Microsoft/vscode

Drag&Drop within extension from one webview to the other not working with vscode > 1.90.0

Open

#256,444 opened on Jul 17, 2025

View on GitHub
 (5 comments) (3 reactions) (1 assignee)TypeScript (74,848 stars) (10,221 forks)batch import
bughelp wantedwebview

Description

Problem: In my extenstion, when I drag an object from one webview (tree view in attached Sample project) and drop it into another webview, vscode security asks me to press shift before the drop. Since the source is not outside the project, I ask myself, if this is really a wished behavior by vscode. I would understand the logic when my drag area is an external file system, but here everthing happens within the same extension. The behavior makes my extension less usable. Is there some kind of fix planned? Or is this as known issue?
I have attached a Sample extension to illustrate the behavior.

Does this issue occur when all extensions are disabled?: Yes

  • VS Code Version: 1.102.0
  • OS Version: Windows 11

Steps to Reproduce:

  1. npm install
  2. npm run compile
  3. Press F5 to run extension
  4. In Extension press "Open Target Webview"
  5. From Explorer Select items form view "SECURITY DEMO ITEMS" and try to drop them in the drop area in the "Drop Target" view
  6. Message comes up to Hold Shift before dropping

Sample.zip

Contributor guide

Tech stack
typescripthtmlcss
Domain
frontendsecurity
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
blocked
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
VS Code extension developmentwebview APIdrag and drop
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60
Research direction
Investigate the security prompt behavior change introduced in VS Code 1.90.0 for drag and drop between webviews. Examine the webview drag and drop handling code in the VS Code source (likely in src/vs/workbench/services/webview/ or similar). Look for any related pull requests or discussions about this security change. The issue includes a sample extension to reproduce the behavior; test with the latest Insiders build to confirm the issue persists. Consider whether the extension can opt out or if a fix requires changes to VS Code's drag and drop security model.