Skip to content

Commit e5b3ff7

Browse files
author
Benjamin Pasero
authored
Enable sandbox and contextIsolation for process explorer when running with --__sandbox (microsoft#102924)
* sandbox - allow to enable sandbox and contextIsolation for process explorer * fix asar lookup
1 parent 040b60f commit e5b3ff7

13 files changed

Lines changed: 202 additions & 84 deletions

File tree

‎src/bootstrap-amd.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ const nlsConfig = bootstrap.setupNLS();
1414

1515
// Bootstrap: Loader
1616
loader.config({
17-
baseUrl: bootstrap.uriFromPath(__dirname),
17+
baseUrl: bootstrap.fileUriFromPath(__dirname),
1818
catchError: true,
1919
nodeRequire: require,
2020
nodeMain: __filename,

‎src/bootstrap-window.js‎

Lines changed: 53 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,9 @@
2121
globalThis.MonacoBootstrapWindow = factory();
2222
}
2323
}(this, function () {
24-
const path = require.__$__nodeRequire('path');
25-
const bootstrap = globalThis.MonacoBootstrap;
24+
const preloadGlobals = globals();
25+
const sandbox = preloadGlobals.context.sandbox;
26+
const safeProcess = sandbox ? preloadGlobals.process : process;
2627

2728
/**
2829
* @param {string[]} modulePaths
@@ -43,29 +44,33 @@
4344
const configuration = JSON.parse(args['config'] || '{}') || {};
4445

4546
// Error handler
46-
process.on('uncaughtException', function (error) {
47+
safeProcess.on('uncaughtException', function (error) {
4748
onUnexpectedError(error, enableDeveloperTools);
4849
});
4950

5051
// Developer tools
51-
const enableDeveloperTools = (process.env['VSCODE_DEV'] || !!configuration.extensionDevelopmentPath) && !configuration.extensionTestsPath;
52+
const enableDeveloperTools = (safeProcess.env['VSCODE_DEV'] || !!configuration.extensionDevelopmentPath) && !configuration.extensionTestsPath;
5253
let developerToolsUnbind;
5354
if (enableDeveloperTools || (options && options.forceEnableDeveloperKeybindings)) {
5455
developerToolsUnbind = registerDeveloperKeybindings(options && options.disallowReloadKeybinding);
5556
}
5657

57-
// Correctly inherit the parent's environment
58-
Object.assign(process.env, configuration.userEnv);
58+
// Correctly inherit the parent's environment (TODO@sandbox non-sandboxed only)
59+
if (!sandbox) {
60+
Object.assign(safeProcess.env, configuration.userEnv);
61+
}
5962

60-
// Enable ASAR support
61-
bootstrap.enableASARSupport(path.join(configuration.appRoot, 'node_modules'));
63+
// Enable ASAR support (TODO@sandbox non-sandboxed only)
64+
if (!sandbox) {
65+
globalThis.MonacoBootstrap.enableASARSupport(configuration.appRoot);
66+
}
6267

6368
if (options && typeof options.canModifyDOM === 'function') {
6469
options.canModifyDOM(configuration);
6570
}
6671

67-
// Get the nls configuration into the process.env as early as possible.
68-
const nlsConfig = bootstrap.setupNLS();
72+
// Get the nls configuration into the process.env as early as possible (TODO@sandbox non-sandboxed only)
73+
const nlsConfig = sandbox ? { availableLanguages: {} } : globalThis.MonacoBootstrap.setupNLS();
6974

7075
let locale = nlsConfig.availableLanguages['*'] || 'en';
7176
if (locale === 'zh-tw') {
@@ -76,16 +81,20 @@
7681

7782
window.document.documentElement.setAttribute('lang', locale);
7883

79-
// do not advertise AMD to avoid confusing UMD modules loaded with nodejs
80-
window['define'] = undefined;
84+
// do not advertise AMD to avoid confusing UMD modules loaded with nodejs (TODO@sandbox non-sandboxed only)
85+
if (!sandbox) {
86+
window['define'] = undefined;
87+
}
8188

82-
// replace the patched electron fs with the original node fs for all AMD code
83-
require.define('fs', ['original-fs'], function (originalFS) { return originalFS; });
89+
// replace the patched electron fs with the original node fs for all AMD code (TODO@sandbox non-sandboxed only)
90+
if (!sandbox) {
91+
require.define('fs', ['original-fs'], function (originalFS) { return originalFS; });
92+
}
8493

8594
window['MonacoEnvironment'] = {};
8695

8796
const loaderConfig = {
88-
baseUrl: `${bootstrap.uriFromPath(configuration.appRoot)}/out`,
97+
baseUrl: `${uriFromPath(configuration.appRoot)}/out`,
8998
'vs/nls': nlsConfig,
9099
amdModulesPattern: /^vs\//,
91100
};
@@ -150,7 +159,7 @@
150159
* @returns {() => void}
151160
*/
152161
function registerDeveloperKeybindings(disallowReloadKeybinding) {
153-
const ipcRenderer = globals().ipcRenderer;
162+
const ipcRenderer = preloadGlobals.ipcRenderer;
154163

155164
const extractKey = function (e) {
156165
return [
@@ -163,9 +172,9 @@
163172
};
164173

