network: align URL trust and IDN domain policies - #336960
Draft
Dmitriy Vasyura (dmitrivMS) wants to merge 6 commits into
Draft
Dmitriy Vasyura (dmitrivMS) wants to merge 6 commits into
Dmitriy Vasyura (dmitrivMS) wants to merge 6 commits into
Conversation
Normalize wildcard suffixes with the URL-aware authority helper before validating the pattern. Add matching, policy, and fetch-tool regression coverage while preserving existing domain handling. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Canonicalize sandbox domain policies and preflight URL hosts, rejecting patterns that cannot be normalized. Match equivalent Unicode and Punycode literal host labels in URL trust and approval rules while preserving existing glob semantics. Partial Unicode wildcard labels remain outside this change. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Normalize authority separators and resolved paths consistently across trusted domains, URL approval rules, and web-page fetching. Preserve hostname case semantics, escaped path data, and actual request destinations, with regression coverage for approvals, exclusions, and declined tool calls. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot started reviewing on behalf of
Dmitriy Vasyura (dmitrivMS)
September 20, 2026 22:34
View session
Contributor
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
Security-sensitive URL normalization spans trust, enterprise filtering, confirmation, and network execution boundaries.
Review effort: Balanced
Findings: None
What changed in this PR
Aligns URL trust, approval, prompt-reference, and fetch behavior with effective HTTP(S) destinations.
Changes:
- Normalizes authority separators and path traversal consistently.
- Preserves escaped paths across approval-pattern round trips.
- Adds regression coverage for malformed authorities, encoded paths, and declined fetches.
| File | Description |
|---|---|
src/vs/platform/url/common/urlGlob.ts |
Normalizes HTTP authorities and paths for matching. |
src/vs/platform/url/common/trustedDomains.ts |
Applies effective URL normalization to trust checks. |
src/vs/workbench/contrib/chat/common/tools/builtinTools/chatUrlFetchingPatterns.ts |
Aligns approvals and generated patterns with normalized destinations. |
src/vs/workbench/contrib/chat/electron-browser/builtInTools/fetchPageTool.ts |
Uses normalized destinations for policy, confirmation, and fetching. |
src/vs/platform/url/test/common/urlGlob.test.ts |
Tests backslash authority matching. |
src/vs/platform/url/test/common/urlPathNormalization.test.ts |
Covers effective path and authority normalization. |
src/vs/workbench/contrib/chat/test/common/tools/builtinTools/chatUrlFetchingPatterns.test.ts |
Tests approval patterns for malformed authorities. |
src/vs/workbench/contrib/chat/test/common/tools/builtinTools/chatUrlFetchingPaths.test.ts |
Tests encoded paths, exclusions, and traversal. |
src/vs/workbench/contrib/chat/test/electron-browser/tools/builtinTools/fetchPageTool.test.ts |
Verifies consistent fetch destinations. |
src/vs/workbench/contrib/chat/test/electron-browser/tools/builtinTools/fetchPageToolPaths.test.ts |
Exercises complete confirmation and fetch orchestration. |
src/vs/workbench/contrib/chat/test/browser/tools/languageModelToolsService.test.ts |
Verifies declined URLs cause no fetch effects. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Merge the IDN network-filter and sandbox changes with effective URL destination normalization. Preserve both normalization stages and their regression coverage, and add combined IDN plus effective-path approval and exclusion tests. Consolidates #336944 into #336960. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Dmitriy Vasyura (dmitrivMS)
changed the title
Dmitriy Vasyura (dmitrivMS)
added
security
chat
fetch-tool
Keep shell-tool registration and offline sandboxed commands available when domain patterns cannot be normalized. Log a warning and use a deny-all policy instead of throwing, with regression coverage for both lists and recovery after settings are corrected. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot started reviewing on behalf of
Dmitriy Vasyura (dmitrivMS)
September 20, 2026 23:25
View session
Replace the eager recursive matcher with iterative deduplicated states to avoid Unicode path allocation spikes and stack growth. Normalize configured patterns consistently, preserve effective authority and path semantics, and retain HTTP path case without changing non-HTTP drive normalization. Add regression coverage for the PR feedback and verify real Code OSS trust, approval, fetch, and sandbox workflows. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
Screenshot ChangesBase: Changed (1)
|
| Before | After |
|---|---|
 |
 |
1 insignificant change(s) omitted (≤20 px, Δ≤2). See CI logs for details.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
URL trust and approval matching
The shared matcher keeps two clearly named stages:
normalizeURLAuthorityAndPathestablishes effective URL structure before path normalization;normalizeAuthorityForMatchingcanonicalizes literal DNS labels for matching. These are composed rather than treated as interchangeable helpers.Network and sandbox policies
Performance and validation
85224b354e3.Evidence is retained locally with screenshots, raw uncaptioned videos, Playwright traces, request ledgers, and runtime provenance. The two GitHub-specific checks are live-service diagnostics, not real-GitHub fetch tests. Windows native validation covers overall outbound policy, not per-host sandbox enforcement; Linux/macOS native execution is not claimed.