Change:
<!-- Do Not Delete This! bugreporttemplate --<!-- Please read our Rules of Conduct: --<!-- Read our guide about submitting issues: --<!-- Search existing issues to avoid creating duplicates. --<!-- Test using the latest Insiders build to see if your issue has already been fixed: --<!-- Instead of creating your report here, use 'Report Issue' from the 'Help' menu in VS Code to pre-fill useful information. --<!-- Launch with to check. --Does this issue occur when all extensions are disabled?: Yes/No --- <!-- If you answered No above, use 'Help: Start Extension Bisect' from Command Palette to try to identify the cause. --<!-- Issues caused by an extension need to be reported directly to the extension publisher. The 'Help Report Issue' dialog can assist with this. --- VS Code Version: --- OS Version: --- monaco-editor version: 0.28.0 Hi. I have an issue with part of code inside monaco-editor's build code inside this particular file: I opened issue here (rather that monaco-editor's repository) because I found the code inside vscode's source code. There is a code snippet that goes like . (inside as ) Which is probably there because of IE-support reasons. But as you may know there is a security vulnerability reported for that small code snippet. is an alert. My problem arises from the point that I deployed my web application which included monaco-editor. It was all perfect, until I received a message that said the page that includes monaco-editor is not loading. I double checked my website, it was fine everywhere. It worked. For debugging, I went to the organization that I received the message from. It did not work inside the organization. After hours of debugging I found out the IPS of the organization is preventing the file from arriving into the company's network. My issue was resolved with simply removing every usage of from the build code and serving it from my server (instead of using a CDN), because my web application did not need IE support. Later I found that doing simply like this would trick that particular IPS too: That particular IPS may let this code through; but other IPSs may not! So I'm here with this issue maybe you can do something about it to prevent further problems like this for anyone else to happen. You can gain more information about the security vulnerability by searching this message: HTTP BROWSER Microsoft Internet Explorer improper copy buffer access information disclosure attempt And here is the problematic code inside vscode's source code:
According to this: What about IE 11 support? The Monaco Editor no longer supports IE 11. The last version that was tested on IE 11 is 0.18.1. So I think it would be safe to remove everything that uses . I would be happy to do it if confirmed.
verified in code

Discussion:
if (e.clipboardData) { return true; } <del> if ((<any>window).clipboardData) { return true; } </del> return false; }

return [text, metadata]; } <del> if ((<any>window).clipboardData) { e.preventDefault(); const text: string = (<any>window).clipboardData.getData('Text'); return [text, null]; } </del> throw new Error('ClipboardEventUtils.getTextData: Cannot use text data!'); }

return; } <del> if ((<any>window).clipboardData) { (<any>window).clipboardData.setData('Text', text); e.preventDefault(); return; } </del> throw new Error('ClipboardEventUtils.setTextData: Cannot use text data!'); } }