Skip to content

"Opening URIs can be insecure" warning appears, but link is still opened. #221255

@foxt

Description

@foxt

Does this issue occur when all extensions are disabled?: Yes/No

  • VS Code Version: Version: 1.92.0-insider
  • OS Version: macOS 12.7.5

Steps to Reproduce:

  1. In the terminal, run
    • echo -e "\e]8;;spotify://\e\hello\e]8;;" (if you have Spotify installed)
    • echo -e "\e]8;;ical://\e\hello\e]8;;" (on a Mac)
    • echo -e "\e]8;;ms-windows-store://\e\hello\e]8;;" (on Windows)
  2. Click the link in the terminal.
    You will get a popup prompt asking if you want to open the URI, but the URI will also be opened immediately (even if you don't click Allow)

Seems like the check is here:

if (this._terminalConfigurationService.config.allowedLinkSchemes.indexOf(scheme) === -1) {
this._notificationService.prompt(Severity.Warning, nls.localize('scheme', 'Opening URIs can be insecure, do you want to allow opening links with the scheme {0}?', scheme), [
{
label: nls.localize('allow', 'Allow {0}', scheme),
run: () => {
const allowedLinkSchemes = [
...this._terminalConfigurationService.config.allowedLinkSchemes,
scheme
];
this._configurationService.updateValue(`terminal.integrated.allowedLinkSchemes`, allowedLinkSchemes);
}
}
]);
}
this._openers.get(TerminalBuiltinLinkType.Url)?.open({
type: TerminalBuiltinLinkType.Url,
text,
bufferRange: null!,
uri: URI.parse(text)
});
, but it only checks when showing the notification. The link is opened unconditionally.

Metadata

Metadata

Assignees

Labels

bugIssue identified by VS Code Team member as probable buginsiders-releasedPatch has been released in VS Code Insidersterminal-links

Type

No type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions