security: route external references through trust ref

[Vincent Biret (baywet)]

this pull request routes external references through trust refs when resolving schemas for json. Previously we were only requesting to trust the "root" schema, but it can ref into something external, which brings additional security concerns, e.g. https://www.schemastore.org/openapi-overlay-1.X.json which refs into https://spec.openapis.org/overlay/1.0/schema/2026-04-01

[Copilot]

Pull request overview

Routes external JSON schema references through client-side trust checks by limiting the server’s default protocol handling.

Changes:

• Defaults server-side schema loading to file: URIs.
• Updates schema-loading documentation.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
extensions/json-language-features/server/src/jsonServer.ts	Delegates non-file schema requests to the client by default.
extensions/json-language-features/server/README.md	Documents the revised default behavior.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Martin Aeschlimann (aeschli)]

Can you describes more the issue it describe to fix and the steps to reproduce the issue?
Could you clarify how the change in this PR is related the scenario described in the PR description?

The fix in the PR does not impact VS Code, only on other editors that bundle the JSON language server and do not specify handledSchemaProtocols in the language server init options.
The json-language-feature extension in VS Code always passes handledSchemaProtocols: ['file'], that means the language server forwards all requests to the client. https://github.com/unsupportedpastels/vscode/blob/5eaf3418ed793e39f9adfb79fb28922befde63ea/extensions/json-language-features/client/src/jsonClient.ts#L285-L286
The client then has a list of trusted servers and will make a decision which schemas to load.
All schema fetched (including all schemas references by $ref) request go through that schema service and the VSCodeContentRequest LSP request that.

[Vincent Biret (baywet)]

Martin Aeschlimann (@aeschli)

Here is the reproduction (pre-patch)

1. Open an OpenAPI Overlay document (JSON) in VSCode (also works with OpenAPI descriptions and their corresponding schema)
2. Set the schema for the description to be https://www.schemastore.org/openapi-overlay-1.X.json through the configuration or the selection tool.
3. You'll be prompted to accept the origin https://www.schemastore.org/openapi-overlay-1.X.json. However that schema has external references into https://spec.openapis.org/overlay/1.0/schema/2026-04-01, which is on a different domain all together.
4. Note that you're not prompted to trust the different origin https://spec.openapis.org/overlay/1.0/schema/2026-04-01, it gets pulled automatically I believe that's potentially a security concern.

This patch makes any external reference resolution go through the trust mechanism, so they are not "trusted by default".

Let me know if you have any additional comments or questions.

[Martin Aeschlimann (aeschli)]

Note sure what exactly the steps 1. and 2. mean, maybe you can provide the document and how you set the schema.
Here's what I tried (latest VS Code insiders)
openapi-test.json

{
    "$schema": "https://www.schemastore.org/openapi-overlay-1.X.json"
}

Note that we trust all schemas from www.schemastore.org by default

What I found is that sometime the 'Location https://spec.openapis.org/overlay/1.1/schema/2026-04-01 is untrusted' message is not showing, instead 'overlay is missing' shows. Looks like a race condition.
I verified that the PR does not make any difference and that the schema request service is always created with 'file`

[Martin Aeschlimann (aeschli)]

Investigated the issue why 'Location https://spec.openapis.org/overlay/1.1/schema/2026-04-01 is untrusted' message is not always showing.
microsoft/vscode-json-languageservice#357 (comment)
It was a regression from the changes for schema 2019 support. Fix is here: microsoft/vscode-json-languageservice#358.
Closing this PR.

[Martin Aeschlimann (aeschli)]

Vincent Biret (@baywet) If you can still provide the detailed steps for 1. and 2. that would be helpful. Input document, file name, how you configured the association.
That way I'm sure we are talking about the same issue.

[Vincent Biret (baywet)]

Martin Aeschlimann (@aeschli) thanks for looking into it! Yes I read the issue and pull request you created, and the behavior (from an end user perspective) is what I was experiencing.

I'm ok with closing this pr once yours gets merged and revisiting of I still experience anything odd in that area.