CodeVetter · Repo Unpack · Risk map
microsoft/vscode
The largest blast radius is the IPC/channel surface: renderer and shared-process clients reach privileged main-process services over ~30 channels, so any renderer compromise (webview, extension UI) inherits capabilities like file IO, pty spawn, storage, and native host calls — mitigated by validatedIpcMain and sandboxing, but the surface is huge. Secrets have a deliberate weak fallback (plaintext encryption) and an in-memory storage flag. The main process performs privileged file writes (argv.json auto-creation, lockfiles) and spawns shells/extensions/agent processes. Remote debugging and proposed-API flags in argv.json lower security postures when enabled. Untested or thinly-tested areas include much of electron-main orchestration and many UI contribs.
- Renderer→main IPC is a broad privilege boundary: channels registered in initChannels include 'storage', 'nativeHost', 'localPty', 'webview', 'externalTerminal', 'extensionHostStarter' and LOCAL_FILE_SYSTEM_CHANNEL_NAME — validatedIpcMain exists to vet senders, so new channels must use it or they bypass sender validation.
- Secret storage can silently degrade: when no OS keyring is found, the user is offered 'Use weaker encryption' (plaintext) via secretStorageService, and argv.json's use-inmemory-secretstorage drops persistence entirely.
- The extension host executes arbitrary third-party extension code with Node.js capabilities; proposed APIs are gated by ExtensionsProposedApi and --enable-proposed-api in argv.json is a documented escape that can enable unstable surface globally or per-extension.
- Shell-out surface: PtyService/terminalProcess spawn arbitrary shells from user settings, externalTerminalService launches OS terminals, and the main process exposes 'externalTerminal' and localPty channels; task runners (contrib/tasks) execute workspace-defined commands — a classic workspace-trust risk mitigated by IWorkspaceTrustManagementService.
- argv.json is auto-created with comments and supports remote-debugging-port, js-flags, and enable-proposed-api — powerful persisted flags an attacker or misconfiguration could abuse; the file is parsed synchronously before app ready.
- Privileged custom schemes vscode-webview/vscode-file/vscode-remote-resource are registered with fetch/CORS/service-worker privileges before app ready; webview content is additionally isolated to a CDN base template in product.json (webviewContentExternalBaseUrlTemplate).
- Windows UNC paths are selectively allow-listed via addUNCHostToAllowlist for user-data and extension paths — a security-sensitive gate that would be easy to weaken accidentally in environment/path handling code.
- Telemetry collects PII-adjacent identifiers: resolveMachineId/resolveSqmId/resolveDevDeviceId plus getPiiPathsFromEnvironment and a large OSProxyConfig telemetry event enumerating proxy configuration states — all routed through shared-process appenders and controlled by TelemetryLevel.
- Import-barrel coupling is fragile: workbench.*.main.ts ordering determines singleton registration and contrib loading; the banner comment in workbench.web.main.ts and the 'do NOT register services here' note in workbench.ts indicate this has bitten contributors before.
- Single-instance lock + lockfile handling (claimInstance, mainLockfile unlink on shutdown) is a known-fragile area: onWillShutdown joins async lockfile deletion, and the Inno Setup mutex check can release the IPC server mid-startup — race-prone code with historically linked GitHub issues.
- Agent host processes (ElectronAgentHostStarter/AgentHostProcessManager, platform/agentHost) spawn utility processes that talk to external AI services; combined with AgentNetworkFilterService and MCP gateway, this is a new, fast-moving attack surface with sparse test coverage (inference). (inferred)