Guard against infinite redirections in downloadFileFromUrl with redirect counter

[Copilot]

The downloadFileFromUrl function in vscode/npm-package/install.ts was vulnerable to infinite redirect loops, which could cause memory exhaustion, CPU exhaustion, and potential denial-of-service attacks. The function recursively followed HTTP redirects without any limit, making it susceptible to redirect loops.

Changes Made

Core Fix

• Added maxRedirects parameter with a default value of 10 to limit the number of redirects
• Added redirectCount parameter to track the current number of redirects in the chain
• Added validation to reject requests when the redirect limit is exceeded
• Enhanced error handling for both network errors and file system errors

Before

function downloadFileFromUrl(url: string, destinationPath: string): Promise<void> {
  return new Promise((resolve) => {
    https.get(url, (response: any) => {
      if (response.statusCode && response.statusCode >= 300 && response.statusCode < 400 && response.headers.location) {
        resolve(downloadFileFromUrl(response.headers.location, destinationPath));
      } else {
        // ... file writing logic
      }
    });
  });
}

After

function downloadFileFromUrl(url: string, destinationPath: string, maxRedirects: number = 10, redirectCount: number = 0): Promise<void> {
  return new Promise((resolve, reject) => {
    https.get(url, (response: any) => {
      if (response.statusCode && response.statusCode >= 300 && response.statusCode < 400 && response.headers.location) {
        if (redirectCount >= maxRedirects) {
          reject(new Error(`Too many redirects. Maximum of ${maxRedirects} redirects allowed.`));
          return;
        }
        resolve(downloadFileFromUrl(response.headers.location, destinationPath, maxRedirects, redirectCount + 1));
      } else {
        // ... file writing logic with error handling
      }
    }).on('error', (error: Error) => {
      reject(error);
    });
  });
}

Protection Against

• Infinite redirect loops: Prevents stack overflow and memory exhaustion
• CPU exhaustion: Limits computational resources consumed by redirect chains
• Denial-of-service attacks: Protects against malicious servers that return redirect loops

Backward Compatibility

• Existing code continues to work unchanged due to default parameter values
• The change is completely transparent to existing callers

Testing

• Added comprehensive unit tests to verify redirect limit enforcement
• Tests cover successful downloads, limited redirects, and infinite redirect scenarios
• Build passes with no TypeScript compilation errors
• Linting passes with no new style issues

Fixes #6293.

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.