diff --git a/webview-sample/media/main.js b/webview-sample/media/main.js
index 68233df8..91b308f1 100644
--- a/webview-sample/media/main.js
+++ b/webview-sample/media/main.js
@@ -1,30 +1,33 @@
// This script will be run within the webview itself
-// It cannot access VS Code apis directly.
+// It cannot access the main VS Code APIs directly.
+(function () {
+ const vscode = acquireVsCodeApi();
-const counter = document.getElementById('lines-of-code-counter');
+ const counter = document.getElementById('lines-of-code-counter');
-let currentCount = 0;
+ let currentCount = 0;
-setInterval(() => {
- counter.textContent = currentCount++;
+ setInterval(() => {
+ counter.textContent = currentCount++;
- // Alert the extension when the cat introduces a bug
- if (Math.random() < Math.min(0.001 * currentCount, 0.05)) {
- // Send a message back to the extension
- window.parent.postMessage({
- command: 'alert', text: '🐛 on line ' + currentCount },
- '*')
- }
-}, 100);
+ // Alert the extension when the cat introduces a bug
+ if (Math.random() < Math.min(0.001 * currentCount, 0.05)) {
+ // Send a message back to the extension
+ vscode.postMessage({
+ command: 'alert',
+ text: '🐛 on line ' + currentCount
+ });
+ }
+ }, 100);
-// Handle messages sent from the extension to the webview inside the webview
-window.addEventListener('message', event => {
- const message = event.data; // The json data the extension sent
- switch (message.command)
- {
- case 'refactor':
- currentCount = Math.ceil(currentCount * 0.5);
- counter.textContent = currentCount;
- break;
- }
-});
\ No newline at end of file
+ // Handle messages sent from the extension to the webview inside the webview
+ window.addEventListener('message', event => {
+ const message = event.data; // The json data the extension sent
+ switch (message.command) {
+ case 'refactor':
+ currentCount = Math.ceil(currentCount * 0.5);
+ counter.textContent = currentCount;
+ break;
+ }
+ });
+}());
\ No newline at end of file
diff --git a/webview-sample/src/extension.ts b/webview-sample/src/extension.ts
index db070a3f..8107c39c 100644
--- a/webview-sample/src/extension.ts
+++ b/webview-sample/src/extension.ts
@@ -1,5 +1,5 @@
-import * as vscode from 'vscode';
import * as path from 'path';
+import * as vscode from 'vscode';
const cats = {
'Coding Cat': 'https://media.giphy.com/media/JIX9t2j0ZTN9S/giphy.gif',
@@ -136,13 +136,19 @@ class CatCodingPanel {
// And the uri we use to load this script in the webview
const scriptUri = scriptPathOnDisk.with({ scheme: 'vscode-resource' });
+ // Use a nonce to whitelist which scripts can be run
+ const nonce = getNonce();
+
return `
-
-
+
+
Cat Coding
@@ -151,8 +157,17 @@ class CatCodingPanel {
0
-
+
`;
}
+}
+
+function getNonce() {
+ let text = "";
+ const possible = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+ for (let i = 0; i < 32; i++) {
+ text += possible.charAt(Math.floor(Math.random() * possible.length));
+ }
+ return text;
}
\ No newline at end of file