Skip to content

security: route external references through trust ref #325969

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Vincent Biret (baywet) wants to merge 2 commits into from
+2 −4
Closed

security: route external references through trust ref #325969

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c62c02f
Route remote schema refs through client trust checks
baywet Jul 15, 2026
046741d
docs: better documentation for browser scenario
baywet Jul 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions extensions/json-language-features/server/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ The server implements the following capabilities of the language server protocol
- syntax errors
- structural validation based on the document's [JSON schema](http://json-schema.org/).

In order to load JSON schemas, the JSON server uses NodeJS `http` and `fs` modules. For all other features, the JSON server only relies on the documents and settings provided by the client through the LSP.
In the Node.js build, the JSON server uses the `fs` module to load `file` schemas by default and delegates all other schema requests to the client. The browser build delegates all schema requests to the client. For all other features, the JSON server only relies on the documents and settings provided by the client through the LSP.

### Client requirements

Expand Down Expand Up @@ -127,7 +127,6 @@ let clientOptions: LanguageClientOptions = {

If `handledSchemaProtocols` is not set, the JSON language server will load the following URLs itself:

- `http`, `https`: Loaded using NodeJS's HTTP support. Proxies can be configured through the settings.
- `file`: Loaded using NodeJS's `fs` support.

#### Schema content request
Expand Down
3 changes: 1 addition & 2 deletions extensions/json-language-features/server/src/jsonServer.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,7 @@ const sortCodeActionKind = CodeActionKind.Source.concat('.sort', '.json');

export function startServer(connection: Connection, runtime: RuntimeEnvironment) {

function getSchemaRequestService(handledSchemas: string[] = ['https', 'http', 'file']) {
function getSchemaRequestService(handledSchemas: string[] = ['file']) {
const builtInHandlers: { [protocol: string]: RequestService | undefined } = {};
for (const protocol of handledSchemas) {
if (protocol === 'file') {
Expand Down Expand Up @@ -579,4 +579,3 @@ function getFullRange(document: TextDocument): Range {




Loading