Add option for disabling file downloads

[code-asher]

Being able to easily download might be an issue in some situations. See some comments on #1386.

Maybe it also makes sense to prevent the HTTP server from serving these files as well so you can't just curl them.

[JammSpread]

If I'm correct we just have to patch this with if statements on lines 228 225 and 488 485?

[code-asher]

That looks right to me! We may also want to modify the HTTP static endpoint that lets you access files outside the code-server directory.

[bpmct]

I confirmed two sections mentioned above will disable the download option :)

I was also able to modify the static endpoint, I believe we'll want to use something similar to this check to ensure the user can't curl or visit the page for these static files. For curl in particular, we can do

if (req.headers["user-agent"] && req.headers["user-agent"].includes("curl")) {
    throw new HttpError("Unauthorized", HttpCode.Unauthorized)
}

but I assume there is probably a better way to whitelist requests from code-server? Any ideas what headers we should be looking for?

Also, I've added the flag --disable-download in the CLI but am unsure how to check for that in fileActions.contribution.ts.

[lsc196]

How to ban downloading files now？

[JammSpread]

Also, I've added the flag --disable-download in the CLI but am unsure how to check for that in fileActions.contribution.ts.

I think an easy way for you to check for --disable-download might be by passing the flag as an environment variable.

[bpmct]

Yeah, I'd love to do it as both (code-server handles most options like this), but I haven't been able to find an example of it implemented somewhere like fileActions

[code-asher]

We'll need to add the option to the the Args interface in ipc.d.ts. That'll let us use `options.args["disable-download"]` in `lib/vscode/src/vs/server/node/server.ts`. In that file we can add the disable download option to the workbench web configuration (including to the interface) so it gets to the browser in the same way as the home indicator option. From there I think it'd make the most sense to use a context key to enable/disable the download options. We can add and export a context key in `lib/vscode/src/vs/workbench/browser/contextkeys.ts`. We should be able access the value of the flag we passed via the workbench web configuration with `environmentService.options["disable-download"]`.

[metalshanked]

@jsjoeio Will there be an option to disable file uploads as well ? Example:- To disable people uploading their own .vsix file and installing them manually.

[jsjoeio]

I think we could definitely consider it!

If it's a global thing, like download scenario, then it might be possible to implement here as well.

To disable people uploading their own .vsix file and installing them manually.

For that specific use case, we could potentially add that.

It might help if you could expand on your use case (then we can see if it fits in this issue or should be a separate issue).

[metalshanked]

I think we could definitely consider it!

If it's a global thing, like download scenario, then it might be possible to implement here as well.

To disable people uploading their own .vsix file and installing them manually.

For that specific use case, we could potentially add that.

It might help if you could expand on your use case (then we can see if it fits in this issue or should be a separate issue).

Thanks @jsjoeio. Yes, a global disable upload option would be awesome. The use case is similar to the original requester's disable download request. For Eg:- use cases where we want to disable certain users from uploading files to the code-server (running on Docker) so that they can only operate on the files and items preloaded into the container and nothing external can be uploaded (or downloaded)

[jsjoeio]

Ahh okay. Thank you for elaborating! Sounds very similar in which case we can keep here in this issue :)

[songhanpoo]

Hi everyone, currently can i use these options ?
Do i need compile from src ?

[code-asher]

No, these have not been implemented yet.

[belief-cyf]

Looking forward to this feature

[songhanpoo]

Looking forward to this feature which is can be use for external developer. intergrate LDAP login and code on web. no leak code.

hopeful anyone improve about that

[greyscaled]

[sc-16496]

[jsjoeio]

Thanks to @iamdineshkumar for linking this:

https://github.com/microsoft/vscode/blob/6fa3243d3facbbf8b87222bcf4e81c5eddf5d47f/src/vs/workbench/contrib/files/browser/fileActions.contribution.ts#L472

[jsjoeio]

Seems like all we need to do is:

1. create new context key like: ContextKeyExpr.and(IsWebContext, HasDownloadFileEnabled)
2. write expression that returns true by default, or false if CLI flag --disable-file-downloads or something

Might be worth looking into writing e2e tests.

Without CLI flag, should show Download File in menu.
WIth CLI flag, should not show Download File in menu.