VSCode shouldn't allow extensions to disable TLS

[connorshea]

I'm not sure how hard it would be to prevent extensions from doing this, but recently it was found that a particularly popular extension had set NODE_TLS_REJECT_UNAUTHORIZED to 0, which – to my understanding – causes any editor with that extension installed to allow any HTTPS connections regardless of whether their TLS certificate is valid.

I'd argue that extensions should never be allowed to do this. Though there may be certain edge cases where this'd be necessary, it almost definitely isn't worth the risk to the average user.

I'm not a security professional, but I couldn't find any existing issues on the topic so I felt like I needed to open this.

Thanks for the great editor!

[alexdima]

@chrmarti @joaomoreno It looks like we have encountered this in the past, as documented at https://code.visualstudio.com/docs/setup/network#_ssl-certificates

Is there a way to generalize those flags to the extension host given all the proxy work?

[chrmarti]

We can look into applying any of these flags to the extension host. I see the extension has removed that flag for its upcoming version, so I guess we are good for now.

[vscodebot]

This feature request is now a candidate for our backlog. The community has 60 days to upvote the issue. If it receives 20 upvotes we will move it to our backlog. If not, we will close it. To learn more about how we handle feature requests, please see our documentation.

Happy Coding!