From dcd03158dae3ffe2fe137bce17489ba1f1b19e50 Mon Sep 17 00:00:00 2001 From: tuanaiseo Date: Fri, 10 Apr 2026 20:46:57 +0700 Subject: [PATCH] fix(security)(platform): overly permissive github remote detection via pref GitHub remotes are identified using `uri.authority.startsWith('github')`. This can be spoofed by authorities like `github.evil.example`, potentially causing untrusted remotes to be treated as GitHub remotes if this check gates trust, auth behavior, or feature enablement. Affected files: utils.ts Signed-off-by: tuanaiseo <221258316+tuanaiseo@users.noreply.github.com> --- src/platform/remoteRepositories/common/utils.ts | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/platform/remoteRepositories/common/utils.ts b/src/platform/remoteRepositories/common/utils.ts index 44b003ca46..7ff62b5c13 100644 --- a/src/platform/remoteRepositories/common/utils.ts +++ b/src/platform/remoteRepositories/common/utils.ts @@ -6,5 +6,13 @@ import { URI } from '../../../util/vs/base/common/uri'; export function isGitHubRemoteRepository(uri: URI): boolean { - return uri.scheme === 'vscode-vfs' && uri.authority.startsWith('github'); + if (uri.scheme !== 'vscode-vfs') { + return false; + } + + const authority = uri.authority.toLowerCase(); + const host = authority.includes('@') ? authority.split('@').pop() ?? '' : authority; + const hostname = host.split(':')[0]; + + return hostname === 'github' || hostname === 'github.com' || hostname === 'github.dev' || hostname.endsWith('.github.dev'); }