network: normalize IDN policies and URL approvals - #336944
Closed
Dmitriy Vasyura (dmitrivMS) wants to merge 2 commits into
Closed
Dmitriy Vasyura (dmitrivMS) wants to merge 2 commits into
Dmitriy Vasyura (dmitrivMS) wants to merge 2 commits into
Conversation
Normalize wildcard suffixes with the URL-aware authority helper before validating the pattern. Add matching, policy, and fetch-tool regression coverage while preserving existing domain handling. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot started reviewing on behalf of
Dmitriy Vasyura (dmitrivMS)
September 20, 2026 19:07
View session
Contributor
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The focused implementation is consistent with existing authority normalization and has comprehensive regression coverage.
Review effort: Balanced
Findings: None
What changed in this PR
Normalizes Unicode wildcard domains consistently with exact domain patterns.
Changes:
- Canonicalizes wildcard suffixes to Punycode.
- Adds matcher, policy, and extraction regression coverage.
| File | Description |
|---|---|
| src/vs/workbench/contrib/chat/test/electron-browser/tools/builtinTools/fetchPageTool.test.ts | Verifies denied URLs are filtered before extraction. |
| src/vs/platform/networkFilter/test/common/networkFilterService.test.ts | Tests Unicode wildcard allow/deny policies. |
| src/vs/platform/networkFilter/test/common/domainMatcher.test.ts | Covers canonicalization and matching boundaries. |
| src/vs/platform/networkFilter/common/domainMatcher.ts | Normalizes wildcard suffix authorities before validation. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
- Dmitriy propuso normalizar los patrones de dominio comodín Unicode
para coincidencias consistentes.
- Dmitriy incluyó cobertura de regresión y confirmó que las pruebas
pasaron correctamente.
El dom, 20 de sep de 2026, 1:12 p.m., Dmitriy Vasyura <
***@***.***> escribió:
… Summary
Normalize wildcard domain suffixes with the same URL-aware authority
normalization used for exact domain patterns before validating and matching
them. This makes Unicode and Punycode hostnames match consistently while
preserving existing hostname validation and IPv4 handling.
Add regression coverage for wildcard canonicalization, base-domain and
subdomain matching, allow/deny policy behavior, and filtering before web
content extraction. Include unrelated-domain controls to guard against
overmatching.
Validation
- All six new regressions were verified failing before the fix and
passing afterward.
- 116 tests pass across the affected Electron test files; 83 tests
pass in the Node matcher/filter suites.
- Client transpilation, targeted ESLint and hygiene, changed-file
TypeScript diagnostics, and git diff --check pass.
- Full client compile/typecheck could not complete locally because of
Copilot SDK metadata/API mismatches and missing Electron typings. No
dependency changes are included.
------------------------------
You can view, comment on, or merge this pull request online at:
#336944
Commit Summary
- 815f3bc
<815f3bc>
network: normalize Unicode wildcard domain patterns
File Changes
(4 files <https://github.com/microsoft/vscode/pull/336944/files>)
- *M* src/vs/platform/networkFilter/common/domainMatcher.ts
<https://github.com/microsoft/vscode/pull/336944/files#diff-1abb9f3a4f7d7efb0e765c38d1518b107c475c4fc2c2e47cf84b299c30354f59>
(3)
- *M* src/vs/platform/networkFilter/test/common/domainMatcher.test.ts
<https://github.com/microsoft/vscode/pull/336944/files#diff-29c2a051d49fb88dd2974be2902739e79d88c27da14bf4f76825646e5577eff0>
(47)
- *M*
src/vs/platform/networkFilter/test/common/networkFilterService.test.ts
<https://github.com/microsoft/vscode/pull/336944/files#diff-4f371e86bf5d3cd28587b171b733589cdc46e5de303eeed102044f8c86286669>
(49)
- *M*
src/vs/workbench/contrib/chat/test/electron-browser/tools/builtinTools/fetchPageTool.test.ts
<https://github.com/microsoft/vscode/pull/336944/files#diff-6bfa0f0716f085d37df6cf3669eb90b4592788888dc20bed3cd0c43abec01c84>
(45)
Patch Links:
- https://github.com/microsoft/vscode/pull/336944.patch
- https://github.com/microsoft/vscode/pull/336944.diff
—
Reply to this email directly, view it on GitHub
<#336944?email_source=notifications&email_token=CN4ENNHVVII3UZLACPCOCKD5QATY7A5CNFSNUABEM5UWIORPF5TWS5BNNB2WEL2QOVWGYUTFOF2WK43UF42DKOBVGU4DSNZXHGTHEZLBONXW5KTTOVRHGY3SNFRGKZFFMV3GK3TUVRTG633UMVZF6Y3MNFRWW>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/CN4ENND6U672NQ2QKWEVN5T5QATY7AVCNFSNUABEKJSXA33TNF2G64TZHM2DCOBYGE4TAMB3JFZXG5LFHM2TKMJZHA3DCOJVHGQXMAQ>
.
You are receiving this because you are subscribed to this thread.Message
ID: ***@***.***>
|
Dmitriy Vasyura (dmitrivMS)
marked this pull request as ready for review
September 20, 2026 19:54
Dmitriy Vasyura (dmitrivMS)
enabled auto-merge (squash)
September 20, 2026 19:54
Dmitriy Vasyura (dmitrivMS)
marked this pull request as draft
September 20, 2026 19:55
auto-merge was automatically disabled
September 20, 2026 19:55
Pull request was converted to draft
Canonicalize sandbox domain policies and preflight URL hosts, rejecting patterns that cannot be normalized. Match equivalent Unicode and Punycode literal host labels in URL trust and approval rules while preserving existing glob semantics. Partial Unicode wildcard labels remain outside this change. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Dmitriy Vasyura (dmitrivMS)
changed the title
Dmitriy Vasyura (dmitrivMS)
added a commit
that referenced
this pull request
Sep 20, 2026
Merge the IDN network-filter and sandbox changes with effective URL destination normalization. Preserve both normalization stages and their regression coverage, and add combined IDN plus effective-path approval and exclusion tests. Consolidates #336944 into #336960. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Collaborator
Author
|
Superseded by #336960, which now includes both original commits from this PR, the effective URL/trust/approval fixes, both regression suites, and additional combined IDN/path tests. Combined validation: 498 tests pass; targeted typecheck, hygiene, and canonical policy export pass. Closing in favor of the consolidated PR rather than landing two overlapping matcher changes. The source branch is retained. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Normalize wildcard domain suffixes with the same URL-aware authority normalization used for exact domain patterns before validating and matching them. This makes Unicode and Punycode hostnames match consistently while preserving existing hostname validation and IPv4 handling.
Also canonicalize sandbox allow/deny policies and preflight URL hosts. Patterns that cannot be normalized now fail with a configuration error. URL trust and auto-approval matching treats equivalent literal hostname labels consistently while preserving scheme, port, path, and wildcard semantics.
Add regression coverage for canonicalization, base-domain and subdomain matching, allow/deny behavior, explicit approval exceptions, sandbox configuration, and filtering before web content extraction. Include unrelated-domain controls to guard against overmatching.
Scope: Partial Unicode wildcard labels retain their existing spelling-sensitive matching and remain a follow-up. No decoder dependency is added.
Validation: 328 Electron tests pass (2 existing Windows skips), and 226 Node tests pass. Targeted transpilation, changed-file TypeScript diagnostics, ESLint, hygiene, and whitespace checks pass. Native Linux/macOS sandbox execution was not run. Full client compile/typecheck remains blocked locally by SDK metadata/API mismatches and missing Electron typings.