOrigin, ensureAuthenticated, async (req, res) => { if (!mintKeyPromise) { mintKeyPromise = new Promise(async (resolve) => { const keyPath = path.join(req.args["user-data-dir"], "serve-web-key-half") From b6409d323c977f5442a04bd65fc50d0752f8866a Mon Sep 17 00:00:00 2001 From: Asher Date: Mon, 3 Aug 2026 07:46:39 -0800 Subject: [PATCH 2/4] Remove ensureOrigin --- src/node/routes/vscode.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/node/routes/vscode.ts b/src/node/routes/vscode.ts index 6eda3cc718a9..f8c048c6f036 100644 --- a/src/node/routes/vscode.ts +++ b/src/node/routes/vscode.ts @@ -210,7 +210,7 @@ router.get("/manifest.json", async (req, res) => { }) let mintKeyPromise: Promise | undefined -router.post("/mint-key", ensureOrigin, ensureAuthenticated, async (req, res) => { +router.post("/mint-key", ensureAuthenticated, async (req, res) => { if (!mintKeyPromise) { mintKeyPromise = new Promise(async (resolve) => { const keyPath = path.join(req.args["user-data-dir"], "serve-web-key-half") From 92cee676100c233b73aa044ff7011c5aa2d57083 Mon Sep 17 00:00:00 2001 From: Asher Date: Mon, 3 Aug 2026 07:54:05 -0800 Subject: [PATCH 3/4] Add a test --- test/unit/node/routes/vscode.test.ts | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/test/unit/node/routes/vscode.test.ts b/test/unit/node/routes/vscode.test.ts index a5a4fb72da7a..e8096ac29828 100644 --- a/test/unit/node/routes/vscode.test.ts +++ b/test/unit/node/routes/vscode.test.ts @@ -4,11 +4,15 @@ import * as integration from "../../../utils/integration" describe("vscode", () => { let codeServer: httpserver.HttpServer | undefined + // TODO: Support setting this as an argument for tests. + const previousEnvPassword = process.env.PASSWORD beforeEach(() => { + process.env.PASSWORD = "test" mockLogger() }) afterEach(async () => { + process.env.PASSWORD = previousEnvPassword if (codeServer) { await codeServer.dispose() codeServer = undefined @@ -27,4 +31,10 @@ describe("vscode", () => { }) }).rejects.toThrow() }) + + it("should require auth", async () => { + codeServer = await integration.setup(["--auth=password"], "") + let resp = await codeServer.fetch("/mint-key", { method: "POST" }) + expect(resp.status).toBe(401) + }) }) From db16e4db73e8b1025ac1312f7b0875c1a23c24a6 Mon Sep 17 00:00:00 2001 From: Asher Date: Mon, 3 Aug 2026 08:14:12 -0800 Subject: [PATCH 4/4] Setting env to undefined sets literal string --- test/unit/node/routes/vscode.test.ts | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/test/unit/node/routes/vscode.test.ts b/test/unit/node/routes/vscode.test.ts index e8096ac29828..80feefd99be2 100644 --- a/test/unit/node/routes/vscode.test.ts +++ b/test/unit/node/routes/vscode.test.ts @@ -12,7 +12,11 @@ describe("vscode", () => { }) afterEach(async () => { - process.env.PASSWORD = previousEnvPassword + if (typeof previousEnvPassword !== "undefined") { + process.env.PASSWORD = previousEnvPassword + } else { + delete process.env.PASSWORD + } if (codeServer) { await codeServer.dispose() codeServer = undefined