Security: Multiple vulnerabilities found via Snyk Code Analysis (XSS, Path Traversal, ReDoS, Open Redirect)

[nickorlabs]

Summary

Snyk Code Analysis identified 65 issues across 92 analyzed files in code-server. The High severity findings affect production deployments.

High Severity (7 issues)

Cross-site Scripting (XSS) — CWE-79, Score 807

• src/node/routes/errors.ts line 56
• src/node/routes/login.ts lines 68, 119

User-controlled input may be rendered without proper HTML escaping in error and login responses.

Path Traversal — CWE-23, Score 804

• src/node/routes/vscode.ts lines 149, 219

User-supplied path components may allow reading files outside the intended directory.

Regular Expression Denial of Service (ReDoS) — CWE-400, Score 752

• src/node/routes/domainProxy.ts line 46

A regex pattern may cause catastrophic backtracking with crafted input.

Medium Severity (14 issues)

Open Redirect — CWE-601, Score 557

• src/node/routes/login.ts lines 62, 99
• src/node/routes/index.ts line 94

Allocation of Resources Without Limits — CWE-770, Score 555

• src/node/routes/errors.ts line 37
• src/node/routes/vscode.ts line 213

Information Exposure via X-Powered-By — CWE-200, Score 554

• src/node/app.ts line 70

Sensitive Cookie Without Secure/HttpOnly Flags — CWE-614/CWE-1004, Score 402

• src/node/routes/login.ts line 96

Low Severity (44 issues)

Primarily in test files (hardcoded passwords, cleartext HTTP). Not production concerns.

Reproduction

Scanned with Snyk Code Analysis on code-server main branch (commit near v4.112.0).

Suggested Fixes

• XSS: HTML-encode user input before rendering in error/login templates
• Path Traversal: Resolve and validate paths against intended root directory
• ReDoS: Simplify or replace the vulnerable regex pattern
• Open Redirect: Validate redirect URLs against an allowlist
• X-Powered-By: Disable with app.disable('x-powered-by')
• Cookie flags: Add Secure and HttpOnly to session cookies

Happy to submit PRs for any of these if the team confirms the approach.