Skip to content

Commit d3938b6

Browse files
committed
Disable clangd on untrusted workspaces
Per https://llvm.org/docs/Security.html#what-is-considered-a-security-issue, parsing untrusted code through clang can result in harmful behavior. Also it isn't considered as a security-sensitive component, hence its on embedders like vscode-clangd to ensure users are aware of such risks. Hence this patch disables running clangd on untrusted workspaces.
1 parent 1675875 commit d3938b6

File tree

1 file changed

+2
-7
lines changed

1 file changed

+2
-7
lines changed

package.json

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -73,13 +73,8 @@
7373
"qna": "marketplace",
7474
"capabilities": {
7575
"untrustedWorkspaces": {
76-
"supported": "limited",
77-
"description": "In restricted mode clangd.path and clangd.arguments are not respected.",
78-
"restrictedConfigurations": [
79-
"clangd.path",
80-
"clangd.useScriptAsExecutable",
81-
"clangd.arguments"
82-
]
76+
"supported": false,
77+
"description": "Clangd isn't safe to run on untrusted code as it embeds clang as a parser. Parsing source files as one navigates a code base, carries the risk of being exploited."
8378
}
8479
},
8580
"contributes": {

0 commit comments

Comments
 (0)