CVE-2021-29642: Incorrect Authorization (CWE-863)
value: GistPad before 0.2.7 allows a crafted workspace folder to change the URL for the Gist API, which leads to leakage of GitHub access tokens.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 5.3
Published: 2021-03-30T19:15Z
Repository: https://github.com/lostintangent/gistpad
Language: TypeScript
Files changed: CHANGELOG.md, README.md, package.json, src/config.ts, src/repos/wiki/commands.ts, src/store/actions.ts, src/store/auth.ts
Commit date: 2021-03-30 02:00:26 +0000
Commit message: Removing API URL setting

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 32ce5f2..450ba9a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
+## v0.2.7 (03/29/21)
+
+- Removed the `GistPad > Api Url` setting, since it was no longer supported after GistPad moved over to using VS Code's native authentication.
+
 ## v0.2.6 (03/21/21)
 
 - Removed all bundled extensions, to keep GistPad as small as possible
 
 ## v0.2.5 (03/21/21)
diff --git a/README.md b/README.md
index 202aba4..25a685b 100644
--- a/README.md
+++ b/README.md
@@ -283,36 +283,34 @@ In addition to the `Gists` view, this extension also provides the following comm
 
 - `GistPad: Paste Gist File - Allows you to paste the contents of a Gist file into the active editor
 
 ## Configuration Settings
 
-- `Gistpad: Api Url` - Specifies the GitHub API server to use. By default, this points at GitHub.com (`https://api.github.com`), but if you're using GitHub Enterprise, then you need to set this to the v3 API URL of your GitHub server. This should be something like `https://[YOUR_HOST]/api/v3`.
+- `Gistpad: Tree Icons` - Specifies whether to show the gist type icons in the gists tree.
 
-* `Gistpad: Tree Icons` - Specifies whether to show the gist type icons in the gists tree.
-
-* `GistPad > Comments: Show Thread` - Specifies when to show the comment thread UI whenever you open a Gist file. Can be set to one of the following values:
+- `GistPad > Comments: Show Thread` - Specifies when to show the comment thread UI whenever you open a Gist file. Can be set to one of the following values:
 
   - `always`: Always display the comment thread whenever you open a Gist file. You can manually collapse it as needed.
   - `never`: Never automatically open the comment thread when you open a Gist file. You can manually expand it as needed.
   - `whenNotEmpty` _(default)_: Automatically display the comment thread whenever there are actually comments in a Gist file. Otherwise, leave it collapsed.
 
-* `Gistpad > Images: Paste Format`: Specifies the markup format to use when pasting an image into a gist file. Can be set to one of the following values:
+- `Gistpad > Images: Paste Format`: Specifies the markup format to use when pasting an image into a gist file. Can be set to one of the following values:
 
   - `markdown` _(default)_: Pastes the image reference using `Markdown` format (e.g. `![image](link)`).
   - `html`: Pastes the image reference using `HTML` format (e.g. `<img src="link" />`). Note, when you paste an image into an HTML file, it will always use this format type, regardless what the setting is.
 
-* `Gistpad > Images: Paste Type`: Specifies the method to use when pasting an image into a gist file. Can be set to one of the following values:
+- `Gistpad > Images: Paste Type`: Specifies the method to use when pasting an image into a gist file. Can be set to one of the following values:
 
   - `file` _(default)_: The pasted image is uploaded as a `.png` to the gist, and a reference is added to file it's pasted into.
   - `base64`: The pasted image is base64-encoded and then embedded into the gist file.
 
-* `Gistpad > Images: Upload Directory Name`: Specifies the name of the directory to upload images to. Defaults to `images`.
+- `Gistpad > Images: Upload Directory Name`: Specifies the name of the directory to upload images to. Defaults to `images`.
 
