🚀 sandbox - enable by default and remove setting 🚀 (microsoft#181638)

* sandbox - enable by default and remove setting

* remove more

* set flags again

* fix lint

* more cleanup

Author: bpasero

src/bootstrap-fork.js

@@ -235,26 +235,16 @@ function terminateWhenParentTerminates() {
 	}
 }
 
-// TODO@bpasero remove this when sandbox is final
 function configureCrashReporter() {
-	const crashReporterSandboxedHint = process.env['VSCODE_CRASH_REPORTER_SANDBOXED_HINT'];
-	if (crashReporterSandboxedHint) {
-		addCrashReporterParameter('_sandboxed', 'true');
-	}
-
 	const crashReporterProcessType = process.env['VSCODE_CRASH_REPORTER_PROCESS_TYPE'];
 	if (crashReporterProcessType) {
-		addCrashReporterParameter('processType', crashReporterProcessType);
-	}
-}
-
-function addCrashReporterParameter(key, value) {
-	try {
-		if (process['crashReporter'] && typeof process['crashReporter'].addExtraParameter === 'function' /* Electron only */) {
-			process['crashReporter'].addExtraParameter(key, value);
+		try {
+			if (process['crashReporter'] && typeof process['crashReporter'].addExtraParameter === 'function' /* Electron only */) {
+				process['crashReporter'].addExtraParameter('processType', crashReporterProcessType);
+			}
+		} catch (error) {
+			console.error(error);
 		}
-	} catch (error) {
-		console.error(error);
 	}
 }
 

src/bootstrap-window.js

@@ -43,15 +43,6 @@
 	 * }} [options]
 	 */
 	async function load(modulePaths, resultCallback, options) {
-		const isDev = !!safeProcess.env['VSCODE_DEV'];
-
-		// Error handler (node.js enabled renderers only)
-		let showDevtoolsOnError = isDev;
-		if (!safeProcess.sandboxed) {
-			safeProcess.on('uncaughtException', function (/** @type {string | Error} */ error) {
-				onUnexpectedError(error, showDevtoolsOnError);
-			});
-		}
 
 		// Await window configuration from preload
 		const timeout = setTimeout(() => { console.error(`[resolve window config] Could not resolve window configuration within 10 seconds, but will continue to wait...`); }, 10000);
@@ -68,28 +59,21 @@
 
 		// Developer settings
 		const {
-			forceDisableShowDevtoolsOnError,
 			forceEnableDeveloperKeybindings,
 			disallowReloadKeybinding,
 			removeDeveloperKeybindingsAfterLoad
 		} = typeof options?.configureDeveloperSettings === 'function' ? options.configureDeveloperSettings(configuration) : {
-			forceDisableShowDevtoolsOnError: false,
 			forceEnableDeveloperKeybindings: false,
 			disallowReloadKeybinding: false,
 			removeDeveloperKeybindingsAfterLoad: false
 		};
-		showDevtoolsOnError = isDev && !forceDisableShowDevtoolsOnError;
+		const isDev = !!safeProcess.env['VSCODE_DEV'];
 		const enableDeveloperKeybindings = isDev || forceEnableDeveloperKeybindings;
 		let developerDeveloperKeybindingsDisposable;
 		if (enableDeveloperKeybindings) {
 			developerDeveloperKeybindingsDisposable = registerDeveloperKeybindings(disallowReloadKeybinding);
 		}
 
-		// Enable ASAR support (node.js enabled renderers only)
-		if (!safeProcess.sandboxed) {
-			globalThis.MonacoBootstrap.enableASARSupport(configuration.appRoot);
-		}
-
 		// Get the nls configuration into the process.env as early as possible
 		const nlsConfig = globalThis.MonacoBootstrap.setupNLS();
 
@@ -102,29 +86,11 @@
 
 		window.document.documentElement.setAttribute('lang', locale);
 
-		// Define `fs` as `original-fs` to disable ASAR support
-		// in fs-operations  (node.js enabled renderers only)
-		if (!safeProcess.sandboxed) {
-			require.define('fs', [], function () {
-				return require.__$__nodeRequire('original-fs');
-			});
-		}
-
 		window['MonacoEnvironment'] = {};
 
 		// VSCODE_GLOBALS: node_modules
 		globalThis._VSCODE_NODE_MODULES = new Proxy(Object.create(null), { get: (_target, mod) => (require.__$__nodeRequire ?? require)(String(mod)) });
 
