Skip to content

SECURITY_REVIEW.md

Latest commit

 

History

History
132 lines (78 loc) · 8.37 KB

SECURITY_REVIEW.md

File metadata and controls

132 lines (78 loc) · 8.37 KB
Raw

Security Review

  • Review date: 2026-08-08
  • Scope: extension runtime, manifest, tests, npm dependency graph, package contents, and GitHub Actions workflows

Executive Summary

No critical runtime vulnerability was identified. The extension remains a small, transparent terminal launcher with no production dependencies, network access, hidden process execution, telemetry, or credential handling.

The 2026-08-08 follow-up found two newly disclosed high-severity advisories in transitive development dependencies, incomplete required-check coverage on main, and a behavioral test gap around Workspace Trust. All were remediated without changing runtime behavior. The final npm audit reports zero known vulnerabilities.

Critical Findings

None.

High-Severity Findings

SEC-001: Vulnerable transitive build dependencies — resolved

Impact: Processing attacker-controlled patterns or URIs in the affected build-time dependency paths could cause denial of service or URI host confusion during development or packaging.

npm audit reported brace-expansion below 5.0.8 (GHSA-mh99-v99m-4gvg) and fast-uri through 3.1.3 (GHSA-v2hh-gcrm-f6hx). Both were transitive development dependencies under @vscode/vsce; neither was shipped as an extension runtime dependency.

Resolution:

  • brace-expansion is locked to 5.0.9 (package-lock.json:1510).
  • fast-uri is locked to 3.1.5 (package-lock.json:2167).
  • npm run check:security now audits the lockfile at high severity (package.json:127).
  • CI and release jobs run the audit before accepting or publishing artifacts (.github/workflows/ci.yml:109, .github/workflows/release.yml:42).

SEC-007: Newly disclosed js-yaml and undici advisories — resolved

Impact: Malicious inputs reaching affected build-tool paths could cause denial of service or HTTP parsing and cache-safety failures during development or packaging; the extension runtime was not exposed because neither package is shipped in the VSIX.

The follow-up audit reported js-yaml 4.3.0 (GHSA-5p4m-2wfm-xmqj) and undici 7.28.0, including GHSA-4cwx-7wf7-3272. Both were transitive development dependencies under @vscode/vsce.

Resolution:

  • js-yaml is locked to 4.3.1 (package-lock.json:2748).
  • undici is locked to 7.29.0 (package-lock.json:4580).
  • npm audit --omit=dev and the full locked dependency audit both report zero known vulnerabilities.

Medium-Severity Findings

SEC-002: Mutable GitHub Action tags — resolved

The CI workflow referenced actions/checkout@v7 and actions/setup-node@v6. Major-version tags can move, so they do not provide an immutable supply-chain boundary.

Resolution:

  • All checkout and Node setup steps are pinned to verified full commit SHAs, with their major release retained in same-line comments for maintainability (.github/workflows/ci.yml:36, .github/workflows/ci.yml:39, .github/workflows/release.yml:21, .github/workflows/release.yml:24).
  • Default workflow permissions remain read-only; only the release job receives scoped contents: write permission (.github/workflows/release.yml:8, .github/workflows/release.yml:16).

SEC-008: Incomplete required-check coverage on main — resolved

Branch protection required only the Windows and Linux validation jobs. A pull request could therefore remain mergeable when dependency auditing, compatibility, or CodeQL checks failed.

Resolution:

  • Required checks now include dependency auditing, stable macOS, minimum VS Code compatibility, and both CodeQL analyses in addition to Windows and Linux validation.
  • Branch protection is enforced for administrators, while one approving review, stale-review dismissal, conversation resolution, linear history, and force-push/deletion blocking remain enabled.

Low-Severity Findings

SEC-003: VS Code type definitions could drift beyond the supported minimum — resolved

The manifest supports VS Code 1.103.0, while a caret range allowed npm to install much newer VS Code type definitions. That could let a future change compile against APIs unavailable in the minimum supported editor.

Resolution:

  • @types/vscode is pinned to 1.103.0 (package.json:133).
  • Strict compiler checks now include exact optional properties and unchecked-index protection (tsconfig.json:12, tsconfig.json:17).
  • CI exercises both stable VS Code and version 1.103.0.

SEC-006: Integration test could persist resolved settings globally — resolved

The Extension Host smoke test saved configuration with configuration.get(...), which can return a value resolved from a default or workspace scope. Writing that resolved value back to the global scope during cleanup could create a persistent user-level override in the isolated test profile.

Resolution:

  • The test now saves the exact globalValue returned by configuration.inspect(...) and restores that value after the smoke test (test/integration/suite/index.js:30, test/integration/suite/index.js:46).
  • The integration runner now reports failures explicitly and sets a non-zero process exit code, so CI cannot depend on unhandled-rejection behavior (test/integration/runTest.js:24).

SEC-009: Workspace Trust invariant had only structural coverage — resolved

The metadata test confirmed that trust and terminal calls existed in the source but did not execute the registered command in an untrusted state. A misplaced future check could therefore satisfy the regular expression without preserving the security boundary.

Resolution:

  • A behavioral test invokes the registered command callback with workspace.isTrusted false and verifies that configuration is not resolved, no terminal is created, and no text is sent (test/extension.test.js:83).
  • A trusted-path companion test verifies that the global user command is sent while a hostile workspace value is ignored (test/extension.test.js:103).

SEC-010: Dependency audit ran only after repository activity — resolved

New advisories disclosed after the last push could remain visible only as repository alerts until another branch or pull-request run occurred.

Resolution:

  • CI now runs the locked dependency audit every Monday and supports manual dispatch (.github/workflows/ci.yml:8).
  • Scheduled runs skip the Extension Host platform matrix and execute only the dependency audit (.github/workflows/ci.yml:21, .github/workflows/ci.yml:56).
  • Periodic Dependabot version-update pull requests remain intentionally disabled.

Reviewed Design Risks

SEC-004: User-configurable terminal command — accepted by design

The extension intentionally sends a configurable command to the integrated shell (src/extension.ts:68). This is code execution, but it is the product's explicit function and is mitigated by multiple controls:

  • execution is blocked until Workspace Trust is granted (src/extension.ts:24);
  • command resolution uses only the global user value or manifest default and ignores workspace-controlled values (src/command-utils.ts:25);
  • execution is visible in a newly created terminal;
  • the runtime does not inspect output, invoke a hidden child process, or install anything.

Residual guidance: users must review custom commands and must not place credentials in the setting.

SEC-005: Dependabot auto-merge trigger — reviewed, no change required

The workflow uses pull_request_target, which is dangerous if untrusted pull-request code is executed with write permissions. This workflow checks that the PR author is dependabot[bot], never checks out PR code, and only uses Dependabot metadata before enabling GitHub's gated auto-merge (.github/workflows/dependabot-auto-merge.yml:23, .github/workflows/dependabot-auto-merge.yml:33, .github/workflows/dependabot-auto-merge.yml:39, .github/workflows/dependabot-auto-merge.yml:45).

Verification

The security conclusions are supported by:

  • a clean locked install with install scripts disabled;
  • strict TypeScript type-checking and Biome linting;
  • unit, metadata, and VS Code Extension Host integration tests;
  • package-content inspection with vsce ls;
  • npm audit --package-lock-only --audit-level=high;
  • review of GitHub workflow permissions, triggers, and immutable action references.
  • live verification of required branch checks, review enforcement, CodeQL, secret scanning, and push protection.

This review covers the launcher repository only. Kimi Code CLI, VS Code, compatible editors, user shell configuration, and external providers remain outside its trust boundary.