Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

shd101wyy/vscode-markdown-preview-enhanced

              develop @ 8bc848b
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Command Injection: 1 prior fix. Scrutinize any change in this area.

package.json: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: Arbitrary commands could be executed via the webview communication channel. This was mitigated by restricting the execution of VS Code commands to a strict allowlist and validating the source URI of the triggering message. Developers must ensure that any new message handlers or webview endpoints explicitly implement these validations.

Command Injection: The integration of rendering engines and helper libraries like 'crossnote' previously exposed the application to command injection (particularly on Windows) and code execution through untrusted rendering blocks like WaveDrom and Bitfield. This highlights the risk of downstream dependencies handling untrusted markdown syntax natively.

Denial of Service: Unbounded workspace parsing of extremely large markdown files could trigger Out of Memory crashes. The introduction of 'maxNoteFileSize' limits parsing of oversized files, preventing resource exhaustion during indexing tasks.