Skip to content

Commit 13346bb

Browse files
NewtonDerNewtonDer
authored
Merge pull request #215 from austinjang2/1.5
[CE1.5] Fix CVE-2025-13223 and CVE-2025-13224: Update electron to v38.7.1
2 parents d25a355 + 2efbf2e commit 13346bb

File tree

10 files changed

+270
-19
lines changed

10 files changed

+270
-19
lines changed

‎patched-vscode/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,7 @@
149149
"cssnano": "^6.0.3",
150150
"debounce": "^1.0.0",
151151
"deemon": "^1.8.0",
152-
"electron": "29.4.0",
152+
"electron": "38.7.1",
153153
"eslint": "8.36.0",
154154
"eslint-plugin-header": "3.1.1",
155155
"eslint-plugin-jsdoc": "^46.5.0",

‎patched-vscode/src/vs/base/parts/ipc/electron-main/ipcMain.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ class ValidatedIpcMain implements Event.NodeEventEmitter {
111111

112112
const sender = event.senderFrame;
113113

114-
const url = sender.url;
114+
const url = sender?.url;
115115
// `url` can be `undefined` when running tests from playwright https://github.com/microsoft/vscode/issues/147301
116116
// and `url` can be `about:blank` when reloading the window
117117
// from performance tab of devtools https://github.com/electron/electron/issues/39427.
@@ -133,7 +133,7 @@ class ValidatedIpcMain implements Event.NodeEventEmitter {
133133
return false; // unexpected sender
134134
}
135135

136-
if (sender.parent !== null) {
136+
if (sender?.parent !== null) {
137137
onUnexpectedError(`Refused to handle ipcMain event for channel '${channel}' because sender of origin '${host}' is not a main frame.`);
138138
return false; // unexpected frame
139139
}

‎patched-vscode/src/vs/code/electron-main/app.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -195,7 +195,7 @@ export class CodeApplication extends Disposable {
195195
const supportedSvgSchemes = new Set([Schemas.file, Schemas.vscodeFileResource, Schemas.vscodeRemoteResource, Schemas.vscodeManagedRemoteResource, 'devtools']);
196196

197197
// But allow them if they are made from inside an webview
198-
const isSafeFrame = (requestFrame: WebFrameMain | undefined): boolean => {
198+
const isSafeFrame = (requestFrame: WebFrameMain | null | undefined): boolean => {
199199
for (let frame: WebFrameMain | null | undefined = requestFrame; frame; frame = frame.parent) {
200200
if (frame.url.startsWith(`${Schemas.vscodeWebview}://`)) {
201201
return true;

‎patched-vscode/src/vs/platform/dnd/browser/dnd.ts‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ import { VSBuffer } from 'vs/base/common/buffer';
1212
import { ResourceMap } from 'vs/base/common/map';
1313
import { parse } from 'vs/base/common/marshalling';
1414
import { Schemas } from 'vs/base/common/network';
15-
import { isWeb } from 'vs/base/common/platform';
15+
import { isNative, isWeb } from '../../../base/common/platform';
1616
import { URI } from 'vs/base/common/uri';
1717
import { localize } from 'vs/nls';
1818
import { IDialogService } from 'vs/platform/dialogs/common/dialogs';
@@ -407,4 +407,16 @@ export class LocalSelectionTransfer<T> {
407407
}
408408
}
409409

410+
/**
411+
* A helper to get access to Electrons `webUtils.getPathForFile` function
412+
* in a safe way without crashing the application when running in the web.
413+
*/
414+
export function getPathForFile(file: File): string | undefined {
415+
if (isNative && typeof (globalThis as any).vscode?.webUtils?.getPathForFile === 'function') {
416+
return (globalThis as any).vscode.webUtils.getPathForFile(file);
417+
}
418+
419+
return undefined;
420+
}
421+
410422
//#endregion

‎patched-vscode/src/vs/platform/menubar/electron-main/menubar.ts‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
* Licensed under the MIT License. See License.txt in the project root for license information.
44
*--------------------------------------------------------------------------------------------*/
55

6-
import { app, BrowserWindow, KeyboardEvent, Menu, MenuItem, MenuItemConstructorOptions, WebContents } from 'electron';
6+
import { app, BrowserWindow, BaseWindow, KeyboardEvent, Menu, MenuItem, MenuItemConstructorOptions, WebContents } from 'electron';
77
import { WorkbenchActionExecutedClassification, WorkbenchActionExecutedEvent } from 'vs/base/common/actions';
88
import { RunOnceScheduler } from 'vs/base/common/async';
99
import { CancellationToken } from 'vs/base/common/cancellation';
@@ -62,7 +62,7 @@ export class Menubar {
6262

