src/vs/platform/sandbox/common/terminalSandboxMxcRuntime.ts
136 LOC · 119 covered · 17 uncovered · 25 ranges · 1052 concepts · 4 introducers · 489 tests
File neighbourhood
The centred file is linked to every concept that introduces one of its ranges, every test that runs code from the file, and the gray connector concepts standing between those tests and the file's own introducer concepts. Undirected links join concepts to every file where they introduce source and concepts to the tests they introduce; arrows show specialization between the displayed concepts and bridge only concepts omitted from this view. Concept colors match the source ranges below; connector concepts have no source color and are shown in gray.
Focused file, its introducer and connector concepts, their introduced files, and tests that run code from the file
In the embedded map, ordinary wheel input scrolls the page; use the visible controls to zoom and drag to pan. Open the full-screen map for canvas navigation: wheel pans, Ctrl/Command plus wheel zooms, and arrow keys pan when this region is focused. On touch screens, open the full-screen map to pan or pinch. If JavaScript or WebGL is unavailable, use the related-file, concept, and source links on this page.
Graph controls are ready.
Interactive rendering requires JavaScript and WebGL. Use the related-file, concept, and source links on this page while the interactive map is unavailable.
1
>
/*---------------------------------------------------------------------------------------------
terminalSandboxEngine.ts ×71
2
>
* Copyright (c) Microsoft Corporation. All rights reserved.
3
>
* Licensed under the MIT License. See License.txt in the project root for license information.
4
>
*--------------------------------------------------------------------------------------------*/
5
>
6
>
import { win32 } from '../../../base/common/path.js';
7
>
import { URI } from '../../../base/common/uri.js';
8
>
import { createDecorator } from '../../instantiation/common/instantiation.js';
9
>
import type { IWindowsMxcConfig, IWindowsMxcPolicyContainment, IWindowsMxcSandboxPolicy } from './sandboxHelperService.js';
10
>
11
>
export interface IWindowsMxcConfigOptions {
12
>
command: string;
13
>
shell?: string;
14
>
cwd: URI | undefined;
15
>
tempDir: URI;
16
>
schemaVersion?: string;
17
>
allowNetwork: boolean;
18
>
allowReadPaths: string[];
19
>
allowWritePaths: string[];
20
>
denyReadPaths: string[];
21
>
env: string[];
22
>
}
23
>
24
>
export type IWindowsMxcBuildSandboxPayload = (commandLine: string, policy: IWindowsMxcSandboxPolicy, workingDirectory?: string, containerName?: string, containment?: IWindowsMxcPolicyContainment) => Promise<IWindowsMxcConfig | undefined>;
25
>
26
>
export const IWindowsMxcTerminalSandboxRuntime = createDecorator<IWindowsMxcTerminalSandboxRuntime>('windowsMxcTerminalSandboxRuntime');
27
>
28
>
export interface IWindowsMxcTerminalSandboxRuntime {
29
>
readonly _serviceBrand: undefined;
30
>
31
>
getExecutablePath(appRoot: string, nativeModulesDir: string, arch: string | undefined): string;
32
>
getRuntimeReadPaths(appRoot: string | undefined, executablePath: string | undefined): string[];
33
>
createConfig(options: IWindowsMxcConfigOptions, buildSandboxPayload: IWindowsMxcBuildSandboxPayload): Promise<IWindowsMxcConfig>;
34
>
wrapCommand(executablePath: string, configPath: string): string;
35
>
wrapUnsandboxedCommand(command: string): string;
36
>
toWindowsPath(uri: URI): string;
37
>
}
38
>
39
>
/**
40
>
* Windows-only MXC integration for terminal sandboxing.
41
>
*
42
>
* This class is intentionally isolated from the SRT-backed runtime so it can be
43
>
* removed once SRT supports Windows sandboxing.
