Address code review: security, timeout, and error handling

Four fixes from code review:

1. Token exfiltration prevention: require wss:// (reject cleartext ws://)
   and restrict tunnel hosts to *.devtunnels.ms. The GitHub auth token
   is only sent to known-good tunnel domains.

2. Token no longer in DebugConfiguration: store the access token in an
   extension-private Map keyed by a one-time nonce. The nonce is placed
   in the configuration (readable by other extensions) but the token
   itself is consumed and deleted on first use in the factory. Other
   extensions can never read the token from session.configuration.

3. Connection timeout: add a 30s timeout to the WebSocket connect. If
   the handshake stalls (proxy, firewall, DNS), the socket is
   terminated and the promise rejects with a clear error.

4. ws.send() error handling: wrap send() in try/catch. On failure, fire
   a DAP terminated event and dispose the adapter so the debug session
   tears down cleanly instead of leaving the extension host in a bad
   state.

Co-authored-by: Copilot <[email protected]>

Author: rentziass

src/debugger/debugger.ts

@@ -7,6 +7,14 @@ import {WebSocketDapAdapter} from "./webSocketDapAdapter";
 /** The custom debug type registered in package.json contributes.debuggers. */
 export const DEBUG_TYPE = "github-actions-job";
 
+/**
+ * Extension-private store for auth tokens, keyed by a one-time session
+ * nonce. Tokens are never placed in DebugConfiguration (which is readable
+ * by other extensions via vscode.debug.activeDebugSession.configuration).
+ */
+const pendingTokens = new Map<string, string>();
+let nextNonce = 0;
+
 /**
  * Registers the Actions Job Debugger command and debug adapter factory.
  *
@@ -71,14 +79,17 @@ async function connectToDebugger(): Promise<void> {
     return;
   }
 
-  // 3. Launch the debug session. The factory will use the tunnel URL and token
-  //    from the configuration to create the websocket adapter.
+  // 3. Launch the debug session. The token is stored in extension-private
+  //    memory (not in the configuration) to avoid exposing it to other extensions.
+  const nonce = String(++nextNonce);
+  pendingTokens.set(nonce, session.accessToken);
+
   const config: vscode.DebugConfiguration = {
     type: DEBUG_TYPE,
     name: "Actions Job Debugger",
     request: "attach",
     tunnelUrl: validation.url,
-    __token: session.accessToken
+    __tokenNonce: nonce
   };
 
   log(`Starting debug session for ${validation.url}`);
@@ -96,7 +107,13 @@ class ActionsDebugAdapterFactory implements vscode.DebugAdapterDescriptorFactory
     session: vscode.DebugSession
   ): Promise<vscode.DebugAdapterDescriptor> {
     const tunnelUrl = session.configuration.tunnelUrl as string | undefined;
-    const token = session.configuration.__token as string | undefined;
+    const nonce = session.configuration.__tokenNonce as string | undefined;
+    const token = nonce ? pendingTokens.get(nonce) : undefined;
+
+    // Consume the token immediately so it cannot be replayed.
+    if (nonce) {
+      pendingTokens.delete(nonce);
+    }
 
     if (!tunnelUrl || !token) {
       throw new Error(

src/debugger/tunnelUrl.test.ts

@@ -1,39 +1,50 @@
 import {validateTunnelUrl} from "./tunnelUrl";
 
 describe("validateTunnelUrl", () => {
-  it("accepts a valid wss:// URL", () => {
+  it("accepts a valid wss:// devtunnels URL", () => {
     const result = validateTunnelUrl("wss://abcdef-4711.uks1.devtunnels.ms/");
     expect(result).toEqual({valid: true, url: "wss://abcdef-4711.uks1.devtunnels.ms/"});
   });
 
-  it("accepts a valid ws:// URL", () => {
-    const result = validateTunnelUrl("ws://abcdef-4711.uks1.devtunnels.ms/");
-    expect(result).toEqual({valid: true, url: "ws://abcdef-4711.uks1.devtunnels.ms/"});
-  });
-
-  it("accepts a URL without trailing slash", () => {
+  it("accepts a devtunnels URL without trailing slash", () => {
     const result = validateTunnelUrl("wss://abcdef-4711.uks1.devtunnels.ms");
     expect(result.valid).toBe(true);
   });
 
-  it("accepts a URL with a path", () => {
+  it("accepts a devtunnels URL with a path", () => {
     const result = validateTunnelUrl("wss://abcdef-4711.uks1.devtunnels.ms/connect");
     expect(result.valid).toBe(true);
   });
 
+  it("rejects ws:// (cleartext)", () => {
+    const result = validateTunnelUrl("ws://abcdef-4711.uks1.devtunnels.ms/");
+    expect(result.valid).toBe(false);
+    if (!result.valid) {
+      expect(result.reason).toContain("wss://");
+    }
+  });
+
   it("rejects http:// scheme", () => {
     const result = validateTunnelUrl("http://abcdef-4711.uks1.devtunnels.ms/");
     expect(result.valid).toBe(false);
     if (!result.valid) {
-      expect(result.reason).toContain("ws://");
+      expect(result.reason).toContain("wss://");
     }
   });
 
   it("rejects https:// scheme", () => {
     const result = validateTunnelUrl("https://abcdef-4711.uks1.devtunnels.ms/");
     expect(result.valid).toBe(false);
     if (!result.valid) {
-      expect(result.reason).toContain("ws://");
+      expect(result.reason).toContain("wss://");
+    }
+  });
+
+  it("rejects non-devtunnels host", () => {
+    const result = validateTunnelUrl("wss://evil.example.com/");
+    expect(result.valid).toBe(false);
+    if (!result.valid) {
+      expect(result.reason).toContain("not an allowed tunnel domain");
     }
   });
 

