Skip to content

fix: Use Start-Process for online help to avoid security warning #5447

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
aryanjsingh wants to merge 1 commit into from
+24 −20
Closed

fix: Use Start-Process for online help to avoid security warning #5447

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 24 additions & 20 deletions src/features/ShowHelp.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,14 +2,9 @@
// Licensed under the MIT License.

import vscode = require("vscode");
import { NotificationType } from "vscode-languageclient";
import type { LanguageClient } from "vscode-languageclient/node";
import { LanguageClientConsumer } from "../languageClientConsumer";

interface IShowHelpNotificationArguments {}

export const ShowHelpNotificationType =
new NotificationType<IShowHelpNotificationArguments>("powerShell/showHelp");
import { PowerShellIntegratedConsole } from "../powerShellIntegratedConsole";

Comment on lines +7 to 8
Copy link

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The new import "../powerShellIntegratedConsole" (and PowerShellIntegratedConsole.instance.executeCommand(...)) does not resolve anywhere in src/—there is no powerShellIntegratedConsole.ts and no exported PowerShellIntegratedConsole class. This will fail TypeScript compilation. Either add/commit the missing module, or rework this to use the existing session/terminal plumbing (e.g., via the session manager / PowerShellProcess terminal) that already exists in this repo.

Copilot uses AI. Check for mistakes.
export class ShowHelpFeature extends LanguageClientConsumer {
private command: vscode.Disposable;
Expand All @@ -19,29 +14,38 @@ export class ShowHelpFeature extends LanguageClientConsumer {
this.command = vscode.commands.registerCommand(
"PowerShell.ShowHelp",
async (item?) => {
if (!item?.Name) {
let text: string | undefined;
if (item?.Name) {
text = item.Name;
} else {
const editor = vscode.window.activeTextEditor;
if (editor === undefined) {
return;
}

const selection = editor.selection;
const doc = editor.document;
const cwr = doc.getWordRangeAtPosition(selection.active);
const text = doc.getText(cwr);
text = doc.getText(cwr);
}
Comment on lines 25 to +29
Copy link

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

doc.getWordRangeAtPosition(...) can return undefined (e.g., when the cursor is on whitespace). Passing undefined to doc.getText() returns the entire document, which would make escapedText huge and produce an invalid/slow PowerShell command. Consider explicitly handling cwr === undefined (return early or fall back to the selection text) before calling getText.

Copilot uses AI. Check for mistakes.

const client =
await LanguageClientConsumer.getLanguageClient();
await client.sendNotification(ShowHelpNotificationType, {
text,
});
} else {
const client =
await LanguageClientConsumer.getLanguageClient();
await client.sendNotification(ShowHelpNotificationType, {
text: item.Name,
});
if (!text) {
return;
}

// We need to escape single quotes for the PowerShell command.
const escapedText = text.replace(/'/g, "''");
const psCommand =
Comment on lines +35 to +37
Copy link

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file already has a shared helper for escaping single quotes in PowerShell strings (utils.escapeSingleQuotes(...)). Using that helper here would avoid duplicating escaping logic and keep quoting consistent across the extension.

Copilot uses AI. Check for mistakes.
`try { ` +
`$help = (Get-Help '${escapedText}' -ErrorAction Stop)[0]; ` +
`$uri = $help.RelatedLinks.NavigationLink[0].Uri; ` +
`if ($null -ne $uri) { Start-Process $uri } ` +
`} catch { ` +
`# This fails silently, which is similar to the old behavior where no browser ` +
`# would be opened if help is not found. ` +
`}`;

// We don't want to focus the terminal, and we don't want this to show up in history.
await PowerShellIntegratedConsole.instance.executeCommand(psCommand, false, false);
},
);
}
Expand Down
Loading