-
Notifications
You must be signed in to change notification settings - Fork 286
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merged PR 560: Do no load kernels from insecure directories
Do no load kernels from insecure directories
- Loading branch information
1 parent
2910d29
commit 91f4038
Showing
16 changed files
with
281 additions
and
16 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| // Copyright (c) Microsoft Corporation. | ||
| // Licensed under the MIT License. | ||
|
|
||
| 'use strict'; | ||
| import { inject, injectable, named } from 'inversify'; | ||
| import { commands, Memento } from 'vscode'; | ||
| import { IExtensionSyncActivationService } from '../platform/activation/types'; | ||
| import { IApplicationShell } from '../platform/common/application/types'; | ||
| import { GLOBAL_MEMENTO, IBrowserService, IMemento } from '../platform/common/types'; | ||
| import { Common, DataScience } from '../platform/common/utils/localize'; | ||
| import { noop } from '../platform/common/utils/misc'; | ||
| import { TrustedKernelPaths } from './raw/finder/trustedKernelSpecPaths.node'; | ||
|
|
||
| const MEMENTO_KEY_NOTIFIED_ABOUT_HIDDEN_KERNEL = 'MEMENTO_KEY_NOTIFIED_ABOUT_HIDDEN_KERNEL_1'; | ||
| @injectable() | ||
| export class HiddenKernelNotification implements IExtensionSyncActivationService { | ||
| private notifiedAboutHiddenKernel?: boolean; | ||
| constructor( | ||
| @inject(IMemento) @named(GLOBAL_MEMENTO) private readonly globalMemento: Memento, | ||
| @inject(IApplicationShell) private readonly appShell: IApplicationShell, | ||
| @inject(IBrowserService) private readonly browser: IBrowserService | ||
| ) {} | ||
|
|
||
| public activate(): void { | ||
| TrustedKernelPaths.IsKernelSpecHidden.promise | ||
| .then((hidden) => { | ||
| if ( | ||
| !hidden || | ||
| this.notifiedAboutHiddenKernel || | ||
| this.globalMemento.get<boolean>(MEMENTO_KEY_NOTIFIED_ABOUT_HIDDEN_KERNEL, false) | ||
| ) { | ||
| return; | ||
| } | ||
| this.notifiedAboutHiddenKernel = true; | ||
| this.globalMemento.update(MEMENTO_KEY_NOTIFIED_ABOUT_HIDDEN_KERNEL, true).then(noop, noop); | ||
| this.appShell | ||
| .showWarningMessage( | ||
| DataScience.untrustedKernelSpecsHidden(), | ||
| Common.learnMore(), | ||
| DataScience.updateSettingToTrustKernelSpecs() | ||
| ) | ||
| .then((selection) => { | ||
| switch (selection) { | ||
| case Common.learnMore(): | ||
| this.browser.launch('https://aka.ms/JupyterTrustedKernelPaths'); | ||
| break; | ||
| case DataScience.updateSettingToTrustKernelSpecs(): | ||
| commands | ||
| .executeCommand('workbench.action.openSettings', 'jupyter.kernels.trusted') | ||
| .then(noop, noop); | ||
| break; | ||
| } | ||
| }) | ||
| .then(noop, noop); | ||
| }) | ||
| .catch(noop); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,49 @@ | ||
| // Copyright (c) Microsoft Corporation. | ||
| // Licensed under the MIT License. | ||
|
|
||
| import { inject, injectable } from 'inversify'; | ||
| import * as path from '../../../platform/vscode-path/path'; | ||
| import { Uri } from 'vscode'; | ||
| import { IPlatformService } from '../../../platform/common/platform/types'; | ||
| import { ITrustedKernelPaths } from './types'; | ||
| import { IWorkspaceService } from '../../../platform/common/application/types'; | ||
| import { createDeferred } from '../../../platform/common/utils/async'; | ||
|
|
||
| @injectable() | ||
| export class TrustedKernelPaths implements ITrustedKernelPaths { | ||
| public static IsKernelSpecHidden = createDeferred<boolean>(); | ||
| private readonly programData = process.env['PROGRAMDATA'] | ||
| ? Uri.file(path.normalize(process.env['PROGRAMDATA'])) | ||
| : undefined; | ||
| constructor( | ||
| @inject(IPlatformService) private readonly platform: IPlatformService, | ||
| @inject(IWorkspaceService) private readonly workspace: IWorkspaceService | ||
| ) {} | ||
| private get trustedKernelSpecs(): string[] { | ||
| return this.workspace.getConfiguration('jupyter', undefined).get<string[]>('kernels.trusted', []); | ||
| } | ||
| public isTrusted(kernelPath: Uri): boolean { | ||
| const trusted = this.isTrustedImpl(kernelPath); | ||
| if (!trusted && !TrustedKernelPaths.IsKernelSpecHidden.completed) { | ||
| TrustedKernelPaths.IsKernelSpecHidden.resolve(true); | ||
| } | ||
| return trusted; | ||
| } | ||
| private isTrustedImpl(kernelPath: Uri): boolean { | ||
| if (kernelPath.scheme !== 'file') { | ||
| return true; | ||
| } | ||
| if ( | ||
| this.trustedKernelSpecs | ||
| .map((p) => (this.platform.isWindows ? p.toLowerCase() : p)) | ||
| .map((p) => Uri.file(p).path) | ||
| .includes(this.platform.isWindows ? kernelPath.path.toLowerCase() : kernelPath.path) | ||
| ) { | ||
| return true; | ||
| } | ||
| if (this.platform.isWindows && this.programData) { | ||
| return !kernelPath.path.toLowerCase().startsWith(this.programData.path.toLowerCase()); | ||
| } | ||
| return true; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| // Copyright (c) Microsoft Corporation. | ||
| // Licensed under the MIT License. | ||
|
|
||
| import { Uri } from 'vscode'; | ||
|
|
||
| export const ITrustedKernelPaths = Symbol('ITrustedKernelPaths'); | ||
| export interface ITrustedKernelPaths { | ||
| isTrusted(kernelPath: Uri): boolean; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.