fix(vscode): sanitize and lock down Dependencies webview to prevent XSS

[Peter Ombwa (peombwa)]

This PR fixes an XSS vulnerability in the Kiota VS Code extension's dependencies webview.

DependenciesViewProvider._getHtmlForWebview() interpolated dependency Name/Version, dependency type, and language strings directly into the webview's HTML (table rows and the "install commands" <pre> block) without any escaping. The webview also had enableScripts: true with no Content-Security-Policy. Any HTML/script content in a dependency name or version would render/execute unescaped, allowing an attacker to spoof the install commands shown to the user.

Changes

• Added escapeHtml() helper (src/utilities/html.ts).
• Escaped all dynamic values before HTML interpolation in dependenciesViewProvider.ts (dependency name/version/type, language name, localized labels).
• Added a strict Content-Security-Policy meta tag (default-src 'none', nonce-scoped script-src, scoped style-src/img-src) - none existed previously.
• Audited the rest of the extension for similar webview.html = patterns; this was the only instance.
• Added regression tests (dependenciesViewProvider.test.ts) that feed malicious dependency name/version payloads and assert the output is escaped and includes a CSP.

[Copilot]

Pull request overview

This PR hardens the Kiota VS Code extension “Dependencies” webview against XSS by HTML-escaping dynamic values and introducing a restrictive Content Security Policy, plus regression tests to prevent reintroduction.

Changes:

• Added shared HTML utilities for escaping and CSP nonce generation.
• Escaped all dependency- and localization-derived strings before interpolating into the webview HTML.
• Added regression tests asserting malicious payloads are escaped and a CSP is present.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
vscode/packages/microsoft-kiota/src/utilities/html.ts	Adds escapeHtml and getNonce helpers used by webviews.
vscode/packages/microsoft-kiota/src/providers/dependenciesViewProvider.ts	Applies escaping to all dynamic webview HTML values and adds a CSP meta tag.
vscode/packages/microsoft-kiota/src/test/suite/providers/dependenciesViewProvider.test.ts	Adds regression tests covering escaping behavior and CSP presence.

[github-code-quality]

Code Coverage Overview

Languages: C#

C# / code-coverage/dotnet

The overall coverage in commit a62d951 in the fix/dependencies-web... branch is 72%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.

File	main	fix/dependencies-web... a62d951	+/-
/home/runner/wo...guageRefiner.cs	—	98%	—
/home/runner/wo...criptRefiner.cs	—	98%	—
/home/runner/wo...MethodWriter.cs	—	97%	—
/home/runner/wo...MethodWriter.cs	—	96%	—
/home/runner/wo...MethodWriter.cs	—	96%	—
/home/runner/wo...MethodWriter.cs	—	95%	—
/home/runner/wo...rs/GoRefiner.cs	—	94%	—
/home/runner/wo...KiotaBuilder.cs	—	90%	—
/home/runner/wo...ationService.cs	—	89%	—
/home/runner/wo...xGenerator.g.cs	—	75%	—

---

_{Updated August 05, 2026 23:55 UTC}

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

vscode/packages/microsoft-kiota/src/providers/dependenciesViewProvider.ts:8

• The webview HTML produced here doesn’t include any <script> tags or message handlers, but resolveWebviewView still sets enableScripts: true. Even with a CSP, disabling scripts entirely is a stronger mitigation and reduces future XSS blast radius if any unescaped HTML slips in later.

import { escapeHtml, getNonce } from '../utilities/html';

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

vscode/packages/microsoft-kiota/src/providers/dependenciesViewProvider.ts:63

• The PR description mentions adding a getNonce() helper and using a nonce-scoped script-src, but the implemented CSP disables scripts entirely (script-src 'none') and there is no nonce helper. Please update the PR description to match the implemented approach (or adjust the implementation if you intended to allow scripts with a nonce).

			<head>
				<meta charset="UTF-8">
				<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src ${webview.cspSource}; img-src ${webview.cspSource}; script-src 'none';">
				<meta name="viewport" content="width=device-width, initial-scale=1.0">