Repository: vscode
Issue: Trivial pollution of workbench.action.terminal.runRecentCommand list
Labels: feature-request,terminal-shell-integration

<!-- ⚠️⚠️ Do Not Delete This! bug_report_template ⚠️⚠️ -->
<!-- Please read our Rules of Conduct: https://opensource.microsoft.com/codeofconduct/ -->
<!-- 🕮 Read our guide about submitting issues: https://github.com/microsoft/vscode/wiki/Submitting-Bugs-and-Suggestions -->
<!-- 🔎 Search existing issues to avoid creating duplicates. -->
<!-- 🧪 Test using the latest Insiders build to see if your issue has already been fixed: https://code.visualstudio.com/insiders/ -->
<!-- 💡 Instead of creating your report here, use 'Report Issue' from the 'Help' menu in VS Code to pre-fill useful information. -->
<!-- 🔧 Launch with `code --disable-extensions` to check. -->
Does this issue occur when all extensions are disabled?: Yes

<!-- 🪓 If you answered No above, use 'Help: Start Extension Bisect' from Command Palette to try to identify the cause. -->
<!-- 📣 Issues caused by an extension need to be reported directly to the extension publisher. The 'Help > Report Issue' dialog can assist with this. -->
- VS Code Version: 1.70.1
- OS Version: macOS 12.5

This does not appear to meet the definition of a security vulnerability as defined in your [security policy](https://github.com/microsoft/vscode/security/policy), but is concerning so I am raising it as a standard bug report instead.

---

Steps to Reproduce:

1. Run this innocent-looking curl request in the vscode terminal:
   ```sh
   curl https://davidje13.github.io/vscode-command-test/info.txt
   ```

   (you can see the file being downloaded and the plain-text script used to generate it here: https://github.com/davidje13/vscode-command-test)

   It will output: "Hello here is some legitimate content"

2. Run the command `workbench.action.terminal.runRecentCommand` (e.g. by using Cmd+R / Ctrl+R if the [suggestion in the documentation](https://code.visualstudio.com/updates/v1_70#_run-recent-command-as-a-replacement-for-reverse-search) has been followed)

3. Notice that `make` (and possibly `npm install`, but adding multiple commands at once seems unreliable) have appeared in the list. Notice that running one of these will execute the expected command, followed by the (nonexistent) `badcommand` executable (which in practice could obviously be anything)

   ![observed](https://user-images.githubusercontent.com/3287761/184543875-f695704d-1b55-4ea7-81a4-08e171004896.png)

This example uses `curl`ing a URL, but it applies to any situation where a malicious actor can manipulate output displayed in the terminal as the result of any command (e.g. npm package installation info even if scripts are disabled, or server log output when running a local server via this terminal).

Fortunately this list appears to only be used (so far) for the command history feature, which is not enabled by default.

---

There are 2 issues here:

1. it is possible to silently register commands in this list — even from locations which only have the ability to output text — by using the VSCode escape sequence `\033]633;E;%s\007` (the example above adds some other sequences around it to improve the reliability when registering multiple commands at once)
2. It is possible to hide malicious parts of a command by adding arbitrary amounts of whitespace (in the example above, the "legitimate" part of the command is followed by many spaces to ensure the "malicious" part is hidden from view, and the only indication to a user that something is amiss before they run it is the "…")

For the first issue, adding a per-session or per-installation random "password" to the escape sequence may be enough to prevent most attacks (as accessing this "password" would likely require script level access anyway)

For the second issue, collapsing multiple spaces in the display might help, but there are likely other ways to obfuscate this sort of thing.