tsec-compile-check returns too many unrelated errors

[engelsdamien]

Steps to Reproduce:

1. Run yarn tsec-compile check
2. Notice that 52 of 69 issues are unrelated to security

[jrieken]

@engelsdamien btw I am seeing 84 errors, many of those are errors for async-import-statements. I am also surprised that tsec complains about the use of trusted types policies. What are we supposed to do with such errors?

src/vs/editor/browser/core/markdownRenderer.ts:35:33 - error TS21228: Creating a Trusted Types policy requires a security review.

35  private static _ttpTokenizer = window.trustedTypes?.createPolicy('tokenizeToString', {

[engelsdamien]

84 errors ? After #112206 I only see 19 Worker and createPolicy related issues.

The Worker issues are a current limitation of tsec which does not yet understand the Worker construction (we will fix it in tsec and send you and update when it is done, likely sometime next quarter).

As for the createPolicy errors, these are "expected" as they indicate the "vulnerable surface" of your code that requires manual review. In google, usages of createPolicy are only allowed for the security team, which we use to exposes secure by construction APIs.

That being said this does not necessarily translate well to your case, and I will invest some time in the first half of 2021 to:

• reduce / restrict and review current usages of createPolicy
• improve devX around non-TrustedTypes supported browsers

The good news is that apart from src/vs/workbench/services/extensions/browser/webWorkerExtensionHost.ts:248:24, it seems that all of your code is Trusted Types compatible & you should be able to start experimenting with enforcing Trusted Types through the header.

For reference, here are all the errors I see:

> yarn tsec-compile-check 
yarn run v1.22.4
$ node node_modules/tsec/bin/tsec -p src/tsconfig.json --noEmit
src/vs/base/browser/dom.ts:1364:27 - error TS21228: [ban-trustedtypes-createpolicy] Creating a Trusted Types policy requires a security review.

1364 const _ttpSafeInnerHtml = window.trustedTypes?.createPolicy('safeInnerHtml', {
                               ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/vs/base/browser/markdownRenderer.ts:35:20 - error TS21228: [ban-trustedtypes-createpolicy] Creating a Trusted Types policy requires a security review.

35 const _ttpInsane = window.trustedTypes?.createPolicy('insane', {
                      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/vs/base/worker/defaultWorkerFactory.ts:9:18 - error TS21228: [ban-trustedtypes-createpolicy] Creating a Trusted Types policy requires a security review.

9 const ttPolicy = window.trustedTypes?.createPolicy('defaultWorkerFactory', { createScriptURL: value => value });
                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/vs/base/worker/defaultWorkerFactory.ts:19:15 - error TS21228: [ban-worker-calls] Constructing Web Workers can cause code to be loaded from an untrusted URL.

19              return new Worker(ttPolicy ? ttPolicy.createScriptURL(wokerUrl) as unknown as string : wokerUrl, { name: label });
                           ~~~~~~
src/vs/base/worker/defaultWorkerFactory.ts:27:14 - error TS21228: [ban-worker-calls] Constructing Web Workers can cause code to be loaded from an untrusted URL.

27      return new Worker(ttPolicy ? ttPolicy.createScriptURL(workerUrl) as unknown as string : workerUrl, { name: label });
                   ~~~~~~
src/vs/base/worker/workerMain.ts:11:29 - error TS21228: [ban-trustedtypes-createpolicy] Creating a Trusted Types policy requires a security review.

11  const trustedTypesPolicy = self.trustedTypes?.createPolicy('amdLoader', { createScriptURL: value => value });
                               ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/vs/editor/browser/view/viewLayer.ts:372:29 - error TS21228: [ban-trustedtypes-createpolicy] Creating a Trusted Types policy requires a security review.

372  private static _ttPolicy = window.trustedTypes?.createPolicy('editorViewLayer', { createHTML: value => value });
                                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/vs/editor/browser/view/domLineBreaksComputer.ts:15:18 - error TS21228: [ban-trustedtypes-createpolicy] Creating a Trusted Types policy requires a security review.