-		if (!safeProcess.sandboxed) {
-			// VSCODE_GLOBALS: package/product.json
-			globalThis._VSCODE_PRODUCT_JSON = (require.__$__nodeRequire ?? require)(configuration.appRoot + '/product.json');
-			if (process.env['VSCODE_DEV']) {
-				// Patch product overrides when running out of sources
-				try { globalThis._VSCODE_PRODUCT_JSON = Object.assign(globalThis._VSCODE_PRODUCT_JSON, (require.__$__nodeRequire ?? require)(configuration.appRoot + '/product.overrides.json')); } catch (error) { /* ignore */ }
-			}
-			globalThis._VSCODE_PACKAGE_JSON = (require.__$__nodeRequire ?? require)(configuration.appRoot + '/package.json');
-		}
-
 		const loaderConfig = {
 			baseUrl: `${bootstrapLib.fileUriFromPath(configuration.appRoot, { isWindows: safeProcess.platform === 'win32', scheme: 'vscode-file', fallbackAuthority: 'vscode-app' })}/out`,
 			'vs/nls': nlsConfig,
@@ -160,13 +126,6 @@
 			'tas-client-umd': `${baseNodeModulesPath}/tas-client-umd/lib/tas-client-umd.js`
 		};
 
-		// Allow to load built-in and other node.js modules via AMD
-		// which has a fallback to using node.js `require`
-		// (node.js enabled renderers only)
-		if (!safeProcess.sandboxed) {
-			loaderConfig.amdModulesPattern = /(^vs\/)|(^vscode-textmate$)|(^vscode-oniguruma$)|(^xterm$)|(^xterm-addon-canvas$)|(^xterm-addon-search$)|(^xterm-addon-unicode11$)|(^xterm-addon-webgl$)|(^@vscode\/iconv-lite-umd$)|(^jschardet$)|(^@vscode\/vscode-languagedetection$)|(^vscode-regexp-languagedetection$)|(^tas-client-umd$)/;
-		}
-
 		// Signal before require.config()
 		if (typeof options?.beforeLoaderConfig === 'function') {
 			options.beforeLoaderConfig(loaderConfig);

src/bootstrap.js

@@ -50,41 +50,14 @@
 
 	//#region Add support for using node_modules.asar
 
-	/**
-	 * @param {string=} appRoot
-	 */
-	function enableASARSupport(appRoot) {
+	function enableASARSupport() {
 		if (!path || !Module || typeof process === 'undefined') {
 			console.warn('enableASARSupport() is only available in node.js environments');
 			return;
 		}
 
-		const NODE_MODULES_PATH = appRoot ? path.join(appRoot, 'node_modules') : path.join(__dirname, '../node_modules');
-
-		// Windows only:
-		// use both lowercase and uppercase drive letter
-		// as a way to ensure we do the right check on
-		// the node modules path: node.js might internally
-		// use a different case compared to what we have
-		/** @type {string | undefined} */
-		let NODE_MODULES_ALTERNATIVE_PATH;
-		if (appRoot /* only used from renderer until `sandbox` enabled */ && process.platform === 'win32') {
-			const driveLetter = appRoot.substr(0, 1);
-
-			let alternativeDriveLetter;
-			if (driveLetter.toLowerCase() !== driveLetter) {
-				alternativeDriveLetter = driveLetter.toLowerCase();
-			} else {
-				alternativeDriveLetter = driveLetter.toUpperCase();
-			}
-
-			NODE_MODULES_ALTERNATIVE_PATH = alternativeDriveLetter + NODE_MODULES_PATH.substr(1);
-		} else {
-			NODE_MODULES_ALTERNATIVE_PATH = undefined;
-		}
-
+		const NODE_MODULES_PATH = path.join(__dirname, '../node_modules');
 		const NODE_MODULES_ASAR_PATH = `${NODE_MODULES_PATH}.asar`;
-		const NODE_MODULES_ASAR_ALTERNATIVE_PATH = NODE_MODULES_ALTERNATIVE_PATH ? `${NODE_MODULES_ALTERNATIVE_PATH}.asar` : undefined;
 
 		// @ts-ignore
 		const originalResolveLookupPaths = Module._resolveLookupPaths;
@@ -93,23 +66,12 @@
 		Module._resolveLookupPaths = function (request, parent) {
 			const paths = originalResolveLookupPaths(request, parent);
 			if (Array.isArray(paths)) {
-				let asarPathAdded = false;
 				for (let i = 0, len = paths.length; i < len; i++) {
 					if (paths[i] === NODE_MODULES_PATH) {
-						asarPathAdded = true;
 						paths.splice(i, 0, NODE_MODULES_ASAR_PATH);
 						break;
-					} else if (paths[i] === NODE_MODULES_ALTERNATIVE_PATH) {
-						asarPathAdded = true;
-						paths.splice(i, 0, NODE_MODULES_ASAR_ALTERNATIVE_PATH);
-						break;
 					}
 				}
-				if (!asarPathAdded && appRoot) {
-					// Assuming that adding just `NODE_MODULES_ASAR_PATH` is sufficient
-					// because nodejs should find it even if it has a different drive letter case
-					paths.push(NODE_MODULES_ASAR_PATH);
-				}
 			}
 
 			return paths;

src/main.js

@@ -27,6 +27,9 @@ const { getUNCHost, addUNCHostToAllowlist } = require('./vs/base/node/unc');
 const product = require('../product.json');
 const { app, protocol, crashReporter, Menu } = require('electron');
 
