Security: Unrestricted File System Access in Webview Configuration

[cedricvidal]

Summary

The webview configuration in src/extension.ts grants unrestricted read access to the entire file system, which violates the principle of least privilege and creates a significant security risk.

Severity

Critical - This allows the webview to load and read any file on the user's system that the VS Code process has access to.

Affected Platforms

• ⚠️ Linux/macOS: Access to entire filesystem via root /
• ⚠️ Windows: Access to all drive letters (A: through Z:)

This is NOT a Windows-only issue - it affects all platforms.

Location

src/extension.ts, line 113:

static getWebviewOptions(
  uri?: vscode.Uri
): vscode.WebviewOptions & vscode.WebviewPanelOptions {
  return {
    enableScripts: true,
    localResourceRoots: [vscode.Uri.file("/"), ...this.getFolders()],
    retainContextWhenHidden: true,
    enableCommandUris: true,
  }
}

The getFolders() method adds all possible drive letters (A-Z):

private static getFolders(): vscode.Uri[] {
  const data = []
  for (let i = 65; i <= 90; i++) {
    data.push(vscode.Uri.file(`${String.fromCharCode(i)}:/`))
  }
  return data
}

What localResourceRoots Actually Does

The localResourceRoots configuration controls which local filesystem paths the webview can load resources from. This is not just listing directories - it grants read access to files within those roots.

When webview code calls:

const resourceUri = webview.asWebviewUri(vscode.Uri.file('/any/file/path'));

VS Code checks if the path falls under localResourceRoots. With the current configuration, ANY file path would be allowed.

Security Risk

1. Information Disclosure: The webview can load and read ANY file the VS Code process can access:

   • /etc/passwd, /etc/shadow on Linux
   • C:/Users/*/Documents/*, SSH keys, credentials, etc. on Windows
   • User home directories, config files, source code, etc.

2. XSS Exploitation: If the webview has any XSS vulnerability, an attacker could:

   // Malicious script could read sensitive files
   const img = document.createElement('img');
   img.src = webview.asWebviewUri(vscode.Uri.file('/home/user/.ssh/id_rsa'));
   img.onload = () => exfiltrateData(img);

3. Supply Chain Risk: If any dependency used in the webview is compromised, it could access the entire filesystem

4. Violates VS Code Security Guidelines: This configuration goes against Microsoft's recommended security practices

Recommended Fix

Restrict localResourceRoots to only the directories actually needed, such as:

• The extension directory (for editor assets like CSS/JS)
• The markdown file's parent directory (for relative image paths)
• Workspace folders (if needed for markdown resources)

Avoid granting access to filesystem roots or all drive letters.

References

• VS Code Webview Security Guide
• VS Code Extension Security Best Practices
• localResourceRoots Documentation

Thank you for maintaining this extension!