15 const ttPolicy = window.trustedTypes?.createPolicy('domLineBreaksComputer', { createHTML: value => value });
                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/vs/editor/browser/widget/diffEditorWidget.ts:165:18 - error TS21228: [ban-trustedtypes-createpolicy] Creating a Trusted Types policy requires a security review.

165 const ttPolicy = window.trustedTypes?.createPolicy('diffEditorWidget', { createHTML: value => value });
                     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/vs/editor/browser/core/markdownRenderer.ts:35:33 - error TS21228: [ban-trustedtypes-createpolicy] Creating a Trusted Types policy requires a security review.

35  private static _ttpTokenizer = window.trustedTypes?.createPolicy('tokenizeToString', {
                                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/vs/workbench/contrib/notebook/browser/view/renderers/cellRenderer.ts:570:22 - error TS21228: [ban-trustedtypes-createpolicy] Creating a Trusted Types policy requires a security review.

570  private _ttPolicy = window.trustedTypes?.createPolicy('cellRendererEditorText', {
                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/vs/workbench/contrib/notebook/browser/view/renderers/webviewPreloads.ts:391:19 - error TS21228: [ban-trustedtypes-createpolicy] Creating a Trusted Types policy requires a security review.

391  const ttPolicy = window.trustedTypes?.createPolicy('notebookOutputRenderer', {
                      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/vs/workbench/services/extensions/browser/webWorkerExtensionHost.ts:44:18 - error TS21228: [ban-trustedtypes-createpolicy] Creating a Trusted Types policy requires a security review.

44 const ttPolicy = window.trustedTypes?.createPolicy('webWorkerExtensionHost', { createScriptURL: value => value });
                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/vs/workbench/services/extensions/browser/webWorkerExtensionHost.ts:223:22 - error TS21228: [ban-worker-calls] Constructing Web Workers can cause code to be loaded from an untrusted URL.

223     const worker = new Worker(ttPolicy ? ttPolicy.createScriptURL(url) as unknown as string : url, { name: 'WorkerExtensionHost' });
                           ~~~~~~
src/vs/workbench/services/extensions/browser/webWorkerExtensionHost.ts:248:24 - error TS21228: [ban-worker-calls] Constructing Web Workers can cause code to be loaded from an untrusted URL.

248                     const worker = new Worker(data.url, data.options);
                                           ~~~~~~
src/vs/editor/standalone/browser/colorizer.ts:18:18 - error TS21228: [ban-trustedtypes-createpolicy] Creating a Trusted Types policy requires a security review.

18 const ttPolicy = window.trustedTypes?.createPolicy('standaloneColorizer', { createHTML: value => value });
                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/vs/workbench/services/extensions/worker/polyfillNestedWorker.ts:47:8 - error TS21228: [ban-worker-calls] Constructing Web Workers can cause code to be loaded from an untrusted URL.

47      self.Worker = <any>class { constructor() { throw new TypeError('Nested workers from within nested worker are NOT supported.'); } };
             ~~~~~~
src/vs/workbench/services/extensions/worker/extensionHostWorker.ts:56:2 - error TS21228: [ban-worker-calls] Constructing Web Workers can cause code to be loaded from an untrusted URL.

56  Worker = <any>function (stringUrl: string | URL, options?: WorkerOptions) {
    ~~~~~~
src/vs/workbench/services/extensions/worker/extensionHostWorkerMain.ts:11:29 - error TS21228: [ban-trustedtypes-createpolicy] Creating a Trusted Types policy requires a security review.

11  const trustedTypesPolicy = self.trustedTypes?.createPolicy('amdLoader', { createScriptURL: value => value });
                               ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Found 19 errors.

[jrieken]

Yeah, the webWorkerExtensionHost.ts is something new and an oversight. There is also still this xtermjs/xterm.js#3190 then we should we good. I have running locally with trusted types enforced and default policy that logs and haven't found more places

[jrieken]

84 errors ? After #112206 I only see 19 Worker and createPolicy related issues.

Yeah, after that. I have a feeling that yarn handle these packages well.