json: canonicalize schema URLs before trust checks and requests by dmitrivMS · Pull Request #336754 · microsoft/vscode

Dmitriy Vasyura (dmitrivMS) · 2026-09-18T10:55:31Z

Schema trust checks need to use the effective HTTP(S) URL rather than decoded URI components that can identify a different host or path after normalization.

Canonicalize HTTP(S) schema URLs before trusted-domain/path matching, and pass the same canonical URL to the browser or desktop request service.
Compare canonical encoded pathnames without another decoding pass, so encoded separators cannot create a match for a different path prefix.
Apply the same normalization when comparing configured and extension-contributed schema allowances.
Preserve original language-server schema IDs when clearing canonical disk-cache entries, so validation refreshes for equivalent URL spellings.
Release old schema-request aliases even when responses were not stored in the ETag cache, without discarding aliases refreshed by requests that finish during cache clearing.
Cover decoded backslashes, dot segments, ports, encoded paths, and ordered trust rules while preserving workspace trust, download settings, and non-network resource handling.
Add offline tests for common-client trust decisions, browser/desktop request dispatch, and enabled disk-cache invalidation; run the suite through the existing standalone extension-test scripts on Linux, macOS, and Windows (--suite json).

Canonicalize schema URLs before trusted-domain matching and request dispatch. Reject desktop requests when the legacy HTTP transport would select a different host, port, or request target. Cover browser and desktop URL handling with offline regression tests that preserve trust gates and exercise native request validation without opening sockets. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Copilot review overview

🟡 Changes recommended

Empty-query URLs are incorrectly rejected, and the corresponding control fixture expects incorrect serialization.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1 · 1

Open (2)

Expect the empty query in the control fixture · New
Preserve an explicit empty query during validation · New

What changed in this PR

Aligns schema trust checks with canonical browser and desktop request destinations.

Changes:

Canonicalizes URLs before trust matching and dispatch.
Validates desktop transport interpretation.
Adds browser and native transport regression tests.

File	Description
`urlMatch.ts`	Canonicalizes URLs for trust matching.
`jsonClient.ts`	Uses canonical URLs for trust and downloads.
`node/jsonClientMain.ts`	Validates native transport destinations.
`schemaRequestTestUtils.ts`	Provides schema client test utilities.
`schemaRequestTransportTestUtils.ts`	Provides nonconnecting native transport tests.
`schemaRequests.test.ts`	Tests canonical trust and dispatch behavior.
`schemaRequestTransport.test.ts`	Tests desktop parser agreement.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Keep this change focused on canonical schema URLs in common trust checks and request dispatch. Remove the desktop transport parser comparison and its dedicated tests while retaining the 28 common-client browser and desktop regression tests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Copilot review overview

🟢 Approval recommended

The implementation consistently canonicalizes checked and dispatched URLs with comprehensive regression coverage.

Review effort: Balanced
Findings: None

Resolved since last review (2)

Expect the empty query in the control fixture
Preserve an explicit empty query during validation

Compare encoded canonical paths without another decoding pass and retain original language-server schema IDs when invalidating canonical disk-cache entries. Add path-scope and enabled-cache regressions, and run the JSON client suite in the existing Linux Electron-Unit PR job. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Register the standalone JSON client suite beside CSS and HTML in both integration launchers. Preserve grep filtering, failure exit codes, and the existing CI JUnit reporting conventions. Remove the dedicated Linux workflow step so the existing desktop integration jobs run the suite on all supported platforms. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Copilot review overview

🟡 Changes recommended

Alias tracking can grow for uncached responses, and the updated suite documentation remains incomplete.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1 · 1

Open (2)

Prevent unbounded growth of canonical URL alias map · New
Include copilot in the documented available suite list · New

Remove pre-existing schema aliases during cache clearing even when the response had no ETag and no disk-cache entry. Snapshot alias entries so requests completing during the asynchronous clear retain their refreshed aliases. Add failing-first cleanup coverage and a concurrent-refresh control. Include copilot in the documented integration-suite list. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Copilot review overview

🔵 Needs a closer look

Security-sensitive URL trust and concurrent cache-invalidation behavior warrant final human validation.

Review effort: Balanced
Findings: None

Resolved since last review (2)

Prevent unbounded growth of canonical URL alias map
Include copilot in the documented available suite list

…osoft#336754) * json: align schema URL trust with request destinations Canonicalize schema URLs before trusted-domain matching and request dispatch. Reject desktop requests when the legacy HTTP transport would select a different host, port, or request target. Cover browser and desktop URL handling with offline regression tests that preserve trust gates and exercise native request validation without opening sockets. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * json: defer desktop transport URL validation Keep this change focused on canonical schema URLs in common trust checks and request dispatch. Remove the desktop transport parser comparison and its dedicated tests while retaining the 28 common-client browser and desktop regression tests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * json: preserve schema URL paths and cache identities Compare encoded canonical paths without another decoding pass and retain original language-server schema IDs when invalidating canonical disk-cache entries. Add path-scope and enabled-cache regressions, and run the JSON client suite in the existing Linux Electron-Unit PR job. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * json: run schema tests through shared extension scripts Register the standalone JSON client suite beside CSS and HTML in both integration launchers. Preserve grep filtering, failure exit codes, and the existing CI JUnit reporting conventions. Remove the dedicated Linux workflow step so the existing desktop integration jobs run the suite on all supported platforms. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * json: release uncached schema aliases when clearing cache Remove pre-existing schema aliases during cache clearing even when the response had no ETag and no disk-cache entry. Snapshot alias entries so requests completing during the asynchronous clear retain their refreshed aliases. Add failing-first cleanup coverage and a concurrent-refresh control. Include copilot in the documented integration-suite list. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> (cherry picked from commit fb20064)