+// Enable sandbox globally
+app.enableSandbox();
+
 // Enable portable support
 const portable = bootstrapNode.configurePortable(product);
 

src/vs/base/parts/sandbox/electron-sandbox/globals.ts

@@ -8,7 +8,7 @@ import { ISandboxConfiguration } from 'vs/base/parts/sandbox/common/sandboxTypes
 import { IpcRenderer, ProcessMemoryInfo, WebFrame } from 'vs/base/parts/sandbox/electron-sandbox/electronTypes';
 
 /**
- * In sandboxed renderers we cannot expose all of the `process` global of node.js
+ * In Electron renderers we cannot expose all of the `process` global of node.js
  */
 export interface ISandboxNodeProcess extends INodeProcess {
 
@@ -29,20 +29,6 @@ export interface ISandboxNodeProcess extends INodeProcess {
 	 */
 	readonly type: string;
 
-	/**
-	 * Whether the process is sandboxed or not.
-	 */
-	readonly sandboxed: boolean;
-
-	/**
-	 * The `process.pid` property returns the PID of the process.
-	 *
-	 * @deprecated this property will be removed once sandbox is enabled.
-	 *
-	 * TODO@bpasero remove this property when sandbox is on
-	 */
-	readonly pid: number;
-
 	/**
 	 * A list of versions for the current node.js/electron configuration.
 	 */

src/vs/base/parts/sandbox/electron-sandbox/preload.js

@@ -252,11 +252,9 @@
 			get platform() { return process.platform; },
 			get arch() { return process.arch; },
 			get env() { return { ...process.env }; },
-			get pid() { return process.pid; },
 			get versions() { return process.versions; },
 			get type() { return 'renderer'; },
 			get execPath() { return process.execPath; },
-			get sandboxed() { return process.sandboxed; },
 
 			/**
 			 * @returns {string}

src/vs/code/electron-sandbox/issue/issueReporterModel.ts

@@ -34,7 +34,6 @@ export interface IssueReporterData {
 	experimentInfo?: string;
 	restrictedMode?: boolean;
 	isUnsupported?: boolean;
-	isSandboxed?: boolean;
 }
 
 export class IssueReporterModel {
@@ -78,7 +77,6 @@ ${this.getExtensionVersion()}
 VS Code version: ${this._data.versionInfo && this._data.versionInfo.vscodeVersion}
 OS version: ${this._data.versionInfo && this._data.versionInfo.os}
 Modes:${modes.length ? ' ' + modes.join(', ') : ''}
-Sandboxed: ${this._data.isSandboxed ? 'Yes' : 'No'}
 ${this.getRemoteOSes()}
 ${this.getInfos()}
 <!-- generated by issue reporter -->`;

src/vs/code/test/electron-sandbox/issue/testReporterModel.test.ts

@@ -34,7 +34,6 @@ undefined
 VS Code version: undefined
 OS version: undefined
 Modes:
-Sandboxed: No
 
 Extensions: none
 <!-- generated by issue reporter -->`);
@@ -66,7 +65,6 @@ undefined
 VS Code version: undefined
 OS version: undefined
 Modes:
-Sandboxed: No
 
 <details>
 <summary>System Info</summary>
@@ -111,7 +109,6 @@ undefined
 VS Code version: undefined
 OS version: undefined
 Modes:
-Sandboxed: No
 
 <details>
 <summary>System Info</summary>
@@ -167,7 +164,6 @@ undefined
 VS Code version: undefined
 OS version: undefined
 Modes:
-Sandboxed: No
 
 <details>
 <summary>System Info</summary>
@@ -225,7 +221,6 @@ undefined
 VS Code version: undefined
 OS version: undefined
 Modes:
-Sandboxed: No
 Remote OS version: Linux x64 4.18.0
 
 <details>
@@ -275,7 +270,6 @@ undefined
 VS Code version: undefined
 OS version: undefined
 Modes:
-Sandboxed: No
 
 <details>
 <summary>System Info</summary>
@@ -307,7 +301,6 @@ undefined
 VS Code version: undefined
 OS version: undefined
 Modes: Restricted, Unsupported
-Sandboxed: No
 
 Extensions: none
 <!-- generated by issue reporter -->`);

src/vs/platform/issue/common/issue.ts

@@ -64,7 +64,6 @@ export interface IssueReporterData extends WindowData {
 	experiments?: string;
 	restrictedMode: boolean;
 	isUnsupported: boolean;
-	isSandboxed: boolean; // TODO@bpasero remove me once sandbox is final
 	githubAccessToken: string;
 	readonly issueTitle?: string;
 	readonly issueBody?: string;

src/vs/platform/issue/electron-main/issueMainService.ts

@@ -438,8 +438,7 @@ export class IssueMainService implements IIssueMainService {
 				enableWebSQL: false,
 				spellcheck: false,
 				zoomFactor: zoomLevelToZoomFactor(options.zoomLevel),
-				sandbox: true,
-				contextIsolation: true
+				sandbox: true
 			},
 			alwaysOnTop: options.alwaysOnTop,
 			experimentalDarkMode: true