Display error message when running kernels from untrusted locations (#11624)

* Display error message when running kernels from untrusted locations

* Update change log and version

Author: DonJayamanne

CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 2022.9.120 (11 October 2022)
+### Enhancements
+1. Display an error message (with instructions to resolve the issue) in the cell output when attempting to run a cell against a kernel from an untrusted location.
+   ([#11622](https://github.com/Microsoft/vscode-jupyter/issues/11622))
+
+### Thanks
+
+Thanks to the following projects which we fully rely on to provide some of
+our features:
+
+-   [Python Extension](https://marketplace.visualstudio.com/items?itemName=ms-python.python)
+-   [debugpy](https://pypi.org/project/debugpy/)
+
+Also thanks to the various projects we provide integrations with which help
+make this extension useful:
+
+-   [Jupyter](https://jupyter.org/):
+    [Notebooks](https://jupyter-notebook.readthedocs.io/en/latest/?badge=latest),
+    [JupyterHub](https://jupyterhub.readthedocs.io/en/stable/),
+    [ipywidgets](https://ipywidgets.readthedocs.io/en/latest/),
+    [nbconvert](https://nbconvert.readthedocs.io/en/latest/)
+
 ## 2022.9.110 (11 October 2022)
 ### Fixes
 1. Fixed vulnerability described in [CVE-2022-41083](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41083)

build/azure-pipeline.stable.yml

@@ -39,8 +39,8 @@ extends:
       - script: python -m pip --disable-pip-version-check install -t ./pythonFiles/lib/python --no-cache-dir --implementation py --no-deps --upgrade -r ./requirements.txt
         displayName: Install Python libs
 
-    #   - script: npm run updateBuildNumber
-    #     displayName: Update build number
+      - script: npm run updateBuildNumber
+        displayName: Update build number
 
       - script: npm run prePublishBundleStable
         displayName: Build

package-lock.json

@@ -1,7 +1,7 @@
 {
     "name": "jupyter",
     "displayName": "Jupyter",
-    "version": "2022.9.1100000000",
+    "version": "2022.9.120",
     "description": "Jupyter notebook support, interactive programming and computing that supports Intellisense, debugging and more.",
     "publisher": "ms-toolsai",
     "author": {

package.json

@@ -844,8 +844,7 @@
         "message": "Failed to interrupt the Kernel.",
         "comment": ["{Locked='Kernel'}"]
     },
-    "DataScience.updateSettingToTrustKernelSpecs": "Update setting to trust kernels",
-    "DataScience.untrustedKernelSpecsHidden": "Kernels found in an insecure location have not been loaded.",
+    "DataScience.failedToStartAnUntrustedKernelSpec": "The kernel '{0}' was not started as it is located in an insecure location '{1}'.  \nClick [here](https://aka.ms/JupyterTrustedKernelPaths) for further details, optionally update the setting [jupyter.kernels.trusted](command:workbench.action.openSettings?[\"jupyter.kernels.trusted\"]) to trust the kernel.",
     "jupyter.configuration.jupyter.kernels.trusted.markdownDescription": "Enter fully qualified paths to Kernel specification files that are to be trusted. E.g. 'C:\\Program Data\\Jupyter\\kernels\\python3\\kernel.json'.  \n**Note**: Kernels can execute code with user privileges. Click [here](https://aka.ms/JupyterTrustedKernelPaths) for further details.",
     "DataScience.kernelDied": {
         "message": "The kernel died. View Jupyter [log](command:jupyter.viewOutput) for further details. \nError: {0}...",

package.nls.json

@@ -41,6 +41,7 @@ import { buildSourceMap } from '../helper';
 import { noop } from '../../../platform/common/utils/misc';
 import { IInteractiveWindowDebuggingManager } from '../../types';
 import { IControllerLoader, IControllerSelection } from '../../../notebooks/controllers/types';
+import { IServiceContainer } from '../../../platform/ioc/types';
 
