andy/nexus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

fix: harden VS Code bridge and webview CSP

Browse Source
This commit is contained in:
Andy Dixon
2026-06-24 09:45:36 +01:00
parent 07c31b5d1e
commit 3a16a14d6e
5 changed files with 129 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/vscode-bridge/main.go
+26 -3
View File
@@ -47,6 +47,14 @@ type runtimeEventRequest struct {
Payload map[string]any `json:"payload"`
}
const (
bridgeReadHeaderTimeout = 5 * time.Second
bridgeReadTimeout = 15 * time.Second
bridgeIdleTimeout = 60 * time.Second
bridgeMaxHeaderBytes = 16 << 10
bridgeMaxJSONBodyBytes = 1 << 20
)
type eventBroker struct {
mu sync.Mutex
clients map[chan []byte]struct{}
@@ -115,7 +123,7 @@ func main() {
mux.HandleFunc("/events", bridge.auth(token, bridge.handleEvents))
mux.HandleFunc("/runtime/event", bridge.auth(token, bridge.handleRuntimeEvent))
server := &http.Server{Handler: mux}
server := newBridgeHTTPServer(mux)
listener, err := net.Listen("tcp", *listenAddr)
if err != nil {
log.Fatalf("listen: %v", err)
@@ -207,7 +215,7 @@ func (a *bridgeApp) handleRPC(w http.ResponseWriter, r *http.Request) {
return
}
var req rpcRequest
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
if err := decodeLimitedJSON(w, r, &req); err != nil {
writeJSON(w, rpcResponse{Error: err.Error()})
return
}
@@ -225,7 +233,7 @@ func (a *bridgeApp) handleRuntimeEvent(w http.ResponseWriter, r *http.Request) {
return
}
var req runtimeEventRequest
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
if err := decodeLimitedJSON(w, r, &req); err != nil {
writeJSON(w, rpcResponse{Error: err.Error()})
return
}
@@ -325,6 +333,21 @@ func randomToken() (string, error) {
return hex.EncodeToString(b[:]), nil
}
func newBridgeHTTPServer(handler http.Handler) *http.Server {
return &http.Server{
Handler: handler,
ReadHeaderTimeout: bridgeReadHeaderTimeout,
ReadTimeout: bridgeReadTimeout,
IdleTimeout: bridgeIdleTimeout,
MaxHeaderBytes: bridgeMaxHeaderBytes,
}
}
func decodeLimitedJSON(w http.ResponseWriter, r *http.Request, dst any) error {
r.Body = http.MaxBytesReader(w, r.Body, bridgeMaxJSONBodyBytes)
return json.NewDecoder(r.Body).Decode(dst)
}
func writeJSON(w http.ResponseWriter, value any) {
w.Header().Set("Content-Type", "application/json")
_ = json.NewEncoder(w).Encode(value)
cmd/vscode-bridge/main_test.go
+66
View File
@@ -0,0 +1,66 @@
package main
import (
"encoding/json"
"net/http"
"net/http/httptest"
"strings"
"testing"
)
func TestNewBridgeHTTPServerSetsResourceLimits(t *testing.T) {
server := newBridgeHTTPServer(http.NewServeMux())
if server.ReadHeaderTimeout != bridgeReadHeaderTimeout {
t.Fatalf("ReadHeaderTimeout = %s, want %s", server.ReadHeaderTimeout, bridgeReadHeaderTimeout)
}
if server.ReadTimeout != bridgeReadTimeout {
t.Fatalf("ReadTimeout = %s, want %s", server.ReadTimeout, bridgeReadTimeout)
}
if server.IdleTimeout != bridgeIdleTimeout {
t.Fatalf("IdleTimeout = %s, want %s", server.IdleTimeout, bridgeIdleTimeout)
}
if server.MaxHeaderBytes != bridgeMaxHeaderBytes {
t.Fatalf("MaxHeaderBytes = %d, want %d", server.MaxHeaderBytes, bridgeMaxHeaderBytes)
}
}
func TestHandleRPCRejectsOversizedJSONBody(t *testing.T) {
app := &bridgeApp{}
largeBody := `{"method":"ListProfiles","args":[],"pad":"` + strings.Repeat("x", bridgeMaxJSONBodyBytes) + `"}`
req := httptest.NewRequest(http.MethodPost, "/rpc", strings.NewReader(largeBody))
rec := httptest.NewRecorder()
app.handleRPC(rec, req)
if rec.Code != http.StatusOK {
t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)
}
var resp rpcResponse
if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
t.Fatalf("response is not JSON: %v", err)
}
if !strings.Contains(resp.Error, "request body too large") {
t.Fatalf("error = %q, want request body limit error", resp.Error)
}
}
func TestHandleRuntimeEventRejectsOversizedJSONBody(t *testing.T) {
app := &bridgeApp{}
largeBody := `{"name":"session:secret:response","payload":{"pad":"` + strings.Repeat("x", bridgeMaxJSONBodyBytes) + `"}}`
req := httptest.NewRequest(http.MethodPost, "/runtime/event", strings.NewReader(largeBody))
rec := httptest.NewRecorder()
app.handleRuntimeEvent(rec, req)
if rec.Code != http.StatusOK {
t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)
}
var resp rpcResponse
if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
t.Fatalf("response is not JSON: %v", err)
}
if !strings.Contains(resp.Error, "request body too large") {
t.Fatalf("error = %q, want request body limit error", resp.Error)
}
}
frontend/scripts/test-regressions.js
