CVE-2021-29642 (published 2021-03-30T19:15Z)

GistPad before 0.2.7 allows a crafted workspace folder to change the URL for the Gist API, which leads to leakage of GitHub access tokens.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/lostintangent/gistpad
commit_details: repo_url: https://github.com/lostintangent/gistpad
author: Jonathan Carter
author_date: 2021-03-30 02:00:26+00:00
msg: Removing API URL setting
repository: repo_url: https://github.com/lostintangent/gistpad
repo_name: lostintangent/gistpad
description: VS Code extension for managing and sharing code snippets, notes and interactive samples using GitHub Gists
repo_language: TypeScript
owner: lostintangent
file_changes: filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,7 @@
+## v0.2.7 (03/29/21)
+
+- Removed the `GistPad > Api Url` setting, since it was no longer supported after GistPad moved over to using VS Code's native authentication.
+
 ## v0.2.6 (03/21/21)
 
 - Removed all bundled extensions, to keep GistPad as small as possible

programming_language: Markdown
filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -285,34 +285,32 @@ In addition to the `Gists` view, this extension also provides the following comm
 
 ## Configuration Settings
 
-- `Gistpad: Api Url` - Specifies the GitHub API server to use. By default, this points at GitHub.com (`https://api.github.com`), but if you're using GitHub Enterprise, then you need to set this to the v3 API URL of your GitHub server. This should be something like `https://[YOUR_HOST]/api/v3`.
+- `Gistpad: Tree Icons` - Specifies whether to show the gist type icons in the gists tree.
 
-* `Gistpad: Tree Icons` - Specifies whether to show the gist type icons in the gists tree.
-
-* `GistPad > Comments: Show Thread` - Specifies when to show the comment thread UI whenever you open a Gist file. Can be set to one of the following values:
+- `GistPad > Comments: Show Thread` - Specifies when to show the comment thread UI whenever you open a Gist file. Can be set to one of the following values:
 
   - `always`: Always display the comment thread whenever you open a Gist file. You can manually collapse it as needed.
   - `never`: Never automatically open the comment thread when you open a Gist file. You can manually expand it as needed.
   - `whenNotEmpty` _(default)_: Automatically display the comment thread whenever there are actually comments in a Gist file. Otherwise, leave it collapsed.
 
-* `Gistpad > Images: Paste Format`: Specifies the markup format to use when pasting an image into a gist file. Can be set to one of the following values:
+- `Gistpad > Images: Paste Format`: Specifies the markup format to use when pasting an image into a gist file. Can be set to one of the following values:
 
   - `markdown` _(default)_: Pastes the image reference using `Markdown` format (e.g. `![image](link)`).
   - `html`: Pastes the image reference using `HTML` format (e.g. `<img src="link" />`). Note, when you paste an image into an HTML file, it will always use this format type, regardless what the setting is.
 
-* `Gistpad > Images: Paste Type`: Specifies the method to use when pasting an image into a gist file. Can be set to one of the following values:
+- `Gistpad > Images: Paste Type`: Specifies the method to use when pasting an image into a gist file. Can be set to one of the following values:
 
   - `file` _(default)_: The pasted image is uploaded as a `.png` to the gist, and a reference is added to file it's pasted into.
   - `base64`: The pasted image is base64-encoded and then embedded into the gist file.
 
-* `Gistpad > Images: Upload Directory Name`: Specifies the name of the directory to upload images to. Defaults to `images`.
+- `Gistpad > Images: Upload Directory Name`: Specifies the name of the directory to upload images to. Defaults to `images`.
 
-* `GistPad > Scratch Notes: Directory Format` - Specifies the [moment.js](https://momentjs.com/) format string to use when generating directories for new scratch notes. Defaults to `LL` (e.g. `March 6, 2020`).
+- `GistPad > Scratch Notes: Directory Format` - Specifies the [moment.js](https://momentjs.com/) format string to use when generating directories for new scratch notes. Defaults to `LL` (e.g. `March 6, 2020`).
 
-* `GistPad > Scratch Notes: File Extension` - Specifies the file extension to use when generating new scratch notes. Defaults to `.md`.
+- `GistPad > Scratch Notes: File Extension` - Specifies the file extension to use when generating new scratch notes. Defaults to `.md`.
 
-* `GistPad > Scratch Notes: File Format` - Specifies the [moment.js](https://momentjs.com/) format string to use when generating new scratch notes. Defaults to `LT` (e.g. `2:52 PM`).
+- `GistPad > Scratch Notes: File Format` - Specifies the [moment.js](https://momentjs.com/) format string to use when generating new scratch notes. Defaults to `LT` (e.g. `2:52 PM`).
 
-* `GistPad > Scratch Notes: Show` - Specifies whether or not to display the scratch notes node in the gists tree view. Defaults to `true`.
+- `GistPad > Scratch Notes: Show` - Specifies whether or not to display the scratch notes node in the gists tree view. Defaults to `true`.
 
-* `GistPad > Showcase URL` - Specifies the URL to use when displaying the showcase entry. This allows teams/classrooms/etc. to create their own showcase and share it amongst themselves.
+- `GistPad > Showcase URL` - Specifies the URL to use when displaying the showcase entry. This allows teams/classrooms/etc. to create their own showcase and share it amongst themselves.

programming_language: Markdown
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
   "displayName": "GistPad",
   "description": "Manage your code snippets and developer notes using GitHub Gists and repositories.",
   "publisher": "vsls-contrib",
-  "version": "0.2.6",
+  "version": "0.2.7",
   "extensionKind": [
     "ui",
     "workspace"
@@ -42,11 +42,6 @@
       "type": "object",
       "title": "GistPad",
       "properties": {
-        "gistpad.apiUrl": {
-          "default": "https://api.github.com",
-          "type": "string",
-          "description": "Specifies the GitHub server's API URL. By default, this points to GitHub.com, but it can be used to point at a GitHub Enterprise instance."
-        },
         "gistpad.treeIcons": {
           "default": "true",
           "type": "boolean",

programming_language: JavaScript
filename: config.ts
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,6 @@ import * as vscode from "vscode";
 const CONFIG_SECTION = "gistpad";
 
 export function get(key: "treeIcons"): boolean;
-export function get(key: "apiUrl"): string;
 export function get(key: "images.markdownPasteFormat"): "markdown" | "html";
 export function get(key: "images.pasteType"): "file" | "base64";
 export function get(key: "images.directoryName"): string;

programming_language: TypeScript
filename: commands.ts
change_type: ModificationType.MODIFY
diff: @@ -43,26 +43,27 @@ export function registerCommands(context: ExtensionContext) {
       async (node?: RepositoryNode | RepositoryFileNode) => {
         const repoName = node?.repo.name || store.wiki!.name;
 
-        const input = await window.createInputBox();
+        const input = window.createInputBox();
         input.title = `Add wiki page (${repoName})`;
-        input.prompt =  "Enter the name of the new page you'd like to create";
+        input.prompt = "Enter the name of the new page you'd like to create";
 
         input.onDidAccept(async () => {
           input.hide();
-          
+
           if (input.value) {
             const path = getPageFilePath(input.value);
             const filePath =
               node instanceof RepositoryFileNode
                 ? `${node.file.path}/${path}`
                 : path;
-  
-            
-            await withProgress("Adding new page...", async () => createWikiPage(input.value, repoName, filePath));
+
+            await withProgress("Adding new page...", async () =>
+              createWikiPage(input.value, repoName, filePath)
+            );
             openRepoDocument(repoName, filePath);
           }
-        })
-        
+        });
+
         input.show();
       }
     )
@@ -87,9 +88,9 @@ export function registerCommands(context: ExtensionContext) {
         const [, file] = RepoFileSystemProvider.getRepoInfo(uri)!;
 
         if (!file) {
-          await withProgress("Adding new page...", async () => {
-            return createWikiPage(pageTitle, repoName, filePath);
-          });
+          await withProgress("Adding new page...", async () =>
+            createWikiPage(pageTitle, repoName, filePath)
+          );
         }
 
         openRepoDocument(repoName, filePath);

programming_language: TypeScript
filename: actions.ts
change_type: ModificationType.MODIFY
diff: @@ -26,14 +26,7 @@ const Gists = require("gists");
 
 export async function getApi(constructor = Gists) {
   const token = await getToken();
-  const apiurl = config.get("apiUrl");
-
-  if (!apiurl) {
-    const message = "No API URL is set.";
-    throw new Error(message);
-  }
-
-  return new constructor({ apiurl, token });
+  return new constructor({ token });
 }
 
 export async function duplicateGist(

programming_language: TypeScript
filename: auth.ts
change_type: ModificationType.MODIFY
diff: @@ -5,7 +5,6 @@ import {
   window
 } from "vscode";
 import { store } from ".";
-import * as config from "../config";
 import { EXTENSION_NAME } from "../constants";
 import { refreshGists } from "./actions";
 const GitHub = require("github-base");
@@ -27,9 +26,7 @@ const DELETE_REPO_SCOPE = "delete_repo";
 // TODO: Replace github-base with octokit
 export async function getApi(newToken?: string) {
   const token = newToken || (await getToken());
-  const apiurl = config.get("apiUrl");
-
-  return new GitHub({ apiurl, token });
+  return new GitHub({ token });
 }
 
 const TOKEN_RESPONSE = "Sign in";

programming_language: TypeScript