 /**
  * The DebuggingManager maintains the mapping between notebook documents and debug sessions.
@@ -61,9 +62,18 @@ export class InteractiveWindowDebuggingManager
         @inject(IDebugLocationTrackerFactory)
         private readonly debugLocationTrackerFactory: IDebugLocationTrackerFactory,
         @inject(IConfigurationService) private readonly configService: IConfigurationService,
-        @inject(IDebugService) private readonly debugService: IDebugService
+        @inject(IDebugService) private readonly debugService: IDebugService,
+        @inject(IServiceContainer) serviceContainer: IServiceContainer
     ) {
-        super(kernelProvider, controllerLoader, controllerSelection, commandManager, appShell, vscNotebook);
+        super(
+            kernelProvider,
+            controllerLoader,
+            controllerSelection,
+            commandManager,
+            appShell,
+            vscNotebook,
+            serviceContainer
+        );
     }
 
     public override async activate(): Promise<void> {

src/interactive-window/debugger/jupyter/debuggingManager.ts

@@ -453,12 +453,21 @@ function getUserFriendlyErrorMessage(error: Error | string, errorContext?: Kerne
         return getCombinedErrorMessage(errorPrefix, errorMessage);
     }
 }
+function doesErrorHaveMarkdownLinks(message: string) {
+    const markdownLinks = new RegExp(/\[([^\[]+)\]\((.*)\)/);
+    return (markdownLinks.exec(message)?.length ?? 0) > 0;
+}
 function getCombinedErrorMessage(prefix?: string, message?: string) {
     const errorMessage = [prefix || '', message || '']
         .map((line) => line.trim())
         .filter((line) => line.length > 0)
         .join(' \n');
-    if (errorMessage.length && errorMessage.indexOf('command:jupyter.viewOutput') === -1) {
+
+    if (
+        !doesErrorHaveMarkdownLinks(errorMessage) &&
+        errorMessage.length &&
+        errorMessage.indexOf('command:jupyter.viewOutput') === -1
+    ) {
         return `${
             errorMessage.endsWith('.') ? errorMessage : errorMessage + '.'
         } \n${DataScience.viewJupyterLogForFurtherInfo()}`;

src/kernels/errors/kernelErrorHandler.ts

@@ -0,0 +1,27 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+import { Uri } from 'vscode';
+import { getDisplayPath } from '../../platform/common/platform/fs-paths';
+import { DataScience } from '../../platform/common/utils/localize';
+import { getDisplayNameOrNameOfKernelConnection } from '../helpers';
+import { LocalKernelConnectionMetadata } from '../types';
+import { WrappedKernelError } from './types';
+
+/**
+ * Thrown when we attempt to start a kernel that is not trusted.
+ */
+export class KernelSpecNotTrustedError extends WrappedKernelError {
+    constructor(kernelConnectionMetadata: LocalKernelConnectionMetadata) {
+        super(
+            DataScience.failedToStartAnUntrustedKernelSpec().format(
+                getDisplayNameOrNameOfKernelConnection(kernelConnectionMetadata),
+                kernelConnectionMetadata.kernelSpec.specFile
+                    ? getDisplayPath(Uri.file(kernelConnectionMetadata.kernelSpec.specFile))
+                    : ''
+            ),
+            undefined,
+            kernelConnectionMetadata
+        );
+    }
+}

src/kernels/errors/kernelSpecNotTrustedError.ts

@@ -303,8 +303,8 @@ export class JupyterPaths {
                 paths.add(winPath);
             }
 
-            if (process.env.ALLUSERSPROFILE) {
-                paths.add(Uri.file(path.join(process.env.ALLUSERSPROFILE, 'jupyter', 'kernels')));
+            if (process.env.PROGRAMDATA) {
+                paths.add(Uri.file(path.join(process.env.PROGRAMDATA, 'jupyter', 'kernels')));
             }
         } else {
             // Unix based