165174
// Devtools & reload support
166-
const TOGGLE_DEV_TOOLS_KB = (process.platform === 'darwin' ? 'meta-alt-73' : 'ctrl-shift-73'); // mac: Cmd-Alt-I, rest: Ctrl-Shift-I
175+
const TOGGLE_DEV_TOOLS_KB = (safeProcess.platform === 'darwin' ? 'meta-alt-73' : 'ctrl-shift-73'); // mac: Cmd-Alt-I, rest: Ctrl-Shift-I
167176
const TOGGLE_DEV_TOOLS_KB_ALT = '123'; // F12
168-
const RELOAD_KB = (process.platform === 'darwin' ? 'meta-82' : 'ctrl-82'); // mac: Cmd-R, rest: Ctrl-R
177+
const RELOAD_KB = (safeProcess.platform === 'darwin' ? 'meta-82' : 'ctrl-82'); // mac: Cmd-R, rest: Ctrl-R
169178

170179
let listener = function (e) {
171180
const key = extractKey(e);
@@ -192,7 +201,7 @@
192201
*/
193202
function onUnexpectedError(error, enableDeveloperTools) {
194203
if (enableDeveloperTools) {
195-
const ipcRenderer = globals().ipcRenderer;
204+
const ipcRenderer = preloadGlobals.ipcRenderer;
196205
ipcRenderer.send('vscode:openDevTools');
197206
}
198207

@@ -211,6 +220,31 @@
211220
return window.vscode;
212221
}
213222

223+
/**
224+
* TODO@sandbox this should not use the file:// protocol at all
225+
* and be consolidated with the fileUriFromPath() method in
226+
* bootstrap.js.
227+
*
228+
* @param {string} path
229+
* @returns {string}
230+
*/
231+
function uriFromPath(path) {
232+
let pathName = path.replace(/\\/g, '/');
233+
if (pathName.length > 0 && pathName.charAt(0) !== '/') {
234+
pathName = `/${pathName}`;
235+
}
236+
237+
/** @type {string} */
238+
let uri;
239+
if (safeProcess.platform === 'win32' && pathName.startsWith('//')) { // specially handle Windows UNC paths
240+
uri = encodeURI(`file:${pathName}`);
241+
} else {
242+
uri = encodeURI(`file://${pathName}`);
243+
}
244+
245+
return uri.replace(/#/g, '%23');
246+
}
247+
214248
return {
215249
load,
216250
globals

‎src/bootstrap.js‎

Lines changed: 12 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,11 @@
1616

1717
// Browser
1818
else {
19-
globalThis.MonacoBootstrap = factory();
19+
try {
20+
globalThis.MonacoBootstrap = factory();
21+
} catch (error) {
22+
console.warn(error); // expected when e.g. running with sandbox: true (TODO@sandbox eventually consolidate this)
23+
}
2024
}
2125
}(this, function () {
2226
const Module = require('module');
@@ -40,10 +44,10 @@
4044
//#region Add support for using node_modules.asar
4145

4246
/**
43-
* @param {string=} nodeModulesPath
47+
* @param {string} appRoot
4448
*/
45-
function enableASARSupport(nodeModulesPath) {
46-
let NODE_MODULES_PATH = nodeModulesPath;
49+
function enableASARSupport(appRoot) {
50+
let NODE_MODULES_PATH = appRoot ? path.join(appRoot, 'node_modules') : undefined;
4751
if (!NODE_MODULES_PATH) {
4852
NODE_MODULES_PATH = path.join(__dirname, '../node_modules');
4953
} else {
@@ -83,7 +87,7 @@
8387
* @param {string} _path
8488
* @returns {string}
8589
*/
86-
function uriFromPath(_path) {
90+
function fileUriFromPath(_path) {
8791
let pathName = path.resolve(_path).replace(/\\/g, '/');
8892
if (pathName.length > 0 && pathName.charAt(0) !== '/') {
8993
pathName = `/${pathName}`;
@@ -132,15 +136,15 @@
132136
}
133137

134138
const bundleFile = path.join(nlsConfig._resolvedLanguagePackCoreLocation, `${bundle.replace(/\//g, '!')}.nls.json`);
135-
readFile(bundleFile).then(function (content) {
139+
fs.promises.readFile(bundleFile, 'utf8').then(function (content) {
136140
const json = JSON.parse(content);
137141
bundles[bundle] = json;
138142

139143
cb(undefined, json);
140144
}).catch((error) => {
141145
try {
142146
if (nlsConfig._corruptedFile) {
143-
writeFile(nlsConfig._corruptedFile, 'corrupted').catch(function (error) { console.error(error); });
147+
fs.promises.writeFile(nlsConfig._corruptedFile, 'corrupted', 'utf8').catch(function (error) { console.error(error); });
144148
}
145149
} finally {
146150
cb(error, undefined);
@@ -152,23 +156,6 @@
152156
return nlsConfig;
153157
}
154158

155-
/**
156-
* @param {string} file
157-
* @returns {Promise<string>}
158-
*/
159-
function readFile(file) {
160-
return fs.promises.readFile(file, 'utf8');
161-
}
162-
163-
/**
164-
* @param {string} file
165-
* @param {string} content
166-
* @returns {Promise<void>}
167-
*/
168-
function writeFile(file, content) {
169-
return fs.promises.writeFile(file, content, 'utf8');
170-
}
171-
172159
//#endregion
173160

174161

@@ -254,6 +241,6 @@
254241
avoidMonkeyPatchFromAppInsights,
255242
configurePortable,
256243
setupNLS,
257-
uriFromPath
244+
fileUriFromPath
258245
};
259246
}));

0 commit comments

Comments
 (0)