The Wayback Machine - https://web.archive.org/web/20220215172816/https://github.com/microsoft/vscode/issues/92164
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Implement a node.js-free, sandboxed, context isolated renderer #92164

Open
1 of 7 tasks
egamma opened this issue Mar 6, 2020 · 15 comments
Open
1 of 7 tasks

Implement a node.js-free, sandboxed, context isolated renderer #92164

egamma opened this issue Mar 6, 2020 · 15 comments
Assignees
@bpasero @deepak1556 @alexdima @rzhao271
Labels
plan-item sandbox
Milestone
On Deck

Comments

@egamma
Copy link
Member

@egamma egamma commented Mar 6, 2020 •
edited by bpasero

We want to explore a model where the workbench in Electron does not access node.js APIs. In that model the Electron renderer process runs in sandboxed mode, much like any browser tab would do. Privileged code has to either move into a backend process and be accessible via IPC communication or into a preload script that exposes certain methods to the page.

February

On Deck

Backlog

  • Towards a fully enabled sandbox
    • Allow to enable sandbox: true behind a dev setting
    • Performance validation & tuning
      • Investigate slowdown from using ipcRenderer via preload vs. direct MessagePort to main process
      • Understand the impact of having to use Uint8Array over Buffer for large data transfers (e.g. file IO)
      • macOS: Investigate 8kb limit of chunks in streams (vscode#40681)
  • Tests:
    • common/browser: run in BrowserWindow with sandbox: true
    • node.js/electron-browser: run in ELECTRON_RUN_AS_NODE

Architecture

image
@egamma egamma added this to the March 2020 milestone Mar 6, 2020
@kieferrm kieferrm mentioned this issue Mar 8, 2020
Closed
55 tasks
@jrieken
Copy link
Member

@jrieken jrieken commented Mar 9, 2020

An "implict" node-dependency that's not listed here is code loading. Today, the loader uses the fs and vm-modules which allows for v8 cached data usage.

@bpasero
Copy link
Member

@bpasero bpasero commented Mar 12, 2020 •
edited

Bootstrap sandboxed workbench code pointers:

  • enable sandbox & contextIsolation in window.ts
  • load something like a workbench-sandboxed.html from doGetUrl
  • this will likely fail early on because of our AMD loader requiring node.js for cached data etc. and some other things we depend on from window.js so we need something like workbench-sandboxed.js and possibly workbench-preload.js that work properly in this mode
  • instead of vs/workbench/workbench.desktop.main load a vs/workbench/workbench.desktop-sandboxed.main here with those things commented out that are not yet adopted
  • instead of vs/workbench/electron-browser/desktop.main, require a vs/workbench/browser/desktop-sandboxed.main here that brings up the workbench without depending on node.js

@bpasero bpasero removed this from the March 2020 milestone Mar 27, 2020
@bpasero bpasero added this to the April 2020 milestone Mar 27, 2020
@deepak1556 deepak1556 mentioned this issue Apr 13, 2020
Merged
@kieferrm kieferrm mentioned this issue Apr 14, 2020
Closed
45 tasks
@dbaeumer
Copy link
Member

@dbaeumer dbaeumer commented Apr 15, 2020

@bpasero we shouldn't mix localization support in the Web with support for Node free renderer. We need a very different story for the Web whereas for a node free renderer we can still install the LP on the local disk. We can simply not access them from the renderer. So I will change the item (I have discussed it that way with @egamma as well)

@bpasero bpasero removed this from the April 2020 milestone Apr 27, 2020
@bpasero bpasero added this to the May 2020 milestone Apr 27, 2020
@deepak1556 deepak1556 mentioned this issue May 8, 2020
Closed
@kieferrm kieferrm mentioned this issue May 10, 2020
Closed
61 tasks
@bpasero bpasero changed the title Exploration: node.js-free, sandboxed renderer node.js-free, sandboxed renderer May 24, 2020
@deepak1556 deepak1556 mentioned this issue May 27, 2020
Closed
13 tasks
@bpasero bpasero removed this from the May 2020 milestone May 29, 2020
@bpasero bpasero added this to the June 2020 milestone May 29, 2020
@kieferrm kieferrm mentioned this issue Jun 13, 2020
Closed
57 tasks
@bpasero bpasero removed this from the June 2020 milestone Jun 16, 2020
@bpasero bpasero added this to the Backlog milestone Jun 16, 2020
@bpasero bpasero removed this from the Backlog milestone Jun 25, 2020
@bpasero bpasero added this to the On Deck milestone Jun 25, 2020
@kieferrm kieferrm mentioned this issue Jul 10, 2020
Closed
49 tasks
@bpasero bpasero mentioned this issue Jul 20, 2020
Closed
@kieferrm kieferrm mentioned this issue Aug 16, 2020
Closed
40 tasks
@kieferrm kieferrm mentioned this issue Aug 17, 2020
Closed
10 tasks
@bpasero bpasero mentioned this issue Feb 3, 2021
Merged
@kieferrm kieferrm mentioned this issue Feb 6, 2021
Closed
70 tasks
@deepak1556 deepak1556 mentioned this issue Feb 11, 2021
Open
@bpasero bpasero mentioned this issue Feb 17, 2021
Closed
3 tasks
@kieferrm kieferrm mentioned this issue Mar 6, 2021
Closed
76 tasks
@bpasero bpasero changed the title node.js-free, sandboxed renderer Implement a node.js-free, sandboxed, context isolated renderer Mar 11, 2021
@bpasero bpasero mentioned this issue Mar 23, 2021
Closed
@mjbvz
Copy link
Contributor

@mjbvz mjbvz commented Mar 30, 2021

368f44e enables iframe based webviews on desktop when search functionality is not required. We'll get testing of the iframe based webviews during 1.56 insiders

@bpasero bpasero mentioned this issue Mar 31, 2021
Closed
@kieferrm kieferrm mentioned this issue Apr 5, 2021
Closed
75 tasks
@kieferrm kieferrm mentioned this issue May 8, 2021
Closed
77 tasks
@F30 F30 mentioned this issue May 11, 2021
Open
5 tasks
@kieferrm kieferrm mentioned this issue Jun 13, 2021
Closed
72 tasks
@bpasero bpasero mentioned this issue Jun 17, 2021
Closed
mjbvz added a commit that referenced this issue Jul 6, 2021
@mjbvz
Switch entirely to iframe based webviews on desktop
2222f3c 
Fixes #83188
Part of #92164

Removes our usage of the electron `<webview>` tag
@kieferrm kieferrm mentioned this issue Jul 11, 2021
Closed
82 tasks
@kieferrm kieferrm mentioned this issue Jul 13, 2021
Closed
10 tasks
@kieferrm kieferrm mentioned this issue Aug 8, 2021
Closed
91 tasks
@bpasero bpasero mentioned this issue Aug 25, 2021
Closed
@Tyriar
Copy link
Member

@Tyriar Tyriar commented Aug 27, 2021

FYI following up on #116337, I believe the slowness I sometimes see with terminals is a result of the multiple process jumps since we can't communicate directly between the renderer and pty host yet. Was there an issue tracking this direct channel between renderer to arbitrary node process?

@bpasero
Copy link
Member

@bpasero bpasero commented Aug 27, 2021

@Tyriar we had it on our project board, but not as issue. I converted it to one and suggest you ping Deepak about status: #131798

@bpasero bpasero mentioned this issue Sep 3, 2021
Closed
@egamma egamma mentioned this issue Sep 6, 2021
Closed
99 tasks
@metmeylmz

This comment was marked as off-topic.

Sign in to view
@kieferrm kieferrm mentioned this issue Nov 7, 2021
Closed
82 tasks
@kieferrm kieferrm mentioned this issue Dec 21, 2021
Closed
91 tasks
@sandy081
Copy link
Member

@sandy081 sandy081 commented Jan 4, 2022

CachedExtensionScanner is owned by @alexdima and hence removing my name.

@alexdima alexdima self-assigned this Jan 11, 2022
@kieferrm kieferrm mentioned this issue Feb 7, 2022
Open
81 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@bpasero bpasero

@deepak1556 deepak1556

@alexdima alexdima

@rzhao271 rzhao271

Labels
plan-item sandbox
Projects
None yet
Milestone
On Deck
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
12 participants
@egamma @bpasero @deepak1556 @jrieken @dbaeumer @Tyriar @alexdima @rzhao271 @sandy081 @mjbvz @metmeylmz and others