Vihren Atlas

terminalSandboxReadAllowList.ts ×15

Joint frontier

unlabeled · c_31e3a6c417e0

1 test · 13096 LOC · 57 files · introduces 1 test · 153 LOC · 4 files

Introduces — evidence that enters the hierarchy at this concept

Code
32 ranges153 lines · 4 files
Tests
1 test

Contains — complete concept membership

All code (extent)
2140 ranges13096 lines · 57 files · Browse complete extent
All tests (intent)
1 testBrowse complete intent

Neighbourhood graph

The orange circle is the focus. Violet and green circles are every ancestor and descendant, broader and narrower, at any distance; blue squares and pink diamonds are the introduced files and exact introduced tests of every visible concept, not only the focus's. Arrows point from broader to narrower concepts and bridge only concepts omitted from this view. Undirected links show source or test introduction. Concept and file size follows LOC; exact test nodes use test-count units.

Introduced files, introduced tests, and structurally relevant concept specialization

In the embedded map, ordinary wheel input scrolls the page; use the visible controls to zoom and drag to pan. Open the full-screen map for canvas navigation: wheel pans, Ctrl/Command plus wheel zooms, and arrow keys pan when this region is focused. On touch screens, open the full-screen map to pan or pinch. If JavaScript or WebGL is unavailable, use the native relationship evidence on this page.

Graph controls are ready.

Interactive rendering requires JavaScript and WebGL. Use the native relationship evidence on this page while the interactive map is unavailable.

Native relationship evidence

Every exact file and test below is linked only from the concept that introduces it.

Introduced tests

Every collected test enters the hierarchy at exactly one concept.

1 test introduced at this concept.

Introduced code

Every collected source range enters the hierarchy at exactly one concept.

4 files ranked by introduced lines: 153 introduced LOC across 32 ranges. Expand a file to inspect source; the > gutter marks introduced lines.

src/vs/platform/sandbox/common/terminalSandboxReadAllowList.ts 81 introduced LOC · 15 ranges