src/debugger/tunnelUrl.ts

@@ -1,11 +1,15 @@
+/**
+ * Allowed tunnel host patterns. The GitHub token is sent as a Bearer token
+ * to these hosts, so this list must be kept tight.
+ */
+const ALLOWED_TUNNEL_HOST_PATTERN = /\.devtunnels\.ms$/;
+
 /**
  * Validates a Dev Tunnel websocket URL for the Actions job debugger.
  *
- * Accepted formats:
- *   wss://xxxx-4711.region.devtunnels.ms/
- *   ws://xxxx-4711.region.devtunnels.ms/
- *
- * The URL must use a websocket scheme and include a non-empty host.
+ * Requirements:
+ *   - Must use wss:// (cleartext ws:// is rejected to protect the auth token)
+ *   - Host must match an allowed tunnel domain (*.devtunnels.ms)
  */
 export function validateTunnelUrl(raw: string): {valid: true; url: string} | {valid: false; reason: string} {
   let parsed: URL;
@@ -15,13 +19,17 @@ export function validateTunnelUrl(raw: string): {valid: true; url: string} | {va
     return {valid: false, reason: "Invalid URL format"};
   }
 
-  if (parsed.protocol !== "ws:" && parsed.protocol !== "wss:") {
-    return {valid: false, reason: `URL must use ws:// or wss:// scheme, got "${parsed.protocol.replace(":", "")}://"`};
+  if (parsed.protocol !== "wss:") {
+    return {valid: false, reason: `URL must use wss:// scheme, got "${parsed.protocol.replace(":", "")}://"`};
   }
 
-  if (!parsed.host) {
+  if (!parsed.hostname) {
     return {valid: false, reason: "URL must include a host"};
   }
 
+  if (!ALLOWED_TUNNEL_HOST_PATTERN.test(parsed.hostname)) {
+    return {valid: false, reason: `Host "${parsed.hostname}" is not an allowed tunnel domain`};
+  }
+
   return {valid: true, url: parsed.toString()};
 }

src/debugger/webSocketDapAdapter.ts

@@ -8,6 +8,9 @@ import {log, logDebug, logError} from "../log";
  */
 const PING_INTERVAL_MS = 25_000;
 
+/** Maximum time to wait for the websocket handshake to complete. */
+const CONNECT_TIMEOUT_MS = 30_000;
+
 /**
  * A VS Code inline debug adapter that speaks DAP over a websocket connection
  * to the Actions runner's Dev Tunnel endpoint.
@@ -49,13 +52,29 @@ export class WebSocketDapAdapter implements vscode.DebugAdapter {
     log(`Connecting to debugger tunnel: ${this._tunnelUrl}`);
 
     return new Promise<void>((resolve, reject) => {
+      let settled = false;
+
       const ws = new WebSocket(this._tunnelUrl, {
         headers: {
           Authorization: `Bearer ${this._token}`
         }
       });
 
+      const connectTimer = setTimeout(() => {
+        if (!settled) {
+          settled = true;
+          cleanup();
+          ws.terminate();
+          reject(new Error(`Connection timed out after ${CONNECT_TIMEOUT_MS / 1000}s`));
+        }
+      }, CONNECT_TIMEOUT_MS);
+
       const onOpen = () => {
+        if (settled) {
+          return;
+        }
+        settled = true;
+        clearTimeout(connectTimer);
         cleanup();
         log("Connected to debugger tunnel");
         this._ws = ws;
@@ -65,12 +84,22 @@ export class WebSocketDapAdapter implements vscode.DebugAdapter {
       };
 
       const onError = (err: Error) => {
+        if (settled) {
+          return;
+        }
+        settled = true;
+        clearTimeout(connectTimer);
         cleanup();
         logError(err, "Debugger tunnel connection error");
         reject(new Error(`Failed to connect to debugger tunnel: ${err.message}`));
       };
 
       const onClose = (code: number, reason: Buffer) => {
+        if (settled) {
+          return;
+        }
+        settled = true;
+        clearTimeout(connectTimer);
         cleanup();
         const reasonStr = reason.toString() || `code ${code}`;
         logError(new Error(reasonStr), "Debugger tunnel connection closed before open");
@@ -101,7 +130,14 @@ export class WebSocketDapAdapter implements vscode.DebugAdapter {
 
     const json = JSON.stringify(message);
     logDebug(`→ DAP: ${describeDapMessage(message)}`);
-    this._ws.send(json);
+
+    try {
+      this._ws.send(json);
+    } catch (e) {
+      logError(e as Error, "Debugger tunnel send threw");
+      this._fireTerminated();
+      this.dispose();
+    }
   }
 
   dispose(): void {
@@ -187,12 +223,7 @@ export class WebSocketDapAdapter implements vscode.DebugAdapter {
       const reasonStr = reason.toString() || `code ${code}`;
       log(`Debugger tunnel closed: ${reasonStr}`);
       this._stopPingLoop();
-      // Fire a terminated event so VS Code knows the session is over.
-      this._onDidSendMessage.fire({
-        type: "event",
-        event: "terminated",
-        seq: 0
-      } as unknown as vscode.DebugProtocolMessage);
+      this._fireTerminated();
     });
 
     ws.on("error", (err: Error) => {
@@ -216,6 +247,15 @@ export class WebSocketDapAdapter implements vscode.DebugAdapter {
       this._pingTimer = undefined;
     }
   }
+
+  /** Notify VS Code that the debug session is over. */
+  private _fireTerminated(): void {
+    this._onDidSendMessage.fire({
+      type: "event",
+      event: "terminated",
+      seq: 0
+    } as unknown as vscode.DebugProtocolMessage);
+  }
 }
 
 // ── helpers ──────────────────────────────────────────────────────────