What is Workspace Trust in Visual Studio Code?
Visual Studio Code v1.57 launched in May 2021 with a new Workspace Trust feature. This is a security mechanism which helps you avoid accidental code execution when you cant trust a repositorys origins. Workspace Trust is active by default. When you open a new folder, Code will display a dialog asking you to trust the files within. If you say yes, the editor will function normally. If you press no, Code will enter a new restricted mode with reduced functionality. Restricted Mode is meant to prevent untrusted code from running. Visual Studio features which execute files will be disabled to help protect you against threats youve not fully vetted. Debugging features are turned off, preventing you from accidentally launching a downloaded executable. Visual Studio will also disable tasks defined in the workspace file. Tasks in a .vscode file can run binaries and scripts, so a repo containing one is a security risk. Any user extensions which could run code will be disabled or placed into a limited functionality state. Some workspace settings might be overridden too, to limit the reach of downloaded .vscode files. Advertisement    Using Restricted Mode lets you inspect critical portions of a newly downloaded project. You get an opportunity to verify theres no suspect behaviors, without risking actual code execution. Once you exit Restricted Mode, your regular settings will be applied and debugging will be reactivated. When Workspace Trust is enabled, youll see a prompt each time you open a new folder in an untrusted location. Youll need to choose whether to enable all features or open the workspace in Restricted Mode. Visual Studio Code has evolved into a powerful code editor with support for thousands of extensions. Many of these third-party tools run automatically and add themselves into your workspace settings file. This file is often committed to source control so it can be shared with team members. Its conceivable that a crafty bad actor could create a repository that looks genuine but which runs malicious code when its loaded into the editor. Workspace Trust is a response to this possibility. It gives you greater safety when youre inspecting open-source software and other code received from third parties. Disabling Workspace Trust  Workspace Trust helps you avoid potentially dangerous unintended code executions. Using the feature gives you an extra defense layer against unfamiliar repositories. Nonetheless, you might find the prompts annoying if you regularly consume code from new sources. You can disable Workspace Trust entirely by setting the security.workspace.trust.enabled setting to false . You can find this in the UI by clicking File > Preferences > Settings and searching for workspace trust. The checkbox will show up as Security > Workspace > Trust: Enabled. If you only want a one-time launch without Workspace Trust, add the --disable-workspace-trust command line flag. Customizing Workspace Trust  Workspace Trust offers a few settings to let you fine-tune its behavior. Use the procedure described above to view the Workspace Trust settings in the UI. Advertisement    Empty Window controls what happens when youre using a window with no open folders. When the checkbox is filled, the window will be treated as trusted by default. Otherwise, youll need to manually trust it like a regular folder. The Untrusted Files setting defines what happens if you File > Open a file from an untrusted location while in a trusted window. The default behavior is to prompt before continuing. You can change this to always open the file or force it into a new window thats automatically untrusted. Another setting lets you override how extensions respond to Workspace Trust. This must be set manually in your settings.json file. Add an extensions.supportUntrustedWorkspaces key with a JSON object as its value. Add extension IDs as keys in this object. Each extension can have true , limited or false as its value. { "extensions": { "supportUntrustedWorkspaces": { "my-extension": true } } }  An extension listed as true will always be enabled, even in an untrusted workspace. Extensions with false will only load in trusted workspaces. limited extensions will be added to untrusted workspaces but with trusted functionality disabled. You wont be able to use tasks provided by these extensions. Managing Trusted Folders  You can view and manage folders youve marked as trusted from within Visual Studio Code. Press Ctrl+Shift+P to bring up the Command Palette. Search for workspace trust and select the Workspaces: Manage Workspace Trust item from the menu. Advertisement    This screen shows the trust status of your current window. You can switch to Restricted Mode by pressing Dont Trust. Alternatively, press the Trust button to enable all features if youre currently in a restricted state. The Trusted Folders & Workspaces section enumerates all the directories which youve marked as trusted. You can revoke a locations trust by clicking it and pressing the delete X button on the right. Trust is inherited by all sub-directories. Trusting a top-level folder such as /home/me/projects will mean all your repositories are automatically trusted. This compromises the effectiveness of the Workspace Trust system. Conclusion  Workspace Trust is a promising new security protection for Visual Studio Code users. The dangers of unintentional code execution by IDEs are only just starting to gain visibility. While some might find trust prompts frustrating, they could help protect your machine from dangerous sources.