Cherry pick/msrc 1.123 to release 1.123 (#55) (#320698)

* OTel visibility in Copilot Chat UI (#47)

* [msrc/1.123] 114763

* Add maxAttributeSizeChars configuration to OpenTelemetry settings

---------


(cherry picked from commit 042dc59)

* Prompt before connecting to non-loopback remote host:port authorities (#46)

A direct `<host>:<port>` remote authority (no resolver `+` prefix) bypasses
resolver extensions and connects straight to the given server. Since this form
can originate from untrusted sources (e.g. the `remoteAuthority` of a
`.code-workspace` file), a crafted workspace could silently point the window's
extension host backend at an attacker-controlled server.

Centralize a confirmation prompt at the connection point in the renderer:
when resolving a direct authority whose host is not loopback (localhost,
127.0.0.1, ::1), ask the user to confirm before connecting and abort if
declined. Add `isLoopbackHost` helper and tests.

(cherry picked from commit 9505d0f)

* GitHub - improve host parsing (#48)

(cherry picked from commit 4b6e246)

* path traversal fix (#50)

* fix path traversal

* fix compilation

(cherry picked from commit 9b31ff8)

* Path - improve isEqualOrParent calculation (#49)

(cherry picked from commit 0f1ba1e)

* Version bump to 1.123.1 (#52)

(cherry picked from commit db24d8b)

* copilot: update engines.vscode to ^1.123.1

(cherry picked from commit ffa3c3f)

* upgrading version to 1.123.2

* cherrypicking changes

---------








(cherry picked from commit 3c631b164c239e7aeaaae7c626b46c527b361af2)

Co-authored-by: Zhichao Li <Li.Zhichao@microsoft.com>
Co-authored-by: Zhichao Li <zhichli@microsoft.com>
Co-authored-by: Alexandru Dima <alexdima@microsoft.com>
Co-authored-by: Ladislau Szomoru <lszomoru@microsoft.com>
Co-authored-by: Sandeep Somavarapu <sasomava@microsoft.com>
Co-authored-by: ulugbekna <ulugbekna@gmail.com>
Co-authored-by: Megan Rogge <Megan.Rogge@microsoft.com>

Author: 8 people

src/vs/workbench/contrib/terminalContrib/chatAgentTools/browser/tools/commandLineAnalyzer/commandLineFileWriteAnalyzer.ts

@@ -146,7 +146,12 @@ export class CommandLineFileWriteAnalyzer extends Disposable implements ICommand
 							const fileUri = URI.isUri(fileWrite) ? fileWrite : URI.file(fileWrite);
 							// TODO: Handle command substitutions/complex destinations properly https://github.com/microsoft/vscode/issues/274167
 							// TODO: Handle environment variables properly https://github.com/microsoft/vscode/issues/274166
-							if (fileUri.fsPath.match(/[$\(\){}`~]/)) {
+							// `~` catches POSIX tilde expansion (e.g. `~/foo`) and `%` catches Windows
+							// environment variable expansions (e.g. `%APPDATA%\foo`). Neither is
+							// recognized as absolute by `posix.isAbsolute` / `win32.isAbsolute`, so
+							// without this guard they would be joined onto cwd and incorrectly classified
+							// as inside the workspace while expanding at runtime to a location outside it.
+							if (fileUri.fsPath.match(/[$\(\){}`~%]/)) {
 								isAutoApproveAllowed = false;
 								this._log('File write blocked due to likely containing a variable, sub-command, or tilde expansion', fileUri.toString());
 								break;

src/vs/workbench/contrib/terminalContrib/chatAgentTools/test/electron-browser/commandLineAnalyzer/commandLineFileWriteAnalyzer.test.ts

@@ -118,6 +118,8 @@ suite('CommandLineFileWriteAnalyzer', () => {
 			test('variable in filename - block', () => t('echo hello > $HOME/file.txt', 'outsideWorkspace', false, 1));
 			test('command substitution - block', () => t('echo hello > $(pwd)/file.txt', 'outsideWorkspace', false, 1));
 			test('brace expansion - block', () => t('echo hello > {a,b}.txt', 'outsideWorkspace', false, 1));
+			test('tilde expansion - block', () => t('echo hello > ~/file.txt', 'outsideWorkspace', false, 1));
+			test('percent-style variable - block', () => t('echo hello > %HOME%/file.txt', 'outsideWorkspace', false, 1));
 		});
 
 		suite('blockDetectedFileWrites: all', () => {
@@ -300,6 +302,8 @@ suite('CommandLineFileWriteAnalyzer', () => {
 			test('no redirections - allow', () => t('Write-Host "hello"', 'outsideWorkspace', true, 0));
 			test('variable in filename - block', () => t('Write-Host "hello" > $env:TEMP\\file.txt', 'outsideWorkspace', false, 1));
 			test('subexpression - block', () => t('Write-Host "hello" > $(Get-Date).log', 'outsideWorkspace', false, 1));
+			test('percent-style variable - block', () => t('Write-Host "hello" > %APPDATA%\\file.txt', 'outsideWorkspace', false, 1));
+			test('tilde expansion - block', () => t('Write-Host "hello" > ~\\file.txt', 'outsideWorkspace', false, 1));
 		});
 
 		suite('blockDetectedFileWrites: all', () => {