Fix URI scheme validation for components from untrusted sources (IPC)

src/vs/base/common/uri.ts

@@ -162,9 +162,10 @@ export class URI implements UriComponents {
 			this.path = schemeOrData.path || _empty;
 			this.query = schemeOrData.query || _empty;
 			this.fragment = schemeOrData.fragment || _empty;
-			// no validation because it's this URI
-			// that creates uri components.
-			// _validateUri(this);
+			// Validate when constructing from components. While internal code that creates
+			// uri components should be correct, components may come from untrusted sources
+			// (e.g., IPC) and need validation to prevent errors.
+			_validateUri(this);
 		} else {
 			this.scheme = _schemeFix(schemeOrData, _strict);
 			this.authority = authority || _empty;

src/vs/base/test/common/uri.test.ts

@@ -645,5 +645,61 @@ suite('URI', () => {
 		}
 	});
 
+	test('URI.revive should validate scheme from untrusted components', () => {
+		// Test that URI.revive throws an error when scheme contains illegal characters
+		const invalidComponents = {
+			scheme: 'invalid scheme',  // space is illegal in scheme
+			authority: 'example.com',
+			path: '/path',
+			query: '',
+			fragment: ''
+		};
+
+		assert.throws(() => {
+			URI.revive(invