You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Problem
Webview API proposal (#43713) introduces two resource schemes for loading local files:
vscode-workspace-resource: Resources from the user's workspace. This can also be overridden by localResourceRoots
vscode-extension-resource: This allows reading from extension's install directory
However this scheme prevents cross origin requests between extension resources and workspace resources. vscode-extension-resource also currently allows reading any extension's resources, which may not be safe (if, for example, some crazy extension stores user creds in the extension's install directory)
Proposal
Replace these two with a new vscode-resource scheme. This scheme would allow access to files within localResourceRoots. If not specified, localResourceRoots would include:
Currently opened workspaces folders
The extension's install directory
Extensions could override this with localResourceRoots
The text was updated successfully, but these errors were encountered:
Problem
Webview API proposal (#43713) introduces two resource schemes for loading local files:
vscode-workspace-resource
: Resources from the user's workspace. This can also be overridden bylocalResourceRoots
vscode-extension-resource
: This allows reading from extension's install directoryHowever this scheme prevents cross origin requests between extension resources and workspace resources.
vscode-extension-resource
also currently allows reading any extension's resources, which may not be safe (if, for example, some crazy extension stores user creds in the extension's install directory)Proposal
Replace these two with a new
vscode-resource
scheme. This scheme would allow access to files withinlocalResourceRoots
. If not specified,localResourceRoots
would include:Extensions could override this with
localResourceRoots
The text was updated successfully, but these errors were encountered: