Skip to content

Merge in changes - #11

Open
dylanturn wants to merge 1076 commits into
turnbros:mainfrom
coder:main
Open

Merge in changes#11
dylanturn wants to merge 1076 commits into
turnbros:mainfrom
coder:main

Conversation

@dylanturn

Copy link
Copy Markdown
Member

Fixes #

env?: NodeJS.ProcessEnv,
): Promise<{ stdout: string; stderr: string }> {
const CODE_SERVER_COMMAND = process.env.CODE_SERVER_PATH || path.resolve("../../release-standalone/bin/code-server")
const { stdout, stderr } = await promisify(exec)(`${CODE_SERVER_COMMAND} ${argv.join(" ")}`, {

Check warning

Code scanning / CodeQL

Shell command built from environment values

This shell command depends on an uncontrolled [absolute path](1).
@github-advanced-security

Copy link
Copy Markdown

You have successfully added a new CodeQL configuration .github/workflows/security.yaml:codeql-analyze. As part of the setup process, we have scanned this repository and found 2 existing alerts. Please check the repository Security tab to see all alerts.

code-asher and others added 30 commits July 16, 2026 12:41
The problem was that whenever the hashe needed an update, the current
patch would create a conflict which cannot be easily auto-resolved.

Instead, put the hashes in a separate patch that is deleted and
regenerated each time, avoiding the conflicts.

Also the web worker iframe hash was not being updated.
Not sure why I assumed this would render.
This can happen if you run the update multiple times and it was already
deleted from another run but not regenerated yet due to an early
failure like from a conflict.
The client combines the key from this endpoint to then encrypt secrets into browser storage.
We use the cookie parser to remove the code-server token but by default
it encodes using encodeURIComponent, which encodes more than is strictly
necessary and can break proxied applications.

Now we pass the cookies through unchanged (other than removing the
code-server token).

Fixes #7927.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.