+15
View File
@@ -219,6 +219,21 @@ assertContains(
"VNC Connections",
"in-app help must document VNC connection profiles",
);
assertContains(
"vscode/nexus/extension.js",
"crypto.randomBytes(16).toString('base64')",
"Nexus VS Code webview CSP nonces must use cryptographic randomness",
);
assertContains(
"vscode/leviathan/extension.js",
"crypto.randomBytes(16).toString('base64')",
"Leviathan VS Code webview CSP nonces must use cryptographic randomness",
);
assertTreeNotContains(
"vscode",
"const nonce = String(Date.now());",
"VS Code webview CSP nonces must not be predictable timestamps",
);
assertContains(
"docs/user-manual.md",
"## 11. Leviathan binary workbench",
vscode/leviathan/extension.js
+8 -3
View File
@@ -2,10 +2,15 @@
const vscode = require('vscode');
const cp = require('child_process');
const crypto = require('crypto');
const fs = require('fs');
const http = require('http');
const path = require('path');
function createCSPNonce() {
return crypto.randomBytes(16).toString('base64');
}
const TOOLS = [
['Editor', 'hex', 'Hex Editor', 'Browse and patch bytes in the working copy.'],
['Triage', 'overview', 'Overview', 'Fast first-pass summary across hashes, strings, entropy and IOCs.'],
@@ -181,7 +186,7 @@ class ToolsView {
}
html(webview) {
const nonce = String(Date.now());
const nonce = createCSPNonce();
const toolsJson = JSON.stringify(TOOLS);
return `<!doctype html>
<html>
@@ -489,7 +494,7 @@ class ToolPanel {
}
hexHtml(meta) {
const nonce = String(Date.now());
const nonce = createCSPNonce();
const initialFileState = JSON.stringify(this.fileState || null);
const name = escapeHtml(meta.name);
return `<!doctype html>
@@ -765,7 +770,7 @@ class ToolPanel {
}
html(meta) {
const nonce = String(Date.now());
const nonce = createCSPNonce();
const defaults = JSON.stringify(DEFAULTS[this.tool] || {});
const initialFileState = JSON.stringify(this.fileState || null);
const name = escapeHtml(meta.name);
vscode/nexus/extension.js
+14 -9
View File
@@ -2,10 +2,15 @@
const vscode = require('vscode');
const cp = require('child_process');
const crypto = require('crypto');
const fs = require('fs');
const http = require('http');
const path = require('path');
function createCSPNonce() {
return crypto.randomBytes(16).toString('base64');
}
class Bridge {
constructor(context) {
this.context = context;
@@ -211,7 +216,7 @@ class ConnectionsProvider {
}
html(webview) {
const nonce = String(Date.now());
const nonce = createCSPNonce();
return `<!doctype html>
<html>
<head>
@@ -546,7 +551,7 @@ class TerminalPanel {
const fitJs = webview.asWebviewUri(vscode.Uri.joinPath(mediaRoot, 'xterm-addon-fit.min.js'));
const unicodeJs = webview.asWebviewUri(vscode.Uri.joinPath(mediaRoot, 'xterm-addon-unicode11.min.js'));
const xtermCss = webview.asWebviewUri(vscode.Uri.joinPath(mediaRoot, 'xterm.css'));
const nonce = String(Date.now());
const nonce = createCSPNonce();
const terminalFontFamily = JSON.stringify(this.profile.terminalFontFamily || '');
const terminalFontSize = Number(this.profile.terminalFontSize || 13);
const terminalScrollback = Number(this.profile.terminalScrollback || 10000);
@@ -887,7 +892,7 @@ class RawPanel {
}
html() {
const nonce = String(Date.now());
const nonce = createCSPNonce();
return `<!doctype html>
<html>
<head>
@@ -1053,7 +1058,7 @@ class GitHubPanel {
}
html() {
const nonce = String(Date.now());
const nonce = createCSPNonce();
return `<!doctype html>
<html>
<head>
@@ -1154,7 +1159,7 @@ class IRCPanel {
}
html() {
const nonce = String(Date.now());
const nonce = createCSPNonce();
return `<!doctype html>
<html>
<head>
@@ -1252,7 +1257,7 @@ class VNCPanel {
const webview = this.panel.webview;
const mediaRoot = vscode.Uri.file(path.join(this.context.extensionPath, 'media'));
const noVncJs = webview.asWebviewUri(vscode.Uri.joinPath(mediaRoot, 'novnc.min.js'));
const nonce = String(Date.now());
const nonce = createCSPNonce();
const vncConfig = JSON.stringify((this.profile && this.profile.vnc) || {});
return `<!doctype html>
<html>
@@ -1367,7 +1372,7 @@ class ProfileEditorPanel {
}
html() {
const nonce = String(Date.now());
const nonce = createCSPNonce();
const profileJson = JSON.stringify(this.profile);
return `<!doctype html>
<html>
@@ -1610,7 +1615,7 @@ class SettingsPanel {
}
html() {
const nonce = String(Date.now());
const nonce = createCSPNonce();
return `<!doctype html>
<html>
<head>
@@ -1824,7 +1829,7 @@ class SFTPPanel {
}
html() {
const nonce = String(Date.now());
const nonce = createCSPNonce();
return `<!doctype html>
<html>
<head>