Skip to content

Commit 3e76a04

Browse files
code-ashercode-asher
committed
Fix automatic CSP hash update
The problem was that whenever the hashe needed an update, the current patch would create a conflict which cannot be easily auto-resolved. Instead, put the hashes in a separate patch that is deleted and regenerated each time, avoiding the conflicts. Also the web worker iframe hash was not being updated.
1 parent 421e7eb commit 3e76a04

5 files changed

Lines changed: 79 additions & 74 deletions

File tree

‎ci/build/update-vscode.sh‎

Lines changed: 46 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ set -Eeuo pipefail
44

55
function unapply_patches() {
66
local -i exit_code=0
7-
quiet quilt pop -af || exit_code=$?
7+
quiet quilt pop -af 2>&1 || exit_code=$?
88
case $exit_code in
99
# Sucessfully unapplied.
1010
0) ;;
@@ -15,6 +15,19 @@ function unapply_patches() {
1515
esac
1616
}
1717

18+
function apply_patches() {
19+
local -i exit_code=0
20+
quiet quilt push -a 2>&1 || exit_code=$?
21+
case $exit_code in
22+
# Sucessfully applied.
23+
0) ;;
24+
# No more patches to apply.
25+
2) ;;
26+
# Some error.
27+
*) return $exit_code ;;
28+
esac
29+
}
30+
1831
function update_vscode() {
1932
pushd lib/vscode
2033
if ! git checkout 2>&1 "$target_vscode_version" ; then
@@ -28,8 +41,8 @@ function update_vscode() {
2841

2942
function refresh_patches() {
3043
local -i exit_code=0
31-
while quiet quilt push ; ! (( exit_code=$? )) ; do
32-
quilt refresh
44+
while quiet quilt push 2>&1 ; ! (( exit_code=$? )) ; do
45+
quilt refresh 2>&1
3346
done
3447
case $exit_code in
3548
# No more patches to apply.
@@ -56,50 +69,41 @@ function get-webview-script-hash() {
5669
local html
5770
html=$(<"$1")
5871
local start_tag='<script async type="module">'
72+
if [[ $file == */webWorkerExtensionHostIframe.html ]] ; then
73+
start_tag='<script>'
74+
fi
5975
local end_tag="</script>"
6076
html=${html##*"$start_tag"}
6177
html=${html%%"$end_tag"*}
6278
echo -n "$html" | openssl sha256 -binary | openssl base64
6379
}
6480

81+
function delete_csp() {
82+
quilt delete csp-hashes.diff
83+
}
84+
6585
function update_csp() {
66-
local current
67-
current=$(quilt top 2>/dev/null || echo "")
68-
local patch_action=""
69-
echo "Currently at ${current:-base}"
70-
if [[ $current != */webview.diff ]] ; then
71-
echo "Moving to patches/webview.diff..."
72-
local -i exit_code=0
73-
if quilt applied 2>/dev/null | grep --quiet webview.diff ; then
74-
quiet quilt pop webview || exit_code=$?
75-
patch_action=pop
76-
else
77-
quiet quilt push webview || exit_code=$?
78-
patch_action=push
79-
fi
80-
case $exit_code in
81-
# Successfully moved.
82-
0) ;;
83-
# Some error.
84-
*) return $exit_code ;;
85-
esac
86-
fi
86+
apply_patches
8787

88-
local file=lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html
89-
local hash
90-
hash=$(get-webview-script-hash "$file")
91-
echo "Calculated hash as $hash"
92-
# Use octothorpe as a delimiter since the hash may contain a slash.
93-
sed -i.bak "s#script-src 'sha256-[^']\+'#script-src 'sha256-$hash'#" "$file"
94-
quilt refresh
88+
local files=(
89+
./lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html
90+
./lib/vscode/src/vs/workbench/services/extensions/worker/webWorkerExtensionHostIframe.html
91+
)
9592