6363
private keybindings: { [commandId: string]: IMenubarKeybinding };
6464

65-
private readonly fallbackMenuHandlers: { [id: string]: (menuItem: MenuItem, browserWindow: BrowserWindow | undefined, event: KeyboardEvent) => void } = Object.create(null);
65+
private readonly fallbackMenuHandlers: { [id: string]: (menuItem: MenuItem, browserWindow: BaseWindow | undefined, event: KeyboardEvent) => void } = Object.create(null);
6666

6767
constructor(
6868
@IUpdateService private readonly updateService: IUpdateService,
@@ -285,7 +285,7 @@ export class Menubar {
285285
const dockMenu = new Menu();
286286
dockMenu.append(new MenuItem({ label: this.mnemonicLabel(nls.localize({ key: 'miNewWindow', comment: ['&& denotes a mnemonic'] }, "New &&Window")), click: () => this.windowsMainService.openEmptyWindow({ context: OpenContext.DOCK }) }));
287287

288-
app.dock.setMenu(dockMenu);
288+
app.dock!.setMenu(dockMenu);
289289
}
290290

291291
// File
@@ -741,8 +741,8 @@ export class Menubar {
741741
return new MenuItem(this.withKeybinding(commandId, options));
742742
}
743743

744-
private makeContextAwareClickHandler(click: (menuItem: MenuItem, win: BrowserWindow, event: KeyboardEvent) => void, contextSpecificHandlers: IMenuItemClickHandler): (menuItem: MenuItem, win: BrowserWindow | undefined, event: KeyboardEvent) => void {
745-
return (menuItem: MenuItem, win: BrowserWindow | undefined, event: KeyboardEvent) => {
744+
private makeContextAwareClickHandler(click: (menuItem: MenuItem, win: BaseWindow, event: KeyboardEvent) => void, contextSpecificHandlers: IMenuItemClickHandler): (menuItem: MenuItem, win: BaseWindow | undefined, event: KeyboardEvent) => void {
745+
return (menuItem: MenuItem, win: BaseWindow | undefined, event: KeyboardEvent) => {
746746

747747
// No Active Window
748748
const activeWindow = BrowserWindow.getFocusedWindow();

‎patched-vscode/src/vs/workbench/contrib/files/browser/fileActions.ts‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ import { KeyChord, KeyCode, KeyMod } from 'vs/base/common/keyCodes';
6060
import { Categories } from 'vs/platform/action/common/actionCommonCategories';
6161
import { ILocalizedString } from 'vs/platform/action/common/action';
6262
import { VSBuffer } from 'vs/base/common/buffer';
63+
import { getPathForFile } from '../../../../platform/dnd/browser/dnd.js';
6364

6465
export const NEW_FILE_COMMAND_ID = 'explorer.newFile';
6566
export const NEW_FILE_LABEL = nls.localize2('newFile', "New File...");
@@ -1121,7 +1122,20 @@ export const pasteFileHandler = async (accessor: ServicesAccessor, fileList?: Fi
11211122
const message = toPaste.files.length > 1 ?
11221123
nls.localize('confirmMultiPasteNative', "Are you sure you want to paste the following {0} items?", toPaste.files.length) :
11231124
nls.localize('confirmPasteNative', "Are you sure you want to paste '{0}'?", basename(toPaste.type === 'paths' ? toPaste.files[0].fsPath : toPaste.files[0].name));
1124-
const detail = toPaste.files.length > 1 ? getFileNamesMessage(toPaste.files.map(item => toPaste.type === 'paths' ? item.path : (item as File).name)) : undefined;
1125+
const detail = toPaste.files.length > 1 ? getFileNamesMessage(toPaste.files.map(item => {
1126+
if (URI.isUri(item)) {
1127+
return item.fsPath;
1128+
}
1129+
1130+
if (toPaste.type === 'paths') {
1131+
const path = getPathForFile(item);
1132+
if (path) {
1133+
return path;
1134+
}
1135+
}
1136+
1137+
return item.name;
1138+
})) : undefined;
11251139
const confirmation = await dialogService.confirm({
11261140
message,
11271141
detail,
@@ -1273,13 +1287,13 @@ type FilesToPaste =
12731287
async function getFilesToPaste(fileList: FileList | undefined, clipboardService: IClipboardService): Promise<FilesToPaste> {
12741288
if (fileList && fileList.length > 0) {
12751289
// with a `fileList` we support natively pasting file from disk from clipboard
1276-
const resources = [...fileList].filter(file => !!file.path && isAbsolute(file.path)).map(file => URI.file(file.path));
1290+
const resources = [...fileList].map(file => getPathForFile(file)).filter(filePath => !!filePath && isAbsolute(filePath)).map((filePath) => URI.file(filePath!));
12771291
if (resources.length) {
12781292
return { type: 'paths', files: resources, };
12791293
}
12801294

