Update SHA for CSP and remove unused patch files (base-path and tar-fs-upgrade)

patched-vscode/src/vs/workbench/contrib/webview/browser/pre/index.html

@@ -5,7 +5,7 @@
 	<meta charset="UTF-8">
 
 	<meta http-equiv="Content-Security-Policy"
-		content="default-src 'none'; script-src 'sha256-R3BsSkqy7qFbvWSmwr7WqT1eg6Sq4zSe0uIlrUQ4EKE=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
+		content="default-src 'none'; script-src 'sha256-1qYtPnTQa4VwKNJO61EOhs2agF9TvuQSYIJ27OgzZqI=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
 
 	<!-- Disable pinch zooming -->
 	<meta name="viewport"
@@ -35,6 +35,8 @@
 		const onElectron = searchParams.get('platform') === 'electron';
 		const disableServiceWorker = searchParams.has('disableServiceWorker');
 		const expectedWorkerVersion = parseInt(searchParams.get('swVersion'));
+		/** @type {MessageChannel | undefined} */
+		let outerIframeMessageChannel;
 
 		/**
 		 * Use polling to track focus of main webview and iframes within the webview
@@ -110,6 +112,10 @@
 				color: var(--vscode-textLink-foreground);
 			}
 
+			p > a {
+				text-decoration: var(--text-link-decoration);
+			}
+
 			a:hover {
 				color: var(--vscode-textLink-activeForeground);
 			}
@@ -232,7 +238,7 @@
 			}
 
 			const swPath = encodeURI(`service-worker.js?v=${expectedWorkerVersion}&vscode-resource-base-authority=${searchParams.get('vscode-resource-base-authority')}&remoteAuthority=${searchParams.get('remoteAuthority') ?? ''}`);
-			navigator.serviceWorker.register(swPath)
+			navigator.serviceWorker.register(swPath, { type: 'module' })
 				.then(async registration => {
 					/**
 					 * @param {MessageEvent} event
@@ -260,7 +266,8 @@
 					navigator.serviceWorker.addEventListener('message', versionHandler);
 
 					const postVersionMessage = (/** @type {ServiceWorker} */ controller) => {
-						controller.postMessage({ channel: 'version' });
+						outerIframeMessageChannel = new MessageChannel();
+						controller.postMessage({ channel: 'version' }, [outerIframeMessageChannel.port2]);
 					};
 
 					// At this point, either the service worker is ready and
@@ -797,6 +804,32 @@
 			}
 		}
 
+
+		function handleInnerDragEvent(/** @type {DragEvent} */ e) {
+			/**
+			 * To ensure that the drop event always fires as expected, you should always include a preventDefault() call in the part of your code which handles the dragover event.
+			 * source: https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement/drop_event
+			 **/
+			e.preventDefault();
+
+			if (!e.dataTransfer) {
+				return;
+			}
+
+
+			// Only handle drags from outside editor for now
+			if (e.dataTransfer.items.length && Array.prototype.every.call(e.dataTransfer.items, item => item.kind === 'file')) {
+				hostMessaging.postMessage('drag', {
+					shiftKey: e.shiftKey
+				});
+			}
+
+		}
+
+		function handleInnerDropEvent(/**@type {DragEvent} */e) {
+			e.preventDefault();
+		}
+
 		/**
 		 * @param {() => void} callback
 		 */
@@ -887,7 +920,10 @@
 		window.addEventListener('keydown', handleInnerKeydown);
 		window.addEventListener('keyup', handleInnerKeyup);
 		window.addEventListener('dragenter', handleInnerDragStartEvent);
-		window.addEventListener('dragover', handleInnerDragStartEvent);
+		window.addEventListener('dragover', handleInnerDragEvent);
+		window.addEventListener('drag', handleInnerDragEvent);
+		window.addEventListener('drop', handleInnerDropEvent);
+
 
 		onDomReady(() => {
 			if (!document.body) {
@@ -980,7 +1016,7 @@
 				const previousPendingFrame = getPendingFrame();
 				if (previousPendingFrame) {
 					previousPendingFrame.setAttribute('id', '');
-					document.body.removeChild(previousPendingFrame);
+					previousPendingFrame.remove();
 				}
 				if (!wasFirstLoad) {
 					pendingMessages = [];
@@ -1077,9 +1113,7 @@
 					if (newFrame && newFrame.contentDocument && newFrame.contentDocument === contentDocument) {
 						const wasFocused = document.hasFocus();
 						const oldActiveFrame = getActiveFrame();
-						if (oldActiveFrame) {
-							document.body.removeChild(oldActiveFrame);
-						}
+						oldActiveFrame?.remove();
 						// Styles may have changed since we created the element. Make sure we re-style
 						if (initialStyleVersion !== styleVersion) {
 							applyStyles(newFrame.contentDocument, newFrame.contentDocument.body);
@@ -1171,10 +1205,23 @@
 					});
 