96-
if [[ $patch_action != "" ]] ; then
97-
echo "Moving back to ${current:-base}..."
98-
case $patch_action in
99-
pop) quiet quilt push "$current" ;;
100-
push) quiet quilt pop "${current:--a}" ;;
101-
esac
102-
fi
93+
quilt new csp-hashes.diff
94+
95+
local file
96+
for file in "${files[@]}" ; do
97+
quilt add "$file"
98+
99+
local hash
100+
hash=$(get-webview-script-hash "$file")
101+
echo "Calculated hash as $hash"
102+
# Use octothorpe as a delimiter since the hash may contain a slash.
103+
sed -i.bak "s#'sha256-[^']\+'#'sha256-$hash'#" "$file"
104+
done
105+
106+
quilt refresh
103107
}
104108

105109
function add_changelog() {
@@ -120,6 +124,9 @@ function main() {
120124

121125
declare -a steps
122126

127+
# Hashes are always regenerated to avoid having to resolve conflicts..
128+
steps+=("Revert CSP hashes" "delete_csp")
129+
123130
# If version is not set, assume we are already at the target version and the
124131
# user is just trying to resolve conflics.
125132
local target_vscode_version
@@ -141,7 +148,7 @@ function main() {
141148

142149
steps+=(
143150
"Update Node version" "update_node"
144-
"Update CSP webview hash" "update_csp"
151+
"Regenerate CSP hashes" "update_csp"
145152
"Add changelog note" "add_changelog"
146153
)
147154

‎ci/lib.sh‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -85,18 +85,20 @@ run-steps() {
8585
while (( $# )) ; do
8686
local name=$1 ; shift
8787
local fn=$1 ; shift
88+
echo "$name..."
8889
# Only run if an earlier step has not failed.
90+
# For all failed steps, write out an empty checkbox.
8991
if [[ $failed == 0 ]] ; then
90-
echo "$name..."
9192
if $fn | indent ; then
9293
echo "- [X] $name" >> .cache/checklist
9394
else
9495
((failed++))
96+
echo "- [-] $name" >> .cache/checklist
97+
echo "Failed" | indent
9598
fi
96-
fi
97-
# For all failed steps, write out an empty checkbox.
98-
if [[ $failed != 0 ]] ; then
99+
else
99100
echo "- [ ] $name" >> .cache/checklist
101+
echo "Skipped" | indent
100102
fi
101103
done
102104
if [[ $failed != 0 ]] ; then

‎patches/csp-hashes.diff‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html
2+
===================================================================
3+
--- code-server.orig/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html
4+
+++ code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html
5+
@@ -5,7 +5,7 @@
6+
<meta charset="UTF-8">
7+
8+
<meta http-equiv="Content-Security-Policy"
9+
- content="default-src 'none'; script-src 'sha256-nXjtuhBilO++r8hfxl5VjEScSmdm07wDAk6jw228DgM=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
10+
+ content="default-src 'none'; script-src 'sha256-A6/szVNdTzyi4hDa+9OLbzS8tSd2iUV4CqimLNWex2Y=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
11+
12+
<!-- Disable pinch zooming -->
13+
<meta name="viewport"
14+
Index: code-server/lib/vscode/src/vs/workbench/services/extensions/worker/webWorkerExtensionHostIframe.html
15+
===================================================================
16+
--- code-server.orig/lib/vscode/src/vs/workbench/services/extensions/worker/webWorkerExtensionHostIframe.html
17+
+++ code-server/lib/vscode/src/vs/workbench/services/extensions/worker/webWorkerExtensionHostIframe.html
18+
@@ -4,7 +4,7 @@
19+
<meta http-equiv="Content-Security-Policy" content="
20+
default-src 'none';
21+
child-src 'self' data: blob:;
22+
- script-src 'self' 'unsafe-eval' 'sha256-cl8ijlOzEe+0GRCQNJQu2k6nUQ0fAYNYIuuKEm72JDs=' https: http://localhost:* blob:;
23+
+ script-src 'self' 'unsafe-eval' 'sha256-yhZXuB8LS6t73dvNg6rtLX8y4PHLnqRm5+6DdOGkOcw=' https: http://localhost:* blob:;
24+
connect-src 'self' https: wss: http://localhost:* http://127.0.0.1:* ws://localhost:* ws://127.0.0.1:*;"/>
25+
</head>
26+
<body>

‎patches/series‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,3 +24,4 @@ trusted-domains.diff
2424
signature-verification.diff
2525
copilot.diff
2626
app-name.diff
27+
csp-hashes.diff

‎patches/webview.diff‎

Lines changed: 0 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,6 @@ Serve webviews from the same origin
33
Normally webviews are served from vscode-webview.net but we would rather them be
44
self-hosted.
55

6-
When doing this CSP will block resources (for example when viewing images) so
7-
add 'self' to the CSP to fix that.
8-
96
Additionally the service worker defaults to handling *all* requests made to the
107
current host but when self-hosting the webview this will end up including the
118
webview HTML itself which means these requests will fail since the communication
@@ -20,16 +17,6 @@ webview host is separate by default but we serve on the same host).
2017

2118
To test, open a few types of webviews (images, markdown, extension details, etc).
2219

23-
Make sure to update the hash. To do so:
24-
1. run code-server
25-
2. open any webview (i.e. preview Markdown)
26-
3. see error in console and copy hash
27-
28-
That will test the hash change in pre/index.html
29-
30-
Double-check the console to make sure there are no console errors for the webWorkerExtensionHostIframe
31-
which also requires a hash change.
32-
3320
parentOriginHash changes
3421

3522
This fixes webviews from not working properly due to a change upstream.
@@ -66,15 +53,6 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index
6653
===================================================================
6754
--- code-server.orig/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html
6855
+++ code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html
69-
@@ -5,7 +5,7 @@
70-
<meta charset="UTF-8">
71-
72-
<meta http-equiv="Content-Security-Policy"
73-
- content="default-src 'none'; script-src 'sha256-nXjtuhBilO++r8hfxl5VjEScSmdm07wDAk6jw228DgM=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
74-
+ content="default-src 'none'; script-src 'sha256-A6/szVNdTzyi4hDa+9OLbzS8tSd2iUV4CqimLNWex2Y=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
75-
76-
<!-- Disable pinch zooming -->
77-
<meta name="viewport"
7856
@@ -253,7 +253,7 @@
7957
}
8058

@@ -101,15 +79,6 @@ Index: code-server/lib/vscode/src/vs/workbench/services/extensions/worker/webWor
10179
===================================================================
10280
--- code-server.orig/lib/vscode/src/vs/workbench/services/extensions/worker/webWorkerExtensionHostIframe.html
10381
+++ code-server/lib/vscode/src/vs/workbench/services/extensions/worker/webWorkerExtensionHostIframe.html
104-
@@ -4,7 +4,7 @@
105-
<meta http-equiv="Content-Security-Policy" content="
106-
default-src 'none';
107-
child-src 'self' data: blob:;
108-
- script-src 'self' 'unsafe-eval' 'sha256-cl8ijlOzEe+0GRCQNJQu2k6nUQ0fAYNYIuuKEm72JDs=' https: http://localhost:* blob:;
109-
+ script-src 'self' 'unsafe-eval' 'sha256-yhZXuB8LS6t73dvNg6rtLX8y4PHLnqRm5+6DdOGkOcw=' https: http://localhost:* blob:;
110-
connect-src 'self' https: wss: http://localhost:* http://127.0.0.1:* ws://localhost:* ws://127.0.0.1:*;"/>
111-
</head>
112-
<body>
11382
@@ -25,6 +25,13 @@
11483
// validation not requested
11584
return start();

0 commit comments

Comments
 (0)