CVE-2021-29642 (TypeScript, published 2021-03-30T19:15Z)
Description: value: GistPad before 0.2.7 allows a crafted workspace folder to change the URL for the Gist API, which leads to leakage of GitHub access tokens.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/lostintangent/gistpad
Files changed:
CHANGELOG.md
README.md
package.json
src/config.ts
src/repos/wiki/commands.ts
src/store/actions.ts
src/store/auth.ts
Commit message: Removing API URL setting


Vulnerable code:
- `Gistpad: Api Url` - Specifies the GitHub API server to use. By default, this points at GitHub.com (`https://api.github.com`), but if you're using GitHub Enterprise, then you need to set this to the v3 API URL of your GitHub server. This should be something like `https://[YOUR_HOST]/api/v3`.
* `Gistpad: Tree Icons` - Specifies whether to show the gist type icons in the gists tree.

* `GistPad > Comments: Show Thread` - Specifies when to show the comment thread UI whenever you open a Gist file. Can be set to one of the following values:
* `Gistpad > Images: Paste Format`: Specifies the markup format to use when pasting an image into a gist file. Can be set to one of the following values:
* `Gistpad > Images: Paste Type`: Specifies the method to use when pasting an image into a gist file. Can be set to one of the following values:
* `Gistpad > Images: Upload Directory Name`: Specifies the name of the directory to upload images to. Defaults to `images`.
* `GistPad > Scratch Notes: Directory Format` - Specifies the [moment.js](https://momentjs.com/) format string to use when generating directories for new scratch notes. Defaults to `LL` (e.g. `March 6, 2020`).
* `GistPad > Scratch Notes: File Extension` - Specifies the file extension to use when generating new scratch notes. Defaults to `.md`.
* `GistPad > Scratch Notes: File Format` - Specifies the [moment.js](https://momentjs.com/) format string to use when generating new scratch notes. Defaults to `LT` (e.g. `2:52 PM`).
* `GistPad > Scratch Notes: Show` - Specifies whether or not to display the scratch notes node in the gists tree view. Defaults to `true`.
* `GistPad > Showcase URL` - Specifies the URL to use when displaying the showcase entry. This allows teams/classrooms/etc. to create their own showcase and share it amongst themselves.
  "version": "0.2.6",
        "gistpad.apiUrl": {
          "default": "https://api.github.com",
          "type": "string",
          "description": "Specifies the GitHub server's API URL. By default, this points to GitHub.com, but it can be used to point at a GitHub Enterprise instance."
        },
export function get(key: "apiUrl"): string;
        const input = await window.createInputBox();
        input.prompt =  "Enter the name of the new page you'd like to create";
          
  
            
            await withProgress("Adding new page...", async () => createWikiPage(input.value, repoName, filePath));
        })
        
          await withProgress("Adding new page...", async () => {
            return createWikiPage(pageTitle, repoName, filePath);
          });
  const apiurl = config.get("apiUrl");

  if (!apiurl) {
    const message = "No API URL is set.";
    throw new Error(message);
  }

  return new constructor({ apiurl, token });
import * as config from "../config";
  const apiurl = config.get("apiUrl");

  return new GitHub({ apiurl, token });

Fixed code:
## v0.2.7 (03/29/21)

- Removed the `GistPad > Api Url` setting, since it was no longer supported after GistPad moved over to using VS Code's native authentication.

- `Gistpad: Tree Icons` - Specifies whether to show the gist type icons in the gists tree.
- `GistPad > Comments: Show Thread` - Specifies when to show the comment thread UI whenever you open a Gist file. Can be set to one of the following values:
- `Gistpad > Images: Paste Format`: Specifies the markup format to use when pasting an image into a gist file. Can be set to one of the following values:
- `Gistpad > Images: Paste Type`: Specifies the method to use when pasting an image into a gist file. Can be set to one of the following values:
- `Gistpad > Images: Upload Directory Name`: Specifies the name of the directory to upload images to. Defaults to `images`.
- `GistPad > Scratch Notes: Directory Format` - Specifies the [moment.js](https://momentjs.com/) format string to use when generating directories for new scratch notes. Defaults to `LL` (e.g. `March 6, 2020`).
- `GistPad > Scratch Notes: File Extension` - Specifies the file extension to use when generating new scratch notes. Defaults to `.md`.
- `GistPad > Scratch Notes: File Format` - Specifies the [moment.js](https://momentjs.com/) format string to use when generating new scratch notes. Defaults to `LT` (e.g. `2:52 PM`).
- `GistPad > Scratch Notes: Show` - Specifies whether or not to display the scratch notes node in the gists tree view. Defaults to `true`.
- `GistPad > Showcase URL` - Specifies the URL to use when displaying the showcase entry. This allows teams/classrooms/etc. to create their own showcase and share it amongst themselves.
  "version": "0.2.7",
        const input = window.createInputBox();
        input.prompt = "Enter the name of the new page you'd like to create";


            await withProgress("Adding new page...", async () =>
              createWikiPage(input.value, repoName, filePath)
            );
        });

          await withProgress("Adding new page...", async () =>
            createWikiPage(pageTitle, repoName, filePath)
          );
  return new constructor({ token });
  return new GitHub({ token });