4 ms·

My first reaction has been: when we install some node modules, import them and eventually run them, we do grant local execution permissions to whatever the auth

by pmontra 9mo ago

My first reaction has been: when we install some node modules, import them and eventually run them, we do grant local execution permissions to whatever the authors of those modules coded in their scripts, right? More or less every language already suffer from the same problem. Who vets the code inside a Ruby gem, a Python package, etc? Add your favorite language. However I did not know about tasks.json (I don't use VSC) and when I googled it I found the example at https://code.visualstudio.com/api/extension-guides/task-provider https://code.visualstudio.com/api/extension-guides/task-prov... and that is about running rake (Ruby.) So this is a little worse than installing malicious packages: the trigger is opening a malicious repository from the editor. Is this a common practice? If it is, it means two things: 1) the developer did not take an explicit choice of installing and running code, so even the possibility of an attack is unexpected and 2) it affects users of any language, even the ones that have secured package installation or have no installation of packages from remote.

echoangle 9mo ago
You get asked if you trust the folder you’re opening every single time you open a new folder in VsCode. Everyone probably always just says yes but it’s not like it doesn’t tell you that opening untrusted folders is dangerous.
- sroussey 9mo ago
  This is when I say no. Then copy-paste my default .dev-container directory and reload.
- mjdv 9mo ago
  Until this post it wasn't clear to me that just opening and trusting a directory can cause code to be run without taking any other explicit actions that seem like they might involve running code, like running tests. My bad, but still!
  - andy_ppp 9mo ago
    What is the stated reasoning for arbitrary code execution as a feature? Seems pretty mad to me.
    - direwolf20 9mo ago
      Makefiles etc. Many types of projects use arbitrary setup and build commands or can load arbitrary plugins, and unlike VS which imposes its own project format, VSC tries to be compatible with everything that people already use. Git hooks are another one.
      - andy_ppp 9mo ago
        Please see the reply to the other comment, obviously I wasn’t explicit enough in explaining I’m talking about code execution simply by opening a directory.
        direwolf20 9mo ago
        Some project types, such as Gradle or Maven projects, use arbitrary commands or plugins in project setup. You have to run arbitrary plugins to know which directories are the source directories, and you have to know which directories are the source directories to do anything in Java.
        andy_ppp 9mo ago
        There’s no need to run that when opening a directory is there?
        direwolf20 9mo ago
        If you just want to see the files in the directory, then sure. But VS Code is an IDE. It's made for editing software projects which have more structure than that.
    - 9mo ago
- duskdozer 9mo ago
  The message isn't very clear on what exactly is allowed to happen. Just intuitively, I wouldn't have expected simply opening a folder would "automatically execute tasks" because that's strange to me
  - echoangle 9mo ago
    https://code.visualstudio.com/docs/editing/workspaces/workspace-trust https://code.visualstudio.com/docs/editing/workspaces/worksp... It is very clear, the first sentence it that it may automatically execute code.
    - duskdozer 9mo ago
      >Code provides features that may automatically execute files... What features? What files? "may"? So will it actually happen or is it just "well it possibly could"? I've used it to open folders that I personally made and which don't have any tasks or files that get automatically executed, and yet the message pops up anyway. It's like having an antivirus program that unconditionally flags every file as "this file may contain a virus"
      - echoangle 9mo ago
        > What features? What files? "may"? So will it actually happen or is it just "well it possibly could"? How is code supposed to know? It probably depends on the plugins you installed. > It's like having an antivirus program that unconditionally flags every file as "this file may contain a virus" No, it’s like if your OS asks if you want to actually run the program you’re about to before running it the first time. And it gives you the alternative to run it in a sandbox (which is equivalent to what happens when you don’t trust the workspace, then it still opens but in restricted mode)
      - rcxdude 9mo ago
        Yeah, because there are a lot of mechanisms by which a folder may start to execute code when you open it outside of restricted mode. A large fraction of addons have something which could be used for this, for example. There isn't a general check that it can apply ahead of time for this. (They could, with some breaking changes, maybe try to enforce a permissions system for the matrix of addons and folders, where it would ask for permission when an addon does actually try to run something, but this would result in a lot of permission requests for most repos)
- windowpains 9mo ago
  I’ve always defaulted to no.
- javcasas 9mo ago
  autorun.inf flashbacks.
realusername 9mo ago
The reason it's worse in the js ecosystem is that you need way more packages than your average language to build anything functional.
- tentacleuno 9mo ago
  You don't really need more packages. There's definitely a culture of creating ridiculously small packages, though. If you spend enough time in the ecosystem, you'll begin to realise that a select few are very well known for doing this; one in particular made a package for every ANSI terminal colour. left-pad (and quite a few incidents afterwards) were definitely wakeup calls, and I like to think we've listened in some ways.
juujian 9mo ago
On Debian I actually get a surprising amount of packages from just the official repo. In Python or R, I could almost do a full analysis just with those packages. The smaller number of separately installed packages, I can at least do a superficial sanity check. An alternative model of doing things exists. Considering how infinitesimally small Debian is compared to Windows and MacOS, if we had more users, momentum, and volunteers, I have no doubt that I could do everything with well-tested packages only.