 					contentWindow.addEventListener('dragenter', handleInnerDragStartEvent);
-					contentWindow.addEventListener('dragover', handleInnerDragStartEvent);
+					contentWindow.addEventListener('dragover', handleInnerDragEvent);
+					contentWindow.addEventListener('drag', handleInnerDragEvent);
+					contentWindow.addEventListener('drop', handleInnerDropEvent);
 
 					unloadMonitor.onIframeLoaded(newFrame);
 				}
+
+				if (!disableServiceWorker && outerIframeMessageChannel) {
+					outerIframeMessageChannel.port1.onmessage = event => {
+						switch (event.data.channel) {
+							case 'load-resource':
+							case 'load-localhost':
+								hostMessaging.postMessage(event.data.channel, event.data);
+								return;
+						}
+					};
+				}
 			});
 
 			// propagate vscode-context-menu-visible class

patched-vscode/src/vs/workbench/services/extensions/worker/webWorkerExtensionHostIframe.html

@@ -4,15 +4,17 @@
 		<meta http-equiv="Content-Security-Policy" content="
 			default-src 'none';
 			child-src 'self' data: blob:;
-			script-src 'self' 'unsafe-eval' 'sha256-c7vPrYRaSLDtFSrI4CuHYgBQ3a4c4x2LSm/LefSZADQ=' https:;
+			script-src 'self' 'unsafe-eval' 'sha256-yhZXuB8LS6t73dvNg6rtLX8y4PHLnqRm5+6DdOGkOcw=' https:;
 			connect-src 'self' https: wss: http://localhost:* http://127.0.0.1:* ws://localhost:* ws://127.0.0.1:*;"/>
 	</head>
 	<body>
 	<script>
 (function () {
 	const searchParams = new URL(document.location.href).searchParams;
 	const vscodeWebWorkerExtHostId = searchParams.get('vscodeWebWorkerExtHostId') || '';
-	const name = searchParams.get('debugged') ? 'DebugWorkerExtensionHost' : 'WorkerExtensionHost';
+	// DO NOT CHANGE the name of the worker without also updating js-debug, as that
+	// is used to filter targets to attach to (e.g. #232544)
+	const name = searchParams.get('debugged') ? 'DebugExtensionHostWorker' : 'ExtensionHostWorker';
 	const parentOrigin = searchParams.get('parentOrigin') || window.origin;
 	const salt = searchParams.get('salt');
 
@@ -73,14 +75,47 @@
 	}
 
 	function start() {
+
+		// Before we can load the worker, we need to get the current set of NLS
+		// configuration into this iframe. We ask the parent window to send it
+		// together with the necessary information to load the worker via Blob.
+
+		const bootstrapNlsType = 'vscode.bootstrap.nls';
+
+		self.onmessage = (event) => {
+			if (event.origin !== parentOrigin || event.data.type !== bootstrapNlsType) {
+				return;
+			}
+			const { data } = event.data;
+			createWorker(data.workerUrl, data.fileRoot, data.nls.messages, data.nls.language);
+		};
+
+		window.parent.postMessage({
+			vscodeWebWorkerExtHostId,
+			type: bootstrapNlsType
+		}, '*');
+	}
+
+	function createWorker(workerUrl, fileRoot, nlsMessages, nlsLanguage) {
 		try {
-			let workerUrl = '../../../../base/worker/workerMain.js';
 			if (globalThis.crossOriginIsolated) {
 				workerUrl += '?vscode-coi=2'; // COEP
 			}
 
-			const worker = new Worker(workerUrl, { name });
-			worker.postMessage('vs/workbench/api/worker/extensionHostWorker');
+			// In below blob code, we are using JSON.stringify to ensure the passed
+			// in values are not breaking our script. The values may contain string
+			// terminating characters (such as ' or ").
+
+			const blob = new Blob([[
+				`/*extensionHostWorker*/`,
+				`globalThis._VSCODE_NLS_MESSAGES = ${JSON.stringify(nlsMessages)};`,
+				`globalThis._VSCODE_NLS_LANGUAGE = ${JSON.stringify(nlsLanguage)};`,
+				`globalThis._VSCODE_FILE_ROOT = ${JSON.stringify(fileRoot)};`,
+				`await import(${JSON.stringify(workerUrl)});`,
+				`/*extensionHostWorker*/`
+			].join('')], { type: 'application/javascript' });
+
+			const worker = new Worker(URL.createObjectURL(blob), { name, type: 'module' });
 			const nestedWorkers = new Map();
 
 			worker.onmessage = (event) => {