diff --git a/CHANGELOG.md b/CHANGELOG.md index e2ee7108b..18f149405 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -22,12 +22,27 @@ Code v99.99.999 ## Unreleased +Code v1.145.0 + +### Security + +- Strip code-server's cookie from web socket requests going over the built-in + proxy. We were already doing this for regular proxied HTTP requests, but not + for proxied web sockets. +- Add HttpOnly to cookies to prevent them from being accessed by JavaScript + proxied over the built-in proxy. + +### Changed + +- Update to Code 1.145.0 + ### Added -- `--disable-file-cache` keeps workspace files out of the browser cache. It - stops the webview service worker from storing them in Cache Storage and - serves them from `/vscode-remote-resource` with `Cache-Control: no-store`. - Extension files stay cached. +- Vietnamese locale. +- New flag `--disable-file-cache` that keeps workspace files out of the browser + cache. It stops the webview service worker from storing them in Cache Storage + and serves them from `/vscode-remote-resource` with `Cache-Control: no-store`. + Extension files will still be cached. ## [4.144.0](https://github.com/coder/code-server/releases/tag/v4.144.0) - 2026-10-29 diff --git a/lib/vscode b/lib/vscode index 2c33b50b1..a717861c0 160000 --- a/lib/vscode +++ b/lib/vscode @@ -1 +1 @@ -Subproject commit 2c33b50b16c472efe58357d1d2a8a5414bc23fbf +Subproject commit a717861c07586a53d83b80d742cd3f59b20a6273 diff --git a/patches/base-path.diff b/patches/base-path.diff index 59c6725ac..681407d6b 100644 --- a/patches/base-path.diff +++ b/patches/base-path.diff @@ -10,7 +10,7 @@ Index: code-server/lib/vscode/src/vs/base/common/network.ts =================================================================== --- code-server.orig/lib/vscode/src/vs/base/common/network.ts +++ code-server/lib/vscode/src/vs/base/common/network.ts -@@ -262,7 +262,9 @@ class RemoteAuthoritiesImpl { +@@ -263,7 +263,9 @@ class RemoteAuthoritiesImpl { return URI.from({ scheme: platform.isWeb ? this._preferredWebSchema : Schemas.vscodeRemoteResource, authority: `${host}:${port}`, diff --git a/patches/csp-hashes.diff b/patches/csp-hashes.diff index 3e9f215c7..603a23eb6 100644 --- a/patches/csp-hashes.diff +++ b/patches/csp-hashes.diff @@ -6,8 +6,8 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index -+ content="default-src 'none'; script-src 'sha256-BmcTt6YZr75RujSQ3gF/UQL77e1RrOx62jNeikpwtxc=' 'self'; frame-src 'self'; style-src 'unsafe-inline';"> +- content="default-src 'none'; script-src 'sha256-29YeDbmHnhN2BgMJKVq7vDCMiuya6rpEctI6SkJFfJc=' 'self'; frame-src 'self'; style-src 'unsafe-inline';"> ++ content="default-src 'none'; script-src 'sha256-PrK0S1PGjGJseEIewxhvBTIw2x6Ci21IJIkOZ3gFWMg=' 'self'; frame-src 'self'; style-src 'unsafe-inline';"> > | undefined; let closed = false; -@@ -915,7 +918,7 @@ export class WebviewElement extends Disp +@@ -919,7 +922,7 @@ export class WebviewElement extends Disp status: range ? 206 : 200, path: uri.path, mime: result.mimeType, @@ -132,7 +132,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/webviewEl mtime: result.mtime, range: rangeHeader, stream, -@@ -927,7 +930,7 @@ export class WebviewElement extends Disp +@@ -931,7 +934,7 @@ export class WebviewElement extends Disp status: range ? 206 : 200, path: uri.path, mime: result.mimeType, @@ -141,7 +141,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/webviewEl mtime: result.mtime, range: rangeHeader, }); -@@ -984,6 +987,14 @@ export class WebviewElement extends Disp +@@ -988,6 +991,14 @@ export class WebviewElement extends Disp }); } diff --git a/patches/external-file-actions.diff b/patches/external-file-actions.diff index ae375ff4e..6377a27db 100644 --- a/patches/external-file-actions.diff +++ b/patches/external-file-actions.diff @@ -239,8 +239,8 @@ Index: code-server/lib/vscode/src/vs/workbench/services/dialogs/browser/simpleFi @IRemoteAgentService private readonly remoteAgentService: IRemoteAgentService, @IPathService protected readonly pathService: IPathService, @IKeybindingService private readonly keybindingService: IKeybindingService, -@@ -362,21 +362,23 @@ export class SimpleFileDialog extends Di - this.filePickBox.placeholder = nls.localize('remoteFileDialog.placeholder', "Folder path"); +@@ -365,21 +365,23 @@ export class SimpleFileDialog extends Di + : nls.localize('remoteFileDialog.placeholder', "Folder path"); this.filePickBox.ok = true; this.filePickBox.okLabel = typeof this.options.openLabel === 'string' ? this.options.openLabel : this.options.openLabel?.withoutMnemonic; - if ((this.scheme !