Update to latest Electron 1.7.x

[zyxneo]

Please update Electron version whenever new release with a fix is available. The reason for that is:

Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node integration AND has not specified if webview is enabled/disabled. This vulnerability appears to have been fixed in 1.7.13, 1.8.4, 2.0.0-beta.4.

As far I understand, the current version is 1.7.12
https://github.com/Microsoft/vscode/blob/master/.yarnrc

more info:
https://www.trustwave.com/Resources/SpiderLabs-Blog/CVE-2018-1000136---Electron-nodeIntegration-Bypass/

Many thanks in advice!

[vscodebot]

(Experimental duplicate detection)
Thanks for submitting this issue. Please also check if it is already covered by an existing one, like:

• update to electron 1.7.12 (#45953)

[bpasero]

We should ideally wait for 1.7.15 to be released that includes electron/electron#12808

[Tyriar]

I don't think we're impacted by this, @mjbvz?

[mjbvz]

No I wasn't able to exploit it using a custom webview extension that has no csp and enables scripts. I believe we also block mounting unknown webviews if there happened to be an html injection in the main product

[zyxneo]

@mjbvz Many thanks for investigating it!

[bpasero]

I think we will probably just go to 2.0.x directly. Closing as duplicate of #45542