localResourceRoots should accept only URIs with the file scheme

[tamuratak]

Version: 1.62.0-insider (Universal)
Commit: 729d816
Date: 2021-10-18T05:21:54.840Z
Electron: 13.5.1
Chrome: 91.0.4472.164
Node.js: 14.16.0
V8: 9.1.269.39-electron.0
OS: Darwin arm64 20.6.0

Misconfigured localResourceRoots leads to a serious issue. And, we can easily misconfigure it. localResourceRoots should accept only URIs with the file scheme.

Steps to Reproduce:

1. Execute the sample code: https://github.com/tamuratak/vscode-extension-samples/tree/misconf_webview/webview-view-sample
2. In the sample code, we set asWebviewUri(this._extensionUri) to localResourceRoots, instead of this._extensionUri. It is a misconfiguration.
3. fetch inside the WebView View can access to /etc/bashrc.

CC: @mjbvz

[mjbvz]

Thanks! Taking a look.

Only allowing file is probably restrictive as we do need to support virtual and remote workspaces. However I'll see if we can catch the case where you pass in the results of asWebviewUri

[mjbvz]

Ok I fixed the bug that would cause an asWebviewUri uri to mistakenly allow other uris to be loaded

Give it a try in the next insiders build and let me know if something still seems off

[tamuratak]

I have confirmed that the issue is fixed. WebView View cannot access to /etc/bashrc.