When you find out that something doesnt work, you still get the knowledge about how not to attack stuff

Someone messed messed with his on screen text.

Congrats,your comment worked, i just subscribed. Make that video soon

+ sub im exited

Afaik in that case there is a separate VSCode server running somewhere else which among other things runs extensions and launches and connects to the LSP servers. It also works like this when you connect VSCode to a remote (though there also are extensions that run locally in that case, not sure how exactly that behaves in the browser, I guess maybe the local extensions can only be JS and run in the browser). Also keep in mind that the LSP "servers" aren't the kind of servers that run somewhere else in the cloud or something. If you run VSCode locally, they are just programs that will be started by VSCode on your PC.

Nvm, you did it for extension not the server. 👍

I’m trying to figure out whether a malicious website can attack a VSCode extension that uses a language server via socket transport. Ultimately in the end I want to check whether my extension is safe against this potential attack

Websocket is a bit more complex protocol that requires the server to play along

Because code in the browser has a lower trust level, websites are sandboxed. If an application running on your machine communicates with other applications, it’s expected. If you allow a website to execute code on your machine it’s much worse.

The LSP protocol is entirely different from this.

It’s easy for an attacker to make the victim open a malicious website. Getting python code execution on the local computer is already game over ;)

It's not that strange when you consider that it can be used remotely, e.g. for remote editor environments (like Visual Studio Code supports). Using TCP with TLS wouldn't make sense locally, because the request and responses would have to be encrypted and decrypted on the same machine anyway. In this case you can use TLS on top of the TCP connection that is established with a remote LSP.

„mach ports“

I don't think it would make much of a difference performance-wise. Since no bytes have to be transmitted over the (slow) network, the performance cost of a single call to the language server is probably not going to depend too much on the length of the data to be sent, but will just be some more or less constant amount of time spent in kernel code (for the underlying IPC mechanism). So, with performance not being an issue, it makes sense to just make the API for the language server as programmer-friendly as possible. And there, JSON just wins over binary encoding. Sadly. :D

or just require that a particular header is set that no website sends by default

A malicious website. That’s why we explore whether we can attack the extension from the browser

@@LiveOverflow Yeah, eventually that was answered. But initially it was not clear. - Also, I think it's just what direction the search turned toward. Not the initial goal. - I guess the initial goal was "try to find any vulnerability" be it local escalation, or external access etc ... but that's a weird goal to have... but I guess it's just "how safe is it to let someone use VSCode+LSP" inside our reasonably trusted LAN etc ...

You literally described the video :D I had to do a security review of a vscode extension. And in the video I take you along researching one particular attack surface. It’s just the story from start to research result ;)

And yes, that’s research. „Initially the goal wasn’t clear“. Of course it’s not clear, that’s science and looking into the unknown;)

@@LiveOverflow Yeah, my bad. I didn't know exactly what "security review" is, so I was confused the first 75% of the video, before I figured out what the objective was. - As a software developer, I usually start by defining an attack surface. Don't worry with anything in the "trusted" scope, trust "nothing" in the outside world. Only caring about that one well defined surface to not go crazy. Otherwise I would never get anything done. - That's why it was hard for me to go along and think about the problem when that was not clear upfront. - It would have been useful for me to mention near the start we are looking for a vulnerability at any possible "level" (except not really untrusted extensions themselves?). - With VSCode extensions, I would be much more worried about evil/hacked extensions, dependency running a hacked script etc ... than an existing "backdoor" using it for escalation, or website injecting a script in my build... - But the browser direction was interesting. I always assume only local things can open connections to loopback ports, so never considered worrying about it (except extensions, tools that are local servers, etc) ... I wonder if my assumption is even right ... I never considered CORS at development time running on localhost.... O.O Great video, though. Thanks!

If malicious code is able to read raw tcp requests like that, it’s effectively game over for the system, and there’s no need to exploit vscode to achieve what the hacker wants. And in reality not all communication within the system needs to be encrypted. One concern which is valid is privacy concerns, and unfortunately if you install an app on your system, you’re essentially giving it free reign to access whatever file it wants

I think you'd have more important concerns if malware ended up on your computer in the first place.

🥇

​@@bigmistqke He deserves the award 😅😅

Who cares

@@HTWwpzIuqaObMt nobody

@@bigmistqke thank you for the honor dear sir