12811295
// Support pasting files that we can't read from disk
1282-
return { type: 'data', files: [...fileList].filter(file => !file.path) };
1296+
return { type: 'data', files: [...fileList].filter(file => !getPathForFile(file)) };
12831297
} else {
12841298
// otherwise we fallback to reading resources from our clipboard service
12851299
return { type: 'paths', files: resources.distinctParents(await clipboardService.readResources(), resource => resource) };

‎patched-vscode/src/vs/workbench/contrib/terminal/browser/terminalInstance.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ import { IClipboardService } from 'vs/platform/clipboard/common/clipboardService
3131
import { ICommandService } from 'vs/platform/commands/common/commands';
3232
import { IConfigurationService } from 'vs/platform/configuration/common/configuration';
3333
import { IContextKey, IContextKeyService } from 'vs/platform/contextkey/common/contextkey';
34-
import { CodeDataTransfers, containsDragType } from 'vs/platform/dnd/browser/dnd';
34+
import { CodeDataTransfers, containsDragType, getPathForFile } from '../../../../platform/dnd/browser/dnd.js';
3535
import { FileSystemProviderCapabilities, IFileService } from 'vs/platform/files/common/files';
3636
import { IInstantiationService } from 'vs/platform/instantiation/common/instantiation';
3737
import { ServiceCollection } from 'vs/platform/instantiation/common/serviceCollection';
@@ -2372,9 +2372,9 @@ class TerminalInstanceDragAndDropController extends Disposable implements dom.ID
23722372
path = URI.file(JSON.parse(rawCodeFiles)[0]);
23732373
}
23742374

2375-
if (!path && e.dataTransfer.files.length > 0 && e.dataTransfer.files[0].path /* Electron only */) {
2375+
if (!path && e.dataTransfer.files.length > 0 && getPathForFile(e.dataTransfer.files[0])) {
23762376
// Check if the file was dragged from the filesystem
2377-
path = URI.file(e.dataTransfer.files[0].path);
2377+
path = URI.file(getPathForFile(e.dataTransfer.files[0])!);
23782378
}
23792379

23802380
if (!path) {

‎patched-vscode/src/vs/workbench/contrib/terminal/browser/terminalTabsList.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ import { InputBox, MessageType } from 'vs/base/browser/ui/inputbox/inputBox';
3838
import { createSingleCallFunction } from 'vs/base/common/functional';
3939
import { IKeyboardEvent } from 'vs/base/browser/keyboardEvent';
4040
import { KeyCode } from 'vs/base/common/keyCodes';
41-
import { CodeDataTransfers, containsDragType } from 'vs/platform/dnd/browser/dnd';
41+
import { CodeDataTransfers, containsDragType, getPathForFile } from '../../../../platform/dnd/browser/dnd';
4242
import { terminalStrings } from 'vs/workbench/contrib/terminal/common/terminalStrings';
4343
import { ILifecycleService } from 'vs/workbench/services/lifecycle/common/lifecycle';
4444
import { IProcessDetails } from 'vs/platform/terminal/common/terminalProcess';
@@ -733,9 +733,9 @@ class TerminalTabsDragAndDrop extends Disposable implements IListDragAndDrop<ITe
733733
resource = URI.file(JSON.parse(rawCodeFiles)[0]);
734734
}
735735

736-
if (!resource && e.dataTransfer.files.length > 0 && e.dataTransfer.files[0].path /* Electron only */) {
736+
if (!resource && e.dataTransfer.files.length > 0 && getPathForFile(e.dataTransfer.files[0])) {
737737
// Check if the file was dragged from the filesystem
738-
resource = URI.file(e.dataTransfer.files[0].path);
738+
resource = URI.file(getPathForFile(e.dataTransfer.files[0])!);
739739
}
740740

741741
if (!resource) {

0 commit comments

Comments
 (0)