Copilot AI balanced review requested due to automatic review settings September 18, 2026 10:55

Dmitriy Vasyura (dmitrivMS) marked this pull request as draft September 18, 2026 10:56

Dmitriy Vasyura (dmitrivMS) self-assigned this Sep 18, 2026

Copilot started reviewing on behalf of Dmitriy Vasyura (dmitrivMS) September 18, 2026 10:56 View session

Dmitriy Vasyura (dmitrivMS) added the security label Sep 18, 2026

Copilot AI reviewed Sep 18, 2026

View reviewed changes

Comment thread extensions/json-language-features/client/src/test/schemaRequestTransport.test.ts Outdated

Comment thread extensions/json-language-features/client/src/node/jsonClientMain.ts Outdated

Dmitriy Vasyura (dmitrivMS) changed the title ~~json: align schema URL trust with request destinations~~ json: canonicalize schema URLs before trust checks and requests Sep 18, 2026

Dmitriy Vasyura (dmitrivMS) requested a balanced review from Copilot September 18, 2026 21:09

Copilot started reviewing on behalf of Dmitriy Vasyura (dmitrivMS) September 18, 2026 21:10 View session

Dmitriy Vasyura (dmitrivMS) added this to the 1.139.0 milestone Sep 18, 2026

Merge origin/main into fix/json-schema-url-destinations

3ceed52

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI reviewed Sep 18, 2026

View reviewed changes

Dmitriy Vasyura (dmitrivMS) mentioned this pull request Sep 18, 2026

mcp: enforce URL policy after variable resolution #336849

Merged

Dmitriy Vasyura (dmitrivMS) commented Sep 18, 2026

View reviewed changes

Comment thread extensions/json-language-features/client/src/utils/urlMatch.ts Outdated

Comment thread extensions/json-language-features/client/src/jsonClient.ts Outdated

Comment thread extensions/json-language-features/client/src/test/schemaRequests.test.ts

Dmitriy Vasyura (dmitrivMS) and others added 2 commits September 18, 2026 15:53

Dmitriy Vasyura (dmitrivMS) requested a balanced review from Copilot September 18, 2026 23:19

Copilot started reviewing on behalf of Dmitriy Vasyura (dmitrivMS) September 18, 2026 23:19 View session

Copilot AI reviewed Sep 18, 2026

View reviewed changes

Comment thread extensions/json-language-features/client/src/jsonClient.ts Outdated

Comment thread .github/skills/integration-tests/SKILL.md Outdated

Dmitriy Vasyura (dmitrivMS) requested a balanced review from Copilot September 18, 2026 23:56

Copilot started reviewing on behalf of Dmitriy Vasyura (dmitrivMS) September 18, 2026 23:57 View session

Dmitriy Vasyura (dmitrivMS) added the json JSON support issues label Sep 18, 2026

Copilot AI reviewed Sep 19, 2026

View reviewed changes

Dmitriy Vasyura (dmitrivMS) marked this pull request as ready for review September 19, 2026 00:54

Dmitriy Vasyura (dmitrivMS) enabled auto-merge (squash) September 19, 2026 00:54

TylerLeonhardt approved these changes Sep 19, 2026

View reviewed changes

Dmitriy Vasyura (dmitrivMS) merged commit fb20064 into main Sep 19, 2026
34 checks passed

Dmitriy Vasyura (dmitrivMS) deleted the fix/json-schema-url-destinations branch September 19, 2026 00:56

Joaquín Ruales (jruales) mentioned this pull request Sep 19, 2026

ci: fix JSON integration test build setup #336876

Merged

Dmitriy Vasyura (dmitrivMS) mentioned this pull request Sep 19, 2026

tests: revert JSON integration runner wiring #336896

Closed

Microsoft (microsoft) deleted a comment from github-actions Bot Sep 20, 2026

Navigation Menu

Repository navigation

json: canonicalize schema URLs before trust checks and requests - #336754

json: canonicalize schema URLs before trust checks and requests#336754
Dmitriy Vasyura (dmitrivMS) merged 6 commits into
mainfrom
fix/json-schema-url-destinations

Dmitriy Vasyura (dmitrivMS) commented Sep 18, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Dmitriy Vasyura (dmitrivMS) commented Sep 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟢 Approval recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🔵 Needs a closer look

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Dmitriy Vasyura (dmitrivMS) commented Sep 18, 2026 •

edited

Loading