Vihren Atlas

terminalSandboxEngine.ts ×19

Code frontier

unlabeled · c_9d0cab8ad55a

3 tests · 12832 LOC · 57 files · introduces 0 tests · 63 LOC · 1 file

Introduces — evidence that enters the hierarchy at this concept

Code
19 ranges63 lines · 1 files
Tests
0 tests

Contains — complete concept membership

All code (extent)
2056 ranges12832 lines · 57 files · Browse complete extent
All tests (intent)
3 testsBrowse complete intent

Neighbourhood graph

The orange circle is the focus. Violet and green circles are every ancestor and descendant, broader and narrower, at any distance; blue squares and pink diamonds are the introduced files and exact introduced tests of every visible concept, not only the focus's. Arrows point from broader to narrower concepts and bridge only concepts omitted from this view. Undirected links show source or test introduction. Concept and file size follows LOC; exact test nodes use test-count units.

Introduced files, introduced tests, and structurally relevant concept specialization

In the embedded map, ordinary wheel input scrolls the page; use the visible controls to zoom and drag to pan. Open the full-screen map for canvas navigation: wheel pans, Ctrl/Command plus wheel zooms, and arrow keys pan when this region is focused. On touch screens, open the full-screen map to pan or pinch. If JavaScript or WebGL is unavailable, use the native relationship evidence on this page.

Graph controls are ready.

Interactive rendering requires JavaScript and WebGL. Use the native relationship evidence on this page while the interactive map is unavailable.

Native relationship evidence

Every exact file and test below is linked only from the concept that introduces it.

Introduced tests

Every collected test enters the hierarchy at exactly one concept.

No tests are introduced at this concept. Its intent tests are introduced by other concepts.

Introduced code

Every collected source range enters the hierarchy at exactly one concept.

1 file ranked by introduced lines: 63 introduced LOC across 19 ranges. Expand a file to inspect source; the > gutter marks introduced lines.

src/vs/platform/sandbox/common/terminalSandboxEngine.ts 63 introduced LOC · 19 ranges

