Follow-up from #275.
Problem
src/webview/webviewHtml.ts:40:
const parts = relativePath.split('/').filter(Boolean);
return webview.asWebviewUri(
vscode.Uri.joinPath(extensionUri, 'out', 'webview', ...parts)
);filter(Boolean) drops empty segments but keeps .., so assetUri(webview, extensionUri, '../extension.js') resolves outside the out/webview root the doc comment promises. An empty relativePath silently returns the directory itself rather than failing.
Unreachable today — the only call site passes the literal 'styles/loading.css'. It matters because the point of the module is that future callers pass computed paths, and the next PRs in the #275 sequence are exactly those callers.
Suggested fix
Reject a path that contains a .. segment, starts from the filesystem root, or yields no segments at all. Throw rather than return a URI: a bad asset path is a programming error, and a silently wrong URI just 404s inside the webview with nothing pointing back here.
Covered by the unit tests this module gains once it is vscode-free.
Follow-up from #275.
Problem
src/webview/webviewHtml.ts:40:filter(Boolean)drops empty segments but keeps.., soassetUri(webview, extensionUri, '../extension.js')resolves outside theout/webviewroot the doc comment promises. An emptyrelativePathsilently returns the directory itself rather than failing.Unreachable today — the only call site passes the literal
'styles/loading.css'. It matters because the point of the module is that future callers pass computed paths, and the next PRs in the #275 sequence are exactly those callers.Suggested fix
Reject a path that contains a
..segment, starts from the filesystem root, or yields no segments at all. Throw rather than return a URI: a bad asset path is a programming error, and a silently wrong URI just 404s inside the webview with nothing pointing back here.Covered by the unit tests this module gains once it is
vscode-free.