44
>
*/
45
>
export class WindowsMxcTerminalSandboxRuntime implements IWindowsMxcTerminalSandboxRuntime {
47
>
48
>
private readonly _configVersion = '0.6.0-alpha';
50
>
getExecutablePath(appRoot: string, nativeModulesDir: string, arch: string | undefined): string {
52
>
return win32.join(appRoot, nativeModulesDir, '@microsoft', 'mxc-sdk', 'bin', binArch, 'wxc-exec.exe');
53
>
}
55
>
getRuntimeReadPaths(appRoot: string | undefined, executablePath: string | undefined): string[] {
56
const paths: string[] = [];
57
if (appRoot) {
58
paths.push(appRoot);
59
}
60
if (executablePath) {
61
paths.push(executablePath, win32.dirname(executablePath));
62
}
63
return [...new Set(paths)];
64
}
66
>
async createConfig(options: IWindowsMxcConfigOptions, buildSandboxPayload: IWindowsMxcBuildSandboxPayload): Promise<IWindowsMxcConfig> {
68
>
const shell = options.shell
69
>
? this._quoteWindowsCommandLineArgument(options.shell)
70
: 'pwsh.exe';
71
>
const commandLine = `${shell} -NoProfile -Command ${this._quoteWindowsCommandLineArgument(options.command)}`;
terminalSandboxMxcRuntime.ts ×11
72
>
const cwd = options.cwd ? this.toWindowsPath(options.cwd) : tempDirPath;
73
>
const policy: IWindowsMxcSandboxPolicy = {
74
>
version: options.schemaVersion ?? this._configVersion,
75
>
timeoutMs: 0,
76
>
filesystem: {
77
>
readwritePaths: options.allowWritePaths.map(path => this._normalizeWindowsPath(path)),
78
>
readonlyPaths: [tempDirPath, ...(options.shell && win32.isAbsolute(options.shell) ? [win32.dirname(options.shell)] : []), ...options.allowReadPaths].map(path => this._normalizeWindowsPath(path)),
79
>
deniedPaths: options.denyReadPaths.map(path => this._normalizeWindowsPath(path)),
80
>
},
81
>
network: this._createNetworkPolicy(options.allowNetwork),
82
>
ui: {
83
>
allowWindows: true,
84
>
clipboard: 'none',
85
>
allowInputInjection: false,
86
>
},
87
>
};
88
>
89
>
const config = await buildSandboxPayload(commandLine, policy, cwd);
90
>
if (!config?.process) {
91
throw new Error('Unable to build Windows MXC sandbox payload');
92
}
94
>
config.process.env = [...options.env];
95
>
96
>
return config;
97
>
}
99
>
wrapCommand(executablePath: string, configPath: string): string {
100
>
return `& ${this._quotePowerShellArgument(executablePath)} ${this._quotePowerShellArgument(configPath)}`;
terminalSandboxMxcRuntime.ts ×11
101
>
}
103
>
wrapUnsandboxedCommand(command: string): string {
104
return command;
105
}
107
>
toWindowsPath(uri: URI): string {
109
>
if (uri.authority && uri.path.length > 1 && uri.scheme === 'file') {
110
value = `\\\\${uri.authority}${uri.path}`;
112
>
value = uri.path.slice(1);
113
>
} else {
114
value = uri.fsPath;
115
}
117
>
}
119
>
private _normalizeWindowsPath(path: string): string {
121
>
}
123
>
private _createNetworkPolicy(allowNetwork: boolean): NonNullable<IWindowsMxcSandboxPolicy['network']> {
124
>
// MXC does not support per-host network policies on Windows. Rely on the
terminalSandboxMxcRuntime.ts ×11
125
>
// overall allow/block policy instead of emitting unsupported host lists.
126
>
return { allowOutbound: allowNetwork };
127
>
}
129
>
private _quotePowerShellArgument(value: string): string {
131
>
}
133
>
private _quoteWindowsCommandLineArgument(value: string): string {
134
>
return `"${value.replace(/(\\*)"/g, '$1$1\\"').replace(/\\+$/g, '$&$&')}"`;
terminalSandboxMxcRuntime.ts ×11
135
>
}