by pmontra 9mo ago

echoangle 9mo ago

You get asked if you trust the folder you’re opening every single time you open a new folder in VsCode. Everyone probably always just says yes but it’s not like it doesn’t tell you that opening untrusted folders is dangerous.

sroussey 9mo ago
This is when I say no. Then copy-paste my default .dev-container directory and reload.
mjdv 9mo ago
Until this post it wasn't clear to me that just opening and trusting a directory can cause code to be run without taking any other explicit actions that seem like they might involve running code, like running tests. My bad, but still!
- andy_ppp 9mo ago
  What is the stated reasoning for arbitrary code execution as a feature? Seems pretty mad to me.
  - direwolf20 9mo ago
    Makefiles etc. Many types of projects use arbitrary setup and build commands or can load arbitrary plugins, and unlike VS which imposes its own project format, VSC tries to be compatible with everything that people already use. Git hooks are another one.
    - andy_ppp 9mo ago
      Please see the reply to the other comment, obviously I wasn’t explicit enough in explaining I’m talking about code execution simply by opening a directory.
      - direwolf20 9mo ago
        Some project types, such as Gradle or Maven projects, use arbitrary commands or plugins in project setup. You have to run arbitrary plugins to know which directories are the source directories, and you have to know which directories are the source directories to do anything in Java.
        andy_ppp 9mo ago
        There’s no need to run that when opening a directory is there?
        direwolf20 9mo ago
        If you just want to see the files in the directory, then sure. But VS Code is an IDE. It's made for editing software projects which have more structure than that.
  - 9mo ago
duskdozer 9mo ago
The message isn't very clear on what exactly is allowed to happen. Just intuitively, I wouldn't have expected simply opening a folder would "automatically execute tasks" because that's strange to me
- echoangle 9mo ago
  https://code.visualstudio.com/docs/editing/workspaces/workspace-trust https://code.visualstudio.com/docs/editing/workspaces/worksp... It is very clear, the first sentence it that it may automatically execute code.
  - duskdozer 9mo ago
    >Code provides features that may automatically execute files... What features? What files? "may"? So will it actually happen or is it just "well it possibly could"? I've used it to open folders that I personally made and which don't have any tasks or files that get automatically executed, and yet the message pops up anyway. It's like having an antivirus program that unconditionally flags every file as "this file may contain a virus"
    - echoangle 9mo ago
      > What features? What files? "may"? So will it actually happen or is it just "well it possibly could"? How is code supposed to know? It probably depends on the plugins you installed. > It's like having an antivirus program that unconditionally flags every file as "this file may contain a virus" No, it’s like if your OS asks if you want to actually run the program you’re about to before running it the first time. And it gives you the alternative to run it in a sandbox (which is equivalent to what happens when you don’t trust the workspace, then it still opens but in restricted mode)
    - rcxdude 9mo ago
      Yeah, because there are a lot of mechanisms by which a folder may start to execute code when you open it outside of restricted mode. A large fraction of addons have something which could be used for this, for example. There isn't a general check that it can apply ahead of time for this. (They could, with some breaking changes, maybe try to enforce a permissions system for the matrix of addons and folders, where it would ask for permission when an addon does actually try to run something, but this would result in a lot of permission requests for most repos)
windowpains 9mo ago
I’ve always defaulted to no.
javcasas 9mo ago
autorun.inf flashbacks.

realusername 9mo ago

The reason it's worse in the js ecosystem is that you need way more packages than your average language to build anything functional.

tentacleuno 9mo ago
You don't really need more packages. There's definitely a culture of creating ridiculously small packages, though. If you spend enough time in the ecosystem, you'll begin to realise that a select few are very well known for doing this; one in particular made a package for every ANSI terminal colour. left-pad (and quite a few incidents afterwards) were definitely wakeup calls, and I like to think we've listened in some ways.

juujian 9mo ago

On Debian I actually get a surprising amount of packages from just the official repo. In Python or R, I could almost do a full analysis just with those packages. The smaller number of separately installed packages, I can at least do a superficial sanity check. An alternative model of doing things exists. Considering how infinitesimally small Debian is compared to Windows and MacOS, if we had more users, momentum, and volunteers, I have no doubt that I could do everything with well-tested packages only.