-* `GistPad > Scratch Notes: Directory Format` - Specifies the [moment.js](https://momentjs.com/) format string to use when generating directories for new scratch notes. Defaults to `LL` (e.g. `March 6, 2020`).
+- `GistPad > Scratch Notes: Directory Format` - Specifies the [moment.js](https://momentjs.com/) format string to use when generating directories for new scratch notes. Defaults to `LL` (e.g. `March 6, 2020`).
 
-* `GistPad > Scratch Notes: File Extension` - Specifies the file extension to use when generating new scratch notes. Defaults to `.md`.
+- `GistPad > Scratch Notes: File Extension` - Specifies the file extension to use when generating new scratch notes. Defaults to `.md`.
 
-* `GistPad > Scratch Notes: File Format` - Specifies the [moment.js](https://momentjs.com/) format string to use when generating new scratch notes. Defaults to `LT` (e.g. `2:52 PM`).
+- `GistPad > Scratch Notes: File Format` - Specifies the [moment.js](https://momentjs.com/) format string to use when generating new scratch notes. Defaults to `LT` (e.g. `2:52 PM`).
 
-* `GistPad > Scratch Notes: Show` - Specifies whether or not to display the scratch notes node in the gists tree view. Defaults to `true`.
+- `GistPad > Scratch Notes: Show` - Specifies whether or not to display the scratch notes node in the gists tree view. Defaults to `true`.
 
-* `GistPad > Showcase URL` - Specifies the URL to use when displaying the showcase entry. This allows teams/classrooms/etc. to create their own showcase and share it amongst themselves.
+- `GistPad > Showcase URL` - Specifies the URL to use when displaying the showcase entry. This allows teams/classrooms/etc. to create their own showcase and share it amongst themselves.
diff --git a/package.json b/package.json
index d54a512..ff8b5d9 100644
--- a/package.json
+++ b/package.json
@@ -1,11 +1,11 @@
 {
   "name": "gistfs",
   "displayName": "GistPad",
   "description": "Manage your code snippets and developer notes using GitHub Gists and repositories.",
   "publisher": "vsls-contrib",
-  "version": "0.2.6",
+  "version": "0.2.7",
   "extensionKind": [
     "ui",
     "workspace"
   ],
   "icon": "images/icon.png",
@@ -40,15 +40,10 @@
   "contributes": {
     "configuration": {
       "type": "object",
       "title": "GistPad",
       "properties": {
-        "gistpad.apiUrl": {
-          "default": "https://api.github.com",
-          "type": "string",
-          "description": "Specifies the GitHub server's API URL. By default, this points to GitHub.com, but it can be used to point at a GitHub Enterprise instance."
-        },
         "gistpad.treeIcons": {
           "default": "true",
           "type": "boolean",
           "description": "Specifies whether to show the gist type icons in the gists tree."
         },
diff --git a/src/config.ts b/src/config.ts
index 3e697ab..a99dc41 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -1,11 +1,10 @@
 import * as vscode from "vscode";
 
 const CONFIG_SECTION = "gistpad";
 
 export function get(key: "treeIcons"): boolean;
-export function get(key: "apiUrl"): string;
 export function get(key: "images.markdownPasteFormat"): "markdown" | "html";
 export function get(key: "images.pasteType"): "file" | "base64";
 export function get(key: "images.directoryName"): string;
 export function get(key: "scratchNotes.directoryFormat"): string;
 export function get(key: "scratchNotes.fileExtension"): string;
diff --git a/src/repos/wiki/commands.ts b/src/repos/wiki/commands.ts
index 5287785..cf96f5f 100644
--- a/src/repos/wiki/commands.ts
+++ b/src/repos/wiki/commands.ts
@@ -41,30 +41,31 @@ export function registerCommands(context: ExtensionContext) {
     commands.registerCommand(
       `${EXTENSION_NAME}.addWikiPage`,
       async (node?: RepositoryNode | RepositoryFileNode) => {
         const repoName = node?.repo.name || store.wiki!.name;
 
-        const input = await window.createInputBox();
+        const input = window.createInputBox();
         input.title = `Add wiki page (${repoName})`;
-        input.prompt =  "Enter the name of the new page you'd like to create";
+        input.prompt = "Enter the name of the new page you'd like to create";
 
         input.onDidAccept(async () => {
           input.hide();
-          
+
           if (input.value) {
             const path = getPageFilePath(input.value);
             const filePath =
               node instanceof RepositoryFileNode
                 ? `${node.file.path}/${path}`
                 : path;
-  
-            
-            await withProgress("Adding new page...", async () => createWikiPage(input.value, repoName, filePath));
+
+            await withProgress("Adding new page...", async () =>
+              createWikiPage(input.value, repoName, filePath)
+            );
             openRepoDocument(repoName, filePath);
           }
-        })
-        
+        });
+
         input.show();
       }
     )
   );
 
@@ -85,13 +86,13 @@ export function registerCommands(context: ExtensionContext) {
 
         const uri = RepoFileSystemProvider.getFileUri(repoName, filePath);
         const [, file] = RepoFileSystemProvider.getRepoInfo(uri)!;
 
         if (!file) {
-          await withProgress("Adding new page...", async () => {
-            return createWikiPage(pageTitle, repoName, filePath);
-          });
+          await withProgress("Adding new page...", async () =>
+            createWikiPage(pageTitle, repoName, filePath)
+          );
         }
 
         openRepoDocument(repoName, filePath);
       }
     )
diff --git a/src/store/actions.ts b/src/store/actions.ts
index 2c8e1a6..b53c162 100644
--- a/src/store/actions.ts
+++ b/src/store/actions.ts
@@ -24,18 +24,11 @@ import moment = require("moment");
 
 const Gists = require("gists");
 
 export async function getApi(constructor = Gists) {
   const token = await getToken();
-  const apiurl = config.get("apiUrl");
-
-  if (!apiurl) {
-    const message = "No API URL is set.";
-    throw new Error(message);
-  }
-
-  return new constructor({ apiurl, token });
+  return new constructor({ token });
 }
 
 export async function duplicateGist(
   id: string,
   isPublic: boolean = true,
diff --git a/src/store/auth.ts b/src/store/auth.ts
index e2aad62..2c095ca 100644
--- a/src/store/auth.ts
+++ b/src/store/auth.ts
@@ -3,11 +3,10 @@ import {
   AuthenticationSession,
   commands,
   window
 } from "vscode";
 import { store } from ".";
-import * as config from "../config";
 import { EXTENSION_NAME } from "../constants";
 import { refreshGists } from "./actions";
 const GitHub = require("github-base");
 
 let loginSession: string | undefined;
@@ -25,13 +24,11 @@ const REPO_SCOPE = "repo";
 const DELETE_REPO_SCOPE = "delete_repo";
 
 // TODO: Replace github-base with octokit
 export async function getApi(newToken?: string) {
   const token = newToken || (await getToken());
-  const apiurl = config.get("apiUrl");
-
-  return new GitHub({ apiurl, token });
+  return new GitHub({ token });
 }
 
 const TOKEN_RESPONSE = "Sign in";
 export async function ensureAuthenticated() {
   if (store.isSignedIn) {

Vulnerable code: - `Gistpad: Api Url` - Specifies the GitHub API server to use. By default, this points at GitHub.com (`https://api.github.com`), but if you're using GitHub Enterprise, then you need to set this to the v3 API URL of your GitHub server. This should be something like `https://[YOUR_HOST]/api/v3`.
* `Gistpad: Tree Icons` - Specifies whether to show the gist type icons in the gists tree.

* `GistPad > Comments: Show Thread` - Specifies when to show the comment thread UI whenever you open a Gist file. Can be set to one of the following values:
* `Gistpad > Images: Paste Format`: Specifies the markup format to use when pasting an image into a gist file. Can be set to one of the following values:
* `Gistpad > Images: Paste Type`: Specifies the method to use when pasting an image into a gist file. Can be set to one of the following values:
* `Gistpad > Images: Upload Directory Name`: Specifies the name of the directory to upload images to. Defaults to `images`.
* `GistPad > Scratch Notes: Directory Format` - Specifies the [moment.js](https://momentjs.com/) format string to use when generating directories for new scratch notes. Defaults to `LL` (e.g. `March 6, 2020`).
* `GistPad > Scratch Notes: File Extension` - Specifies the file extension to use when generating new scratch notes. Defaults to `.md`.
* `GistPad > Scratch Notes: File Format` - Specifies the [moment.js](https://momentjs.com/) format string to use when generating new scratch notes. Defaults to `LT` (e.g. `2:52 PM`).
* `GistPad > Scratch Notes: Show` - Specifies whether or not to display the scratch notes node in the gists tree view. Defaults to `true`.
* `GistPad > Showcase URL` - Specifies the URL to use when displaying the showcase entry. This allows teams/classrooms/etc. to create their own showcase and share it amongst themselves.
  "version": "0.2.6",
        "gistpad.apiUrl": {
          "default": "https://api.github.com",
          "type": "string",
          "description": "Specifies the GitHub server's API URL. By default, this points to GitHub.com, but it can be used to point at a GitHub Enterprise instance."
        },
export function get(key: "apiUrl"): string;
        const input = await window.createInputBox();
        input.prompt =  "Enter the name of the new page you'd like to create";
          
  
            
            await withProgress("Adding new page...", async () => createWikiPage(input.value, repoName, filePath));
        })
        
          await withProgress("Adding new page...", async () => {
            return createWikiPage(pageTitle, repoName, filePath);
          });
  const apiurl = config.get("apiUrl");

  if (!apiurl) {
    const message = "No API URL is set.";
    throw new Error(message);
  }

  return new constructor({ apiurl, token });
import * as config from "../config";
  const apiurl = config.get("apiUrl");

  return new GitHub({ apiurl, token });
Fixed code: ## v0.2.7 (03/29/21)

- Removed the `GistPad > Api Url` setting, since it was no longer supported after GistPad moved over to using VS Code's native authentication.

- `Gistpad: Tree Icons` - Specifies whether to show the gist type icons in the gists tree.
- `GistPad > Comments: Show Thread` - Specifies when to show the comment thread UI whenever you open a Gist file. Can be set to one of the following values:
- `Gistpad > Images: Paste Format`: Specifies the markup format to use when pasting an image into a gist file. Can be set to one of the following values:
- `Gistpad > Images: Paste Type`: Specifies the method to use when pasting an image into a gist file. Can be set to one of the following values:
- `Gistpad > Images: Upload Directory Name`: Specifies the name of the directory to upload images to. Defaults to `images`.
- `GistPad > Scratch Notes: Directory Format` - Specifies the [moment.js](https://momentjs.com/) format string to use when generating directories for new scratch notes. Defaults to `LL` (e.g. `March 6, 2020`).
- `GistPad > Scratch Notes: File Extension` - Specifies the file extension to use when generating new scratch notes. Defaults to `.md`.
- `GistPad > Scratch Notes: File Format` - Specifies the [moment.js](https://momentjs.com/) format string to use when generating new scratch notes. Defaults to `LT` (e.g. `2:52 PM`).
- `GistPad > Scratch Notes: Show` - Specifies whether or not to display the scratch notes node in the gists tree view. Defaults to `true`.
- `GistPad > Showcase URL` - Specifies the URL to use when displaying the showcase entry. This allows teams/classrooms/etc. to create their own showcase and share it amongst themselves.
  "version": "0.2.7",
        const input = window.createInputBox();
        input.prompt = "Enter the name of the new page you'd like to create";


            await withProgress("Adding new page...", async () =>
              createWikiPage(input.value, repoName, filePath)
            );
        });

          await withProgress("Adding new page...", async () =>
            createWikiPage(pageTitle, repoName, filePath)
          );
  return new constructor({ token });
  return new GitHub({ token });