Open complete file

88 */
89
90 > function getTerminalSandboxReadAllowListForOperation(operation: TerminalSandboxReadAllowListOperation, os: OperatingSystem): readonly string[] { terminalSandboxReadAllowList.ts
91 > if (os === OperatingSystem.Windows) {
92 return [];
93 }
94 > terminalSandboxReadAllowList.ts
95 > switch (operation) {
96 > case TerminalSandboxReadAllowListOperation.Git:
97 > switch (os) {
98 > case OperatingSystem.Macintosh:
99 > case OperatingSystem.Linux:
100 > default:
101 > return [
102 > '~/.gitconfig',
103 > '~/.config/gh/config.yml',
104 > '~/.config/git/config',
105 > '~/.gitignore',
106 > '~/.gitignore_global',
107 > '~/.config/git/ignore',
108 > '~/.config/git/attributes',
109 > ];
110 > }
111 >
112 > case TerminalSandboxReadAllowListOperation.Node:
113 switch (os) {
114 case OperatingSystem.Macintosh:
168 ];
169 }
170 > terminalSandboxReadAllowList.ts
171 > case TerminalSandboxReadAllowListOperation.Rust:
172 switch (os) {
173 case OperatingSystem.Macintosh:
181 ];
182 }
183 > terminalSandboxReadAllowList.ts
184 > case TerminalSandboxReadAllowListOperation.Go:
185 switch (os) {
186 case OperatingSystem.Macintosh:
198 ];
199 }
200 > terminalSandboxReadAllowList.ts
201 > case TerminalSandboxReadAllowListOperation.Python:
202 switch (os) {
203 case OperatingSystem.Macintosh:
225 ];
226 }
227 > terminalSandboxReadAllowList.ts
228 > case TerminalSandboxReadAllowListOperation.Java:
229 switch (os) {
230 case OperatingSystem.Macintosh:
238 ];
239 }
240 > terminalSandboxReadAllowList.ts
241 > case TerminalSandboxReadAllowListOperation.Dotnet:
242 switch (os) {
243 case OperatingSystem.Macintosh:
248 ];
249 }
250 > terminalSandboxReadAllowList.ts
251 > case TerminalSandboxReadAllowListOperation.Nuget:
252 switch (os) {
253 case OperatingSystem.Macintosh:
263 ];
264 }
265 > terminalSandboxReadAllowList.ts
266 > case TerminalSandboxReadAllowListOperation.Msbuild:
267 switch (os) {
268 case OperatingSystem.Macintosh:
271 return [];
272 }
273 > terminalSandboxReadAllowList.ts
274 > case TerminalSandboxReadAllowListOperation.Ruby:
275 switch (os) {
276 case OperatingSystem.Macintosh:
290 ];
291 }
292 > terminalSandboxReadAllowList.ts
293 > case TerminalSandboxReadAllowListOperation.NativeBuild:
294 switch (os) {
295 case OperatingSystem.Macintosh:
305 ];
306 }
307 > terminalSandboxReadAllowList.ts
308 > case TerminalSandboxReadAllowListOperation.Conan:
309 switch (os) {
310 case OperatingSystem.Macintosh:
316 ];
317 }
318 > terminalSandboxReadAllowList.ts
319 > case TerminalSandboxReadAllowListOperation.GnuPG:
320 > switch (os) {
321 > case OperatingSystem.Macintosh:
322 > case OperatingSystem.Linux:
323 > default:
324 > return [
325 > '~/.gnupg',
326 > ];
327 > }
328 >
329 > case TerminalSandboxReadAllowListOperation.Ssh:
330 > switch (os) {
331 > case OperatingSystem.Macintosh:
332 > case OperatingSystem.Linux:
333 > default:
334 > return [
335 > '~/.ssh',
336 > ];
337 > }
338 > }
339 > }
340
341 function getTerminalSandboxReadAllowListForCommandDetails(os: OperatingSystem, commandDetails: readonly ITerminalSandboxCommand[]): readonly string[] {
342 const operations = new Set<TerminalSandboxReadAllowListOperation>();
343 for (const command of commandDetails) {
344 > for (const rule of terminalSandboxReadAllowListCommandDetailRules) { terminalSandboxReadAllowList.ts
345 > if (matchesTerminalSandboxCommandRule(command, rule, { os })) {
346 > operations.add(rule.value);
347 > }
348 > }
349 > }
350
351 const paths = [...operations].flatMap(operation => getTerminalSandboxReadAllowListForOperation(operation, os));
378 return getTerminalSandboxReadAllowListForCommandDetails(os, commandDetails);
379 }
380 > terminalSandboxReadAllowList.ts
381 > const operations = new Set<TerminalSandboxReadAllowListOperation>();
382 > for (const keyword of commandKeywords) {
383 > const operation = terminalSandboxReadAllowListKeywordMap.get(keyword.toLowerCase());
384 > if (operation) {
385 > operations.add(operation);
386 > }
387 > }
388 >
389 > const paths = [...operations].flatMap(operation => getTerminalSandboxReadAllowListForOperation(operation, os));
390 > return [...new Set([...paths, ...getTerminalSandboxReadAllowListForCommandDetails(os, commandDetails)])];
391 > }
src/vs/platform/sandbox/common/terminalSandboxRuntimeConfigurationPerOperation.ts 53 introduced LOC · 11 ranges

Open complete file

25 ];
26
27 > function getTerminalSandboxRuntimeConfigurationForOperation(operation: TerminalSandboxRuntimeConfigurationOperation, os: OperatingSystem): Record<string, unknown> { terminalSandboxRuntimeConfigurationPerOperation.ts
28 > switch (operation) {
29 > case TerminalSandboxRuntimeConfigurationOperation.GnuPG:
30 > switch (os) {
31 > case OperatingSystem.Windows:
32 return {};
33 > case OperatingSystem.Macintosh: terminalSandboxRuntimeConfigurationPerOperation.ts
34 > case OperatingSystem.Linux:
35 > default:
36 > return {
37 > network: {
38 > allowAllUnixSockets: true
39 > },
40 > filesystem: {
41 > allowRead: [
42 > '~/.gnupg'
43 > ],
44 > allowWrite: [
45 > '~/.gnupg'
46 > ]
47 > }
48 > };
49 > }
50 >
51 > case TerminalSandboxRuntimeConfigurationOperation.Node:
52 switch (os) {
53 case OperatingSystem.Windows:
64 };
65 }
66 > } terminalSandboxRuntimeConfigurationPerOperation.ts
67 > }
68
69 export function getTerminalSandboxRuntimeConfigurationForCommands(os: OperatingSystem, commandDetails: readonly ITerminalSandboxCommand[]): Record<string, unknown> {
70 const operations = new Set<TerminalSandboxRuntimeConfigurationOperation>();
71 for (const command of commandDetails) {
72 > for (const rule of terminalSandboxRuntimeConfigurationCommandRules) { terminalSandboxRuntimeConfigurationPerOperation.ts
73 > if (matchesTerminalSandboxCommandRule(command, rule, { os }) && shouldApplyRuntimeConfigurationOperation(rule.value, commandDetails)) {
74 > operations.add(rule.value);
75 > }
76 > }
77 > }
78
79 const configuration: Record<string, unknown> = {};
80 for (const operation of operations) {
81 > mergeAdditionalSandboxConfigProperties(configuration, getTerminalSandboxRuntimeConfigurationForOperation(operation, os)); terminalSandboxRuntimeConfigurationPerOperation.ts
82 > }
83 return configuration;
84 }
85
86 > function shouldApplyRuntimeConfigurationOperation(operation: TerminalSandboxRuntimeConfigurationOperation, commandDetails: readonly ITerminalSandboxCommand[]): boolean { terminalSandboxRuntimeConfigurationPerOperation.ts
87 > switch (operation) {
88 > case TerminalSandboxRuntimeConfigurationOperation.GnuPG:
89 > // Docker socket access can grant host-level privileges, so do not allow all Unix
90 > // sockets when a Docker-related command is part of the sandbox invocation.
91 > return commandDetails.every(command => !command.keyword.toLowerCase().startsWith('docker'));
92 > case TerminalSandboxRuntimeConfigurationOperation.Node:
93 return true;
94 > } terminalSandboxRuntimeConfigurationPerOperation.ts
95 > }
96
97 > function mergeAdditionalSandboxConfigProperties(target: Record<string, unknown>, additional: Record<string, unknown>): void { terminalSandboxRuntimeConfigurationPerOperation.ts
98 > for (const [key, value] of Object.entries(additional)) {
99 > if (!Object.prototype.hasOwnProperty.call(target, key)) {
100 > target[key] = value;
101 > continue;
102 > }
103
104 const existingValue = target[key];
105 > if (Array.isArray(existingValue) && Array.isArray(value)) { terminalSandboxRuntimeConfigurationPerOperation.ts
106 target[key] = [...new Set([...existingValue, ...value])];
107 continue;
108 }
109 > if (isObjectForSandboxConfigMerge(existingValue) && isObjectForSandboxConfigMerge(value)) { terminalSandboxRuntimeConfigurationPerOperation.ts
110 mergeAdditionalSandboxConfigProperties(existingValue, value);
111 }
112 > } terminalSandboxRuntimeConfigurationPerOperation.ts
113 > }
114
115 function isObjectForSandboxConfigMerge(value: unknown): value is Record<string, unknown> {
src/vs/platform/sandbox/common/terminalSandboxEngine.ts 12 introduced LOC · 3 ranges

Open complete file

567 const result: ITerminalSandboxCommand[] = [];
568 for (const command of commandDetails) {
569 > const normalizedCommand = { keyword: command.keyword.toLowerCase(), args: [...command.args] }; terminalSandboxEngine.ts
570 > const key = JSON.stringify(normalizedCommand);
571 > if (!seen.has(key)) {
572 > seen.add(key);
573 > result.push(normalizedCommand);
574 > }
575 > }
576 return result.sort((a, b) => a.keyword.localeCompare(b.keyword) || a.args.join('\0').localeCompare(b.args.join('\0')));
577 }
847 return [];
848 }
849 > terminalSandboxEngine.ts
850 > const paths = filesystem[key];
851 > if (!Array.isArray(paths)) {
852 return [];
853 }
854 > terminalSandboxEngine.ts
855 > return paths.filter((path): path is string => typeof path === 'string');
856 }
857
src/vs/platform/sandbox/common/terminalSandboxCommandRules.ts 7 introduced LOC · 3 ranges

Open complete file

23
24 export function matchesTerminalSandboxCommandRule<T>(command: ITerminalSandboxCommand, rule: ITerminalSandboxCommandRule<T>, context?: ITerminalSandboxCommandRuleContext): boolean {
25 > if (!rule.keywords.includes(command.keyword.toLowerCase())) { terminalSandboxCommandRules.ts
26 > return false;
27 > }
28 > if (rule.condition && (!context || !rule.condition(context))) {
29 return false;
30 }
31 > if (rule.subcommands) { terminalSandboxCommandRules.ts
32 const subcommand = getCommandSubcommand(command.args, rule.optionsWithValue);
33 if (subcommand === undefined || !rule.subcommands.includes(subcommand)) {

Direct hierarchy

Children