== Schemas.file) && this.options && this.options.availableFileSystems && (this.options.availableFileSystems.length > 1) && (this.options.availableFileSystems.indexOf(Schemas.file) > -1)) { @@ -290,7 +290,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/files/browser/views/explo import { WorkbenchCompressibleAsyncDataTree } from '../../../../../platform/list/browser/listService.js'; import { ISearchService, QueryType, getExcludes, ISearchConfiguration, ISearchComplete, IFileQuery } from '../../../../services/search/common/search.js'; import { CancellationToken } from '../../../../../base/common/cancellation.js'; -@@ -1515,7 +1516,8 @@ export class FileDragAndDrop implements +@@ -1543,7 +1544,8 @@ export class FileDragAndDrop implements @IConfigurationService private configurationService: IConfigurationService, @IInstantiationService private instantiationService: IInstantiationService, @IWorkspaceEditingService private workspaceEditingService: IWorkspaceEditingService, @@ -300,7 +300,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/files/browser/views/explo ) { const updateDropEnablement = (e: IConfigurationChangeEvent | undefined) => { if (!e || e.affectsConfiguration('explorer.enableDragAndDrop')) { -@@ -1740,15 +1742,17 @@ export class FileDragAndDrop implements +@@ -1768,15 +1770,17 @@ export class FileDragAndDrop implements // External file DND (Import/Upload file) if (data instanceof NativeDragAndDropData) { diff --git a/patches/integration.diff b/patches/integration.diff index d41b959a5..e880af7bf 100644 --- a/patches/integration.diff +++ b/patches/integration.diff @@ -169,7 +169,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/web.main.ts =================================================================== --- code-server.orig/lib/vscode/src/vs/workbench/browser/web.main.ts +++ code-server/lib/vscode/src/vs/workbench/browser/web.main.ts -@@ -65,6 +65,7 @@ import { IOpenerService } from '../../pl +@@ -67,6 +67,7 @@ import { IOpenerService } from '../../pl import { mixin, safeStringify } from '../../base/common/objects.js'; import { IndexedDB } from '../../base/browser/indexedDB.js'; import { WebFileSystemAccess } from '../../platform/files/browser/webFileSystemAccess.js'; @@ -177,7 +177,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/web.main.ts import { IProgressService } from '../../platform/progress/common/progress.js'; import { DelayedLogChannel } from '../services/output/common/delayedLogChannel.js'; import { dirname, joinPath } from '../../base/common/resources.js'; -@@ -141,6 +142,9 @@ export class BrowserMain extends Disposa +@@ -143,6 +144,9 @@ export class BrowserMain extends Disposa // Startup const instantiationService = workbench.startup(); diff --git a/patches/remote-storage.diff b/patches/remote-storage.diff index a62807144..2eb79aa06 100644 --- a/patches/remote-storage.diff +++ b/patches/remote-storage.diff @@ -196,7 +196,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/web.main.ts serviceCollection.set(IStorageService, service); return service; }) -@@ -610,7 +611,21 @@ export class BrowserMain extends Disposa +@@ -613,7 +614,21 @@ export class BrowserMain extends Disposa })); } @@ -223,7 +223,7 @@ Index: code-server/lib/vscode/src/vs/sessions/browser/web.main.ts =================================================================== --- code-server.orig/lib/vscode/src/vs/sessions/browser/web.main.ts +++ code-server/lib/vscode/src/vs/sessions/browser/web.main.ts -@@ -39,9 +39,9 @@ export class SessionsBrowserMain extends +@@ -41,9 +41,9 @@ export class SessionsBrowserMain extends _workspace: IAnyWorkspaceIdentifier, environmentService: IBrowserWorkbenchEnvironmentService, userDataProfileService: IUserDataProfileService, @@ -235,7 +235,7 @@ Index: code-server/lib/vscode/src/vs/sessions/browser/web.main.ts uriIdentityService: IUriIdentityService, policyService: IPolicyService, logService: ILogService, -@@ -82,7 +82,7 @@ export class SessionsBrowserMain extends +@@ -84,7 +84,7 @@ export class SessionsBrowserMain extends serviceCollection.set(IWorkbenchConfigurationService, configurationService); // Storage diff --git a/patches/series b/patches/series index 3fe2274d6..392eb015c 100644 --- a/patches/series +++ b/patches/series @@ -26,5 +26,5 @@ copilot.diff app-name.diff remote-storage.diff remote-secret-storage.diff -csp-hashes.diff disable-file-cache.diff +csp-hashes.diff diff --git a/patches/webview.diff b/patches/webview.diff index 395bf1792..74aaaf182 100644 --- a/patches/webview.diff +++ b/patches/webview.diff @@ -53,7 +53,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index =================================================================== --- code-server.orig/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html +++ code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html -@@ -266,7 +266,7 @@ +@@ -272,7 +272,7 @@ } const swPath = encodeURI(`service-worker.js?v=${expectedWorkerVersion}&vscode-resource-base-authority=${searchParams.get('vscode-resource-base-authority')}&remoteAuthority=${searchParams.get('remoteAuthority') ?? ''}&platform=${searchParams.get('platform')}`); @@ -62,7 +62,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index .then(async registration => { if (navigator.serviceWorker.controller) { // A previous SW is already controlling. Force an update -@@ -345,6 +345,12 @@ +@@ -351,6 +351,12 @@ const hostname = location.hostname;