Open complete file

358
359 async checkFileAccess(permission: TerminalSandboxFileAccessPermission, paths: readonly string[], precheckInputs?: ITerminalSandboxPrecheckInputs): Promise<ITerminalSandboxFileAccessCheckResult> {
360 > if (!(await this._isSandboxConfiguredEnabled(precheckInputs))) { terminalSandboxEngine.ts
361 return { allowed: true, denied: [] };
362 }
363 > terminalSandboxEngine.ts
364 > await this._resolveRuntimeInfo();
365 > if (!this._tempDir) {
366 > await this._initTempDir();
367 > }
368 >
369 > const configFilePath = this._tempDir ? this._getUriPath(URI.joinPath(this._tempDir, `vscode-sandbox-settings-${this._sandboxSettingsId}.json`)) : undefined;
370 > const accessPaths = await this._getFileSystemAccessPaths(configFilePath);
371 > const denied: string[] = [];
372 > for (const path of paths) {
373 > if (!path || !await this._hasFileSystemAccess(permission, path, accessPaths)) {
374 denied.push(path);
375 }
376 > } terminalSandboxEngine.ts
377 >
378 > return { allowed: denied.length === 0, denied };
379 > }
380
381 async getSandboxConfigPath(forceRefresh: boolean = false, precheckInputs?: ITerminalSandboxPrecheckInputs): Promise<string | undefined> {
706
707 private async _getFileSystemAccessPaths(configFilePath: string | undefined): Promise<ITerminalSandboxFileSystemAccessPaths> {
708 > const linuxFileSystemSetting = this._os === OperatingSystem.Linux terminalSandboxEngine.ts
709 > ? this._getSettingValue<ITerminalSandboxFileSystemSetting>(AgentSandboxSettingId.AgentSandboxLinuxFileSystem) ?? {}
710 : {};
711 > const macFileSystemSetting = this._os === OperatingSystem.Macintosh terminalSandboxEngine.ts
712 ? this._getSettingValue<ITerminalSandboxFileSystemSetting>(AgentSandboxSettingId.AgentSandboxMacFileSystem) ?? {}
713 > : {}; terminalSandboxEngine.ts
714 > const windowsFileSystemSetting = this._os === OperatingSystem.Windows
715 ? this._getSettingValue<ITerminalSandboxFileSystemSetting>(AgentSandboxSettingId.AgentSandboxWindowsFileSystem) ?? {}
716 > : {}; terminalSandboxEngine.ts
717 > const commandRuntimeSetting = getTerminalSandboxRuntimeConfigurationForCommands(this._os, this._commandAllowListCommandDetails);
718 > const commandRuntimeAllowReadPaths = this._getCommandRuntimeFileSystemPaths(commandRuntimeSetting, 'allowRead');
719 > const commandRuntimeAllowWritePaths = this._getCommandRuntimeFileSystemPaths(commandRuntimeSetting, 'allowWrite');
720 > let allowWritePaths: string[] = [];
721 > let allowReadPaths: string[] = [];
722 > let denyReadPaths: string[] = [];
723 > let denyWritePaths: string[] | undefined;
724 > if (this._os === OperatingSystem.Windows) {
725 const filesystemPolicy = await this._getWindowsMxcFilesystemPolicy();
726 allowWritePaths = await this._resolveFileSystemPaths([
730 allowReadPaths = await this._resolveFileSystemPaths([...(windowsFileSystemSetting.allowRead ?? []), ...filesystemPolicy.readonlyPaths]);
731 denyReadPaths = await this._resolveFileSystemPaths(windowsFileSystemSetting.denyRead ?? []);
732 > } else if (this._os === OperatingSystem.Macintosh) { terminalSandboxEngine.ts
733 allowWritePaths = (await this._resolveFileSystemPaths(await this._updateAllowWritePathsWithWorkspaceFolders(macFileSystemSetting.allowWrite, commandRuntimeAllowWritePaths))).filter(path => path !== configFilePath);
734 allowReadPaths = await this._resolveFileSystemPaths(await this._updateAllowReadPathsWithAllowWrite(macFileSystemSetting.allowRead, allowWritePaths, commandRuntimeAllowReadPaths));
735 denyReadPaths = await this._resolveFileSystemPaths(this._updateDenyReadPathsWithHome([...(macFileSystemSetting.denyRead ?? []), ...(configFilePath ? [configFilePath] : [])]));
736 denyWritePaths = macFileSystemSetting.denyWrite ? await this._resolveFileSystemPaths(macFileSystemSetting.denyWrite) : undefined;
737 > } else if (this._os === OperatingSystem.Linux) { terminalSandboxEngine.ts
738 > allowWritePaths = (await this._resolveFileSystemPaths(await this._updateAllowWritePathsWithWorkspaceFolders(linuxFileSystemSetting.allowWrite, commandRuntimeAllowWritePaths))).filter(path => path !== configFilePath);
739 > allowReadPaths = await this._resolveFileSystemPaths(await this._updateAllowReadPathsWithAllowWrite(linuxFileSystemSetting.allowRead, allowWritePaths, commandRuntimeAllowReadPaths));
740 > denyReadPaths = await this._resolveFileSystemPaths(this._updateDenyReadPathsWithHome([...(linuxFileSystemSetting.denyRead ?? []), ...(configFilePath ? [configFilePath] : [])]));
741 > denyWritePaths = await this._resolveFileSystemPaths(linuxFileSystemSetting.denyWrite);
742 > }
743 >
744 > return { allowReadPaths, allowWritePaths, denyReadPaths, denyWritePaths };
745 > }
746
747 private async _hasFileSystemAccess(permission: TerminalSandboxFileAccessPermission, path: string, accessPaths: ITerminalSandboxFileSystemAccessPaths): Promise<boolean> {
748 > const resolvedPaths = await this._resolveFileSystemPath(path); terminalSandboxEngine.ts
749 > if (permission === 'write') {
750 if (this._os === OperatingSystem.Windows && this._matchesAnyFileSystemPath(resolvedPaths, accessPaths.denyReadPaths)) {
751 return false;
761 }
762 return !this._matchesAnyFileSystemPath(resolvedPaths, accessPaths.denyReadPaths);
763 > } terminalSandboxEngine.ts
764
765 private _matchesAnyFileSystemPath(paths: readonly string[], matchers: readonly string[]): boolean {
766 > return paths.some(path => matchers.some(matcher => this._matchesFileSystemPath(path, matcher))); terminalSandboxEngine.ts
767 > }
768
769 /**
781 */
782 private _matchesFileSystemPath(path: string, matcher: string): boolean {
783 > const normalizedPath = this._normalizeFileSystemAccessPath(path); terminalSandboxEngine.ts
784 > const normalizedMatcher = this._normalizeFileSystemAccessPath(matcher, true);
785 > const ignoreCase = this._os === OperatingSystem.Windows;
786 > if (this._containsGlobPattern(normalizedMatcher)) {
787 return globMatch(normalizedMatcher, normalizedPath, { ignoreCase });
788 }
789 > return this._fileSystemPathExtUri.isEqualOrParent(this._toFileSystemAccessUri(normalizedPath), this._toFileSystemAccessUri(normalizedMatcher)); terminalSandboxEngine.ts
790 > }
791
792 /**
803 */
804 private _toFileSystemAccessUri(path: string): URI {
805 > return URI.from({ scheme: 'terminal-sandbox-path', path: path.startsWith('/') ? path : `/${path}` }); terminalSandboxEngine.ts
806 > }
807
808 /**
821 */
822 private _normalizeFileSystemAccessPath(path: string, preserveGlob: boolean = false): string {
823 > let normalizedPath = this._os === OperatingSystem.Windows ? path.replace(/\\/g, '/') : path; terminalSandboxEngine.ts
824 > if (this._os === OperatingSystem.Windows && /^\/[a-zA-Z]:($|\/)/.test(normalizedPath)) {
825 normalizedPath = normalizedPath.slice(1);
826 }
827 > if (!preserveGlob || !this._containsGlobPattern(normalizedPath)) { terminalSandboxEngine.ts
828 > normalizedPath = posix.normalize(normalizedPath);
829 > }
830 > if (normalizedPath.length > 1 && normalizedPath.endsWith('/') && !/^[a-zA-Z]:\/$/.test(normalizedPath)) {
831 normalizedPath = normalizedPath.replace(/\/+$/, '');
832 }
833 > return normalizedPath; terminalSandboxEngine.ts
834 > }
835
836 private _containsGlobPattern(path: string): boolean {
837 > return /[*?{\[]/.test(path); terminalSandboxEngine.ts
838 > }
839
840 private readonly _buildSandboxPayload = (commandLine: string, policy: IWindowsMxcSandboxPolicy, workingDirectory?: string, containerName?: string, containment?: IWindowsMxcPolicyContainment): Promise<IWindowsMxcConfig | undefined> => {

Direct hierarchy

Parents

Children