-
Notifications
You must be signed in to change notification settings - Fork 74
Sync Windows hotfix to main #1560
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
4cb9435
58181fa
e52df09
9b4a302
7833789
9e6dc84
c6da561
0dd458d
2549849
df79cdd
ff32034
d1ab577
c7915f1
c623472
ade1821
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,6 +4,7 @@ | |
| "private": true, | ||
| "pnpm": { | ||
| "overrides": { | ||
| "fast-xml-parser": "5.3.7" | ||
| } | ||
| }, | ||
| "dependencies": { | ||
|
|
||
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
| Original file line number | Diff line number | Diff line change | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -4,7 +4,13 @@ All notable changes to the **Ballerina** extension will be documented in this fi | |||||||||||||||
|
|
||||||||||||||||
| The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project adheres to [Semantic Versioning](https://semver.org/). | ||||||||||||||||
|
|
||||||||||||||||
| ## [5.8.0](https://github.com/wso2/vscode-extensions/compare/ballerina-5.7.3...ballerina-5.8.0) - 2026-02-14 | ||||||||||||||||
| ## [5.8.1](https://github.com/wso2/vscode-extensions/compare/ballerina-integrator-1.7.0...ballerina-5.8.1) - 2026-02-25 | ||||||||||||||||
|
|
||||||||||||||||
| ### Fixed | ||||||||||||||||
|
|
||||||||||||||||
| - **Installation** — Enhanced Windows environment detection to properly identify Ballerina distributions on Windows. | ||||||||||||||||
|
|
||||||||||||||||
|
Comment on lines
+9
to
+12
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Include security/dependency fixes in the 5.8.1 notes for completeness. The release notes for Line 9–Line 12 currently mention only the Windows installation fix, but this PR also includes security dependency updates. Please add a concise Security bullet under 5.8.1 so the changelog reflects the shipped changes. 📝 Suggested changelog patch ### Fixed
- **Installation** — Enhanced Windows environment detection to properly identify Ballerina distributions on Windows.
+- **Security** — Updated dependencies to address known vulnerabilities (including fast-xml-parser and bn.js related fixes).📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||
| ## [5.8.0](https://github.com/wso2/vscode-extensions/compare/ballerina-5.7.3...ballerina-integrator-1.7.0) - 2026-02-14 | ||||||||||||||||
|
|
||||||||||||||||
| ### Added | ||||||||||||||||
|
|
||||||||||||||||
|
|
||||||||||||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -1791,6 +1791,18 @@ export class BallerinaExtension { | |
| if (distPath) { break; } | ||
| } | ||
| } | ||
| } else if (isWindows() && !ballerinaHome) { | ||
| // On Windows, if syncEnvironment() already merged the User+Machine PATH the | ||
| // 'bal.bat version' call below will just work via PATH lookup (distPath stays | ||
| // empty). But for restricted environments (where even User | ||
| // PATH is locked, or where VSCode's inherited PATH is still stale), we run a | ||
| // proactive directory search here so that we can use an absolute path instead | ||
| // of relying on PATH resolution. | ||
| const detectedBinPath = findWindowsBallerinaPath(); | ||
| if (detectedBinPath) { | ||
| distPath = detectedBinPath; | ||
| debug(`[VERSION] Windows fallback search found Ballerina bin: ${distPath}`); | ||
| } | ||
|
Comment on lines
+1794
to
+1805
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Quote the absolute Windows Line 1803 can set 🐛 Proposed fix- let ballerinaCommand = distPath + 'bal' + exeExtension + ' version';
+ const balExecutable = `${distPath}bal${exeExtension}`;
+ const escapedBalExecutable = balExecutable.includes(' ')
+ ? `"${balExecutable}"`
+ : balExecutable;
+ let ballerinaCommand = `${escapedBalExecutable} version`;🤖 Prompt for AI Agents |
||
| } | ||
|
|
||
| let exeExtension = ""; | ||
|
|
@@ -2679,6 +2691,83 @@ function updateProcessEnv(newEnv: NodeJS.ProcessEnv): void { | |
| debug("[UPDATE_ENV] Process environment update completed"); | ||
| } | ||
|
|
||
| /** | ||
| * Searches for the Ballerina bin directory on Windows using two strategies: | ||
| * 1. Read the User-scope and Machine-scope PATH entries from the registry and look | ||
| * for a directory that contains bal.bat. | ||
| * 2. Check well-known installation directories (LOCALAPPDATA, ProgramFiles, etc.). | ||
| * | ||
| * Returns the bin directory path (with trailing separator) or an empty string when | ||
| * nothing is found. This is used as a last-resort fallback for environments where the | ||
| * process PATH was not updated (e.g. company laptops with restricted System PATH, or | ||
| * VS Code opened before the installer ran). | ||
| */ | ||
| function findWindowsBallerinaPath(): string { | ||
| debug('[WIN_BAL_FIND] Searching for Ballerina installation on Windows...'); | ||
|
|
||
| // --- Strategy 1: scan PATH entries from User + Machine registry scopes --- | ||
| try { | ||
| const psCommand = | ||
| '[Environment]::GetEnvironmentVariable(\'Path\',\'Machine\') + \';\' + ' + | ||
| '[Environment]::GetEnvironmentVariable(\'Path\',\'User\')'; | ||
| const rawPaths = execSync( | ||
| `powershell.exe -NoProfile -Command "${psCommand}"`, | ||
| { encoding: 'utf8', timeout: 10000 } | ||
| ).trim(); | ||
|
|
||
| debug(`[WIN_BAL_FIND] Registry PATH (Machine+User) length: ${rawPaths.length} chars`); | ||
|
|
||
| const pathEntries = rawPaths.split(';').map(p => p.trim()).filter(Boolean); | ||
| for (const entry of pathEntries) { | ||
| const candidate = path.join(entry, 'bal.bat'); | ||
| if (fs.existsSync(candidate)) { | ||
| debug(`[WIN_BAL_FIND] Found bal.bat in registry PATH entry: ${entry}`); | ||
| return entry + path.sep; | ||
| } | ||
| } | ||
| debug('[WIN_BAL_FIND] bal.bat not found in registry PATH entries'); | ||
| } catch (err) { | ||
| debug(`[WIN_BAL_FIND] Failed to read registry PATH: ${err}`); | ||
| } | ||
|
|
||
| // --- Strategy 2: check well-known Ballerina installation directories --- | ||
| const localAppData = process.env.LOCALAPPDATA || ''; | ||
| const programFiles = process.env.ProgramFiles || 'C:\\Program Files'; | ||
| const programFilesX86 = process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)'; | ||
|
|
||
| const searchRoots = [ | ||
| localAppData ? path.join(localAppData, 'Programs', 'Ballerina') : '', | ||
| path.join(programFiles, 'Ballerina'), | ||
| path.join(programFilesX86, 'Ballerina'), | ||
| 'C:\\Ballerina', | ||
| ].filter(Boolean); | ||
|
|
||
| for (const root of searchRoots) { | ||
| const directBin = path.join(root, 'bin'); | ||
| if (fs.existsSync(path.join(directBin, 'bal.bat'))) { | ||
| debug(`[WIN_BAL_FIND] Found bal.bat in common directory: ${directBin}`); | ||
| return directBin + path.sep; | ||
| } | ||
| // Handle versioned subdirectory layout, e.g. Ballerina\ballerina-2.x.x\bin | ||
| try { | ||
| const children = fs.readdirSync(root); | ||
| for (const child of children) { | ||
| const versionedBin = path.join(root, child, 'bin'); | ||
| if (fs.existsSync(path.join(versionedBin, 'bal.bat'))) { | ||
| debug(`[WIN_BAL_FIND] Found bal.bat in versioned directory: ${versionedBin}`); | ||
| return versionedBin + path.sep; | ||
| } | ||
|
Comment on lines
+2753
to
+2759
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Pick the newest versioned installation deterministically. Lines 2753-2759 iterate 🔧 Proposed fix- const children = fs.readdirSync(root);
+ const children = fs.readdirSync(root)
+ .sort((a, b) => b.localeCompare(a, undefined, { numeric: true, sensitivity: 'base' }));🤖 Prompt for AI Agents |
||
| } | ||
| } catch (err) { | ||
| // Directory doesn't exist or isn't readable — skip | ||
| debug(`[WIN_BAL_FIND] Failed to read directory "${root}" for versioned Ballerina installations: ${err}`); | ||
| } | ||
| } | ||
|
|
||
| debug('[WIN_BAL_FIND] Ballerina installation not found via fallback search'); | ||
| return ''; | ||
| } | ||
|
|
||
| function getShellEnvironment(): Promise<NodeJS.ProcessEnv> { | ||
| return new Promise((resolve, reject) => { | ||
| debug('[SHELL_ENV] Starting shell environment retrieval...'); | ||
|
|
@@ -2688,8 +2777,19 @@ function getShellEnvironment(): Promise<NodeJS.ProcessEnv> { | |
|
|
||
| if (isWindowsPlatform) { | ||
| debug('[SHELL_ENV] Windows platform detected'); | ||
| // Windows: use PowerShell to get environment | ||
| command = 'powershell.exe -Command "[Environment]::GetEnvironmentVariables(\'Process\') | ConvertTo-Json"'; | ||
| // Windows: read from registry (Machine + User scopes) so that paths added by | ||
| // a fresh Ballerina install (which goes to the User PATH registry key) are | ||
| // picked up even when VS Code's process was launched before the installation. | ||
| // We start with the current Process environment so that VS Code-internal | ||
| // variables are preserved, but we override Path with the merged registry value. | ||
| command = 'powershell.exe -NoProfile -Command "' + | ||
| '$e=[Environment]::GetEnvironmentVariables(\'Process\');' + | ||
| '$mp=[Environment]::GetEnvironmentVariable(\'Path\',\'Machine\');' + | ||
| '$up=[Environment]::GetEnvironmentVariable(\'Path\',\'User\');' + | ||
| 'if($mp -and $up){$e[\'Path\']=$mp+\';\'+$up}' + | ||
| 'elseif($mp){$e[\'Path\']=$mp}' + | ||
| 'elseif($up){$e[\'Path\']=$up};' + | ||
| '$e | ConvertTo-Json"'; | ||
| debug(`[SHELL_ENV] Windows command: ${command}`); | ||
| } else if (isWSL()) { | ||
| debug("[SHELL_ENV] Windows WSL platform, using non-interactive shell"); | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🌐 Web query:
fast-xml-parser version 5.3.7 npm release date published💡 Result:
fast-xml-parser@5.3.7does not appear to have been published to npm (no listing for 5.3.7 in public version indexes; the newest published version shown is 5.3.6). [1], [2]So there is no npm “published” date for 5.3.7. [1], [2]
Sources: [1] shows latest as 5.3.6 and lists recent versions; [2] also shows current version as 5.3.6.
🌐 Web query:
CVE-2026-25896 CVE-2026-26278 fast-xml-parser security advisory💡 Result:
fast-xml-parser security advisories (CVE-2026-25896, CVE-2026-26278)
CVE-2026-25896 — Entity encoding bypass → XSS/injection (Critical, CVSS 9.3)
.(dot) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, letting an attacker “shadow” built-in XML entities like<,>,&,",'with arbitrary strings—bypassing entity encoding and enabling XSS when output is rendered (and other injection risks depending on sinks). [1]fast-xml-parser>= 4.1.3 and <= 5.3.4. [1]CVE-2026-26278 — XML entity expansion DoS (High, CVSS 7.5)
fast-xml-parser>= 4.1.3 and <= 5.3.5. [2]processEntities: false. [2][3]Recommended action: If you might receive untrusted XML, upgrade at least to 5.3.6 (covers both: 5.3.5 fixes CVE-2026-25896; 5.3.6 fixes CVE-2026-26278). [1][2]
Sources
Citations:
🏁 Script executed:
Repository: wso2/vscode-extensions
Length of output: 881
CRITICAL: fast-xml-parser version 5.3.7 does not exist; update to 5.3.6 instead.
Version 5.3.7 is not published to npm (latest is 5.3.6). Both pinned versions at lines 44 and 95 must be corrected to
'5.3.6', which is the actual release that fixes both CVE-2026-25896 (entity encoding bypass/XSS, fixed in 5.3.5) and CVE-2026-26278 (entity expansion DoS, fixed in 5.3.6). The current pin to a non-existent version will not resolve the security vulnerabilities as intended.🤖 Prompt for AI Agents