Thank you for all your efforts and detail here, noted.
1-Click GitHub Token Stealing via a VSCode Bug
61–70 of 116 posts
Re: 1-Click GitHub Token Stealing via a VSCode Bug
#62This is a very good writeup. Zooming way out (perhaps to the point of useless observation), it's a pity that the web embedded VSCode editor is signed into GitHub at all . Defense-in-depth or not, a huge vulnerability surface arises from that original sin. It'd be like if you had a god-permissioned GitHub API token stored in world-readable plaintext on your workstation for the malicious-NPM-package-of-the-week to find…
> it'd be awesome if the in-browser IDE launched with a temporary per-repo permission scope That's actually exactly what they do for codespaces. The token only has read/write on the repo you activated for the codespace [1]. They should definitely consider doing that for github.dev as well. [1] https://orca.security/resources/blog/hacking-github-codespac...
Or they could’ve kept their bounty program running smoothly. But instead they pissed off another security researcher and received a zero days heads-up before public disclosure.
Re: 1-Click GitHub Token Stealing via a VSCode Bug
#63And when what it does with it?
Re: 1-Click GitHub Token Stealing via a VSCode Bug
#64> The only way to allow this behavior is to have the two web pages in the different origins cooperate with each other using the Window.postMessage() API
Small nitpick, but it's also possible to communicate by changing the location.anchor property (by either the iframe or its parent window.)
Re: 1-Click GitHub Token Stealing via a VSCode Bug
#65tl;dr: never press github.dev or open vscode.dev on a repo you don't trust
and don’t open links like https://tinyurl.com/2s3twstw either, or any other page on the internet that’s able to redirect you to github.dev
Re: 1-Click GitHub Token Stealing via a VSCode Bug
#66This is a very good writeup.
Re: 1-Click GitHub Token Stealing via a VSCode Bug
#67This is a very good writeup. Zooming way out (perhaps to the point of useless observation), it's a pity that the web embedded VSCode editor is signed into GitHub at all . Defense-in-depth or not, a huge vulnerability surface arises from that original sin. It'd be like if you had a god-permissioned GitHub API token stored in world-readable plaintext on your workstation for the malicious-NPM-package-of-the-week to find…
You can use SSH keys and GitHub deploy keys to approximate this. Can't speak for the security of it, but I have never set up GitHub with access to every repo. Not sure if there exists approximate functionality in other git forges though.
Re: 1-Click GitHub Token Stealing via a VSCode Bug
#68[flagged]
Re: 1-Click GitHub Token Stealing via a VSCode Bug
#69Ok, I really need to look into Kate and maybe Neovim. Fuck this shit, honestly.
Re: 1-Click GitHub Token Stealing via a VSCode Bug
#70If you like VSCode but don't like Microsoft, try Zed (zed.dev).
Zed is nice, but the project wide search (sidebar based) in VS Code and diff viewer in VS Code are still better IMO and unfortunately since I no longer code, those are my most used features of an editor. Still using it instead of VS Code but I sure wish it improved those views.