SECURITY: Brainstorming and Tracker to prevent getting pwned

[Mupu]

Currently, simply opening a project can get you compromised, as the LSP will run all #run in the code base.

To prevent such a case or at least reduce the risk of that happening, I was thinking of the following:

• Include a disclaimer in the description of the Jails as well as in the VS Code Extension description.

VSCODE:

• When in Trusted Mode, we want to do everything we currently do
• Basic information: https://code.visualstudio.com/api/extension-guides/workspace-trust
• While in Untrusted Mode, we would ideally want: 1) still get code highlighting, 2) still have basic code navigation, 3) prevent the compilation of the program completely.

Other editors (nvim, etc.):
The bigger question is can we do something about other editors, that we don't support?
One solution would be to do something like nvim, where the LSP keeps a trust store of what files to trust. But since it's the LSP it would not be that usable, since it can not offer any Popup to make managing it simple. Maybe we don't have any good solution for this case.

• Maybe we could at least let the client enable/disable the functionaity by letting the client specify it via the capabilities as a best effort solution for the unsupported editors.

Feed back would be appreciated!

[constantitus]

Not sure I'm the first one to come up with this idea, but a way to handle this would be to have a way to tell the compiler not to run any compile-time code in the workspace, but ideally, typecheck as much as it can so the lsp can at least get some data to work with. That way it could run in any untrusted workspace (directory) without the need for a configuration file.
This still doesn't solve the issue of "how do you tell the lsp to trust the workspace in an editor that is not vscode" though since a configuration file could be already come with the untrusted code.