Adopt VS Code's 'asWebviewUri' API

[mjbvz]

Hi, I maintain VS Code's Webview API

Issue

Our telemetry suggests that your extension uses webviews and may be loading resources in these webviews using hardcoded vscode-resource: URIs. These URIs have some important limitations and don't work properly when VS Code is run in a browser. We are also making changes in the desktop version of VS Code that may cause these URIs to not work properly in future versions of VS Code.

While we are making our best effort to continue support existing webview extensions that use vscode-resource: URIs on desktop versions of VS Code, we will not able to fully support all uses cases.

Fix

To ensure that your extension continues to work in as many environments as possible—including on web and remotely—please:

• Switch to use the Webview.asWebviewUri function for loading resources.

• Switch to use the Webview.cspSource property in content security policies.

These APIs shipped around 2 years ago so they should be available in all modern versions of VS Code. You can find additional information about the issue here: microsoft/vscode#97962

Let me know if you have any questions about this change

[rchiodo]

@mjbvz is this just a general ask or did you have a specific reason to ask us to do this? We should already be using asWebviewUri everywhere.

Perhaps there's somewhere not so obvious when looking at our code but you have some logging to indicate we are not using asWebviewUri?

[rchiodo]

The only place vscode-resource is mentioned in the code should be in our cspSource declaration.

See here:
https://github.com/microsoft/vscode-python/blob/5d13fa2bd948fd0949d5a12c571045bf698f7253/src/client/common/application/webPanels/webPanel.ts#L166

[mjbvz]

Our telemetry showed the python extension was webview-resource somewhere. You'll need to update the csp as describe to use Webview.cspSource

[IanMatthewHuff]

@rchiodo I still see a vscode-resource: in two csps. But it looks like it's in webPanel.ts and webPanelServer.ts and in webPanel.ts it's only in the path for generateServerReactHTML. That path was just for the web server idea that we abandoned? Maybe we should pull that code out at this point. I can open an issue if needed for that.

[rchiodo]

Yeah it's not in any code the runs for a user. WebPanelServer can't use cspSource because it doesn't create a webview. But the server react code can (or should be removed).

[IanMatthewHuff]

Created microsoft/vscode-python#12140 for removing the old code. And validating this one.