chore: patch security findings (shell-quote override + GHSA backports) (#242)

Author: azmkercso

package-lock-overrides/sagemaker.series/package-lock.json

@@ -11,6 +11,12 @@
         "patch_path": "common/fix-terminal-autoreplies.diff",
         "link": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21523"
     },
+    {
+        "finding_id": "CVE-2026-21518",
+        "affected_versions": "<1.109.1",
+        "patch_path": "common/fix-mcp-workspace-trust.diff",
+        "link": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21518"
+    },
     {
         "finding_id": "CVE-2026-41613",
         "affected_versions": "<1.119.1",
@@ -36,5 +42,29 @@
         "patch_path": "N/A",
         "link": "https://github.com/microsoft/vscode/security/advisories/GHSA-rg3f-8xq5-hwh6",
         "note": "Copilot extension not present in Code-OSS 1.108.2"
+    },
+    {
+        "finding_id": "GHSA-credential-provider-host-match",
+        "affected_versions": "<1.123.1",
+        "patch_path": "common/fix-github-credential-provider-host-match.diff",
+        "link": "https://github.com/microsoft/vscode/commit/4b6e2467dbd828018d602f73cc25d1b11f699d2c"
+    },
+    {
+        "finding_id": "GHSA-extpath-is-equal-or-parent",
+        "affected_versions": "<1.123.1",
+        "patch_path": "common/fix-extpath-is-equal-or-parent.diff",
+        "link": "https://github.com/microsoft/vscode/commit/0f1ba1ea103757f3023cc1f9c3eb7327c3ec4b02"
+    },
+    {
+        "finding_id": "GHSA-snippets-path-traversal",
+        "affected_versions": "<1.123.1",
+        "patch_path": "common/fix-snippets-path-traversal.diff",
+        "link": "https://github.com/microsoft/vscode/commit/9b31ff896671125cbfc65f33731c4a99660d6201"
+    },
+    {
+        "finding_id": "GHSA-remote-hosts-loopback",
+        "affected_versions": "<1.123.1",
+        "patch_path": "common/fix-remote-hosts-loopback-check.diff",
+        "link": "https://github.com/microsoft/vscode/commit/9505d0fca49eadb707c450d18dcb41a46b720a9e"
     }
-]
+]

package-lock-overrides/web-embedded-with-terminal.series/package-lock.json

@@ -0,0 +1,22 @@
+Override shell-quote to ^1.8.4.
+Regenerate: npx ts-node build-tools/apply-finding-overrides/apply-finding-overrides.ts apply --patch common/finding-override-shell-quote.diff --override global:shell-quote=^1.8.4
+Remove when upstream Code-OSS updates shell-quote to >= 1.8.4.
+
+@generated
+@generator: npx ts-node build-tools/apply-finding-overrides/apply-finding-overrides.ts apply --patch common/finding-override-shell-quote.diff --override global:shell-quote=^1.8.4
+@override-package: shell-quote@^1.8.4
+
+Index: b/package.json
+===================================================================
+--- a/package.json
++++ b/package.json
+@@ -243,7 +243,8 @@
+     "picomatch": "^2.3.2",
+     "follow-redirects": "^1.16.0",
+     "uuid": "^14.0.0",
+-    "ip-address": "^10.1.1"
++    "ip-address": "^10.1.1",
++    "shell-quote": "^1.8.4"
+   },
+   "repository": {
+     "type": "git",

package-lock-overrides/web-embedded.series/package-lock.json

@@ -0,0 +1,50 @@
+Backport extpath isEqualOrParent path traversal normalization from upstream.
+Normalizes paths containing '..' segments before comparison to prevent
+path traversal attacks via isEqualOrParent checks.
+Remove when Code-OSS is updated to >= 1.123.1.
+
+@backported: https://github.com/microsoft/vscode/commit/0f1ba1ea103757f3023cc1f9c3eb7327c3ec4b02
+@finding-id: GHSA-extpath-is-equal-or-parent
+Index: b/src/vs/base/common/extpath.ts
+===================================================================
+--- a/src/vs/base/common/extpath.ts
++++ b/src/vs/base/common/extpath.ts
+@@ -224,7 +224,9 @@ export function isEqual(pathA: string, p
+  * you are in a context without services, consider to pass down the `extUri` from the
+  * outside, or use `extUriBiasedIgnorePathCase` if you know what you are doing.
+  */
+-export function isEqualOrParent(base: string, parentCandidate: string, ignoreCase?: boolean, separator = sep): boolean {
++export function isEqualOrParent(base: string, parentCandidate: string, ignoreCase?: boolean, forcePosixSemantics = false): boolean {
++	const separator = forcePosixSemantics ? posix.sep : sep;
++
+ 	if (base === parentCandidate) {
+ 		return true;
+ 	}
+@@ -233,6 +235,14 @@ export function isEqualOrParent(base: st
+ 		return false;
+ 	}
+ 
++	if (
++		base.indexOf('..') >= 0 ||
++		parentCandidate.indexOf('..') >= 0
++	) {
++		base = forcePosixSemantics ? posix.normalize(base) : normalize(base);
++		parentCandidate = forcePosixSemantics ? posix.normalize(parentCandidate) : normalize(parentCandidate);
++	}
++
+ 	if (parentCandidate.length > base.length) {
+ 		return false;
+ 	}
+Index: b/src/vs/base/common/resources.ts
+===================================================================
+--- a/src/vs/base/common/resources.ts
++++ b/src/vs/base/common/resources.ts
+@@ -174,7 +174,7 @@ export class ExtUri implements IExtUri {
+ 				return extpath.isEqualOrParent(originalFSPath(base), originalFSPath(parentCandidate), this._ignorePathCasing(base)) && base.query === parentCandidate.query && (ignoreFragment || base.fragment === parentCandidate.fragment);
+ 			}
+ 			if (isEqualAuthority(base.authority, parentCandidate.authority)) {
+-				return extpath.isEqualOrParent(base.path, parentCandidate.path, this._ignorePathCasing(base), '/') && base.query === parentCandidate.query && (ignoreFragment || base.fragment === parentCandidate.fragment);
++				return extpath.isEqualOrParent(base.path, parentCandidate.path, this._ignorePathCasing(base), true) && base.query === parentCandidate.query && (ignoreFragment || base.fragment === parentCandidate.fragment);
+ 			}
+ 		}
+ 		return false;

package-lock-overrides/web-server.series/package-lock.json

@@ -0,0 +1,20 @@
+Backport GitHub credential provider host matching fix from upstream Code-OSS.
+Use exact hostname comparison instead of regex to prevent subdomain spoofing.
+Remove when Code-OSS is updated to >= 1.123.1.
+
+@backported: https://github.com/microsoft/vscode/commit/4b6e2467dbd828018d602f73cc25d1b11f699d2c
+@finding-id: GHSA-credential-provider-host-match
+Index: b/extensions/github/src/credentialProvider.ts
+===================================================================
+--- a/extensions/github/src/credentialProvider.ts
++++ b/extensions/github/src/credentialProvider.ts
+@@ -12,7 +12,8 @@ const EmptyDisposable: Disposable = { di
+ class GitHubCredentialProvider implements CredentialsProvider {
+ 
+ 	async getCredentials(host: Uri): Promise<Credentials | undefined> {
+-		if (!/github\.com/i.test(host.authority)) {
++		const hostname = host.authority.replace(/:\d+$/, '').toLowerCase();
++		if (hostname !== 'github.com') {
+ 			return;
+ 		}
+