Security: Multiple vulnerabilities found via Snyk Code Analysis (XSS, Path Traversal, ReDoS, Open Redirect)

Bắt đầu bằng cách chạy lại Snyk Code Analysis trên main branch gần v4.112.0, sau đó xem xét các vị trí được báo cáo trong src/node/routes/errors.ts, login.ts, vscode.ts, domainProxy.ts, index.ts và src/node/app.ts. Phân tách các phát hiện trong production khỏi các phát hiện mức độ nghiêm trọng thấp trong các tệp test, xác nhận từng lỗ hổng và cân nhắc các biện pháp giảm thiểu được đề xuất. Hoàn tất khi các phát hiện trong production đã được xác nhận được xử lý và bản quét không còn báo cáo chúng.

Summary

Snyk Code Analysis identified 65 issues across 92 analyzed files in code-server. The High severity findings affect production deployments.

High Severity (7 issues)

Cross-site Scripting (XSS) — CWE-79, Score 807

• src/node/routes/errors.ts line 56
• src/node/routes/login.ts lines 68, 119

User-controlled input may be rendered without proper HTML escaping in error and login responses.

Path Traversal — CWE-23, Score 804

• src/node/routes/vscode.ts lines 149, 219

User-supplied path components may allow reading files outside the intended directory.

Regular Expression Denial of Service (ReDoS) — CWE-400, Score 752

• src/node/routes/domainProxy.ts line 46

A regex pattern may cause catastrophic backtracking with crafted input.

Medium Severity (14 issues)

Open Redirect — CWE-601, Score 557

• src/node/routes/login.ts lines 62, 99
• src/node/routes/index.ts line 94

Allocation of Resources Without Limits — CWE-770, Score 555

• src/node/routes/errors.ts line 37
• src/node/routes/vscode.ts line 213

Information Exposure via X-Powered-By — CWE-200, Score 554

• src/node/app.ts line 70

Sensitive Cookie Without Secure/HttpOnly Flags — CWE-614/CWE-1004, Score 402

• src/node/routes/login.ts line 96

Low Severity (44 issues)

Primarily in test files (hardcoded passwords, cleartext HTTP). Not production concerns.

Reproduction

Scanned with Snyk Code Analysis on code-server main branch (commit near v4.112.0).

Suggested Fixes

• XSS: HTML-encode user input before rendering in error/login templates
• Path Traversal: Resolve and validate paths against intended root directory
• ReDoS: Simplify or replace the vulnerable regex pattern
• Open Redirect: Validate redirect URLs against an allowlist
• X-Powered-By: Disable with app.disable('x-powered-by')
• Cookie flags: Add Secure and HttpOnly to session cookies

Happy to submit PRs for any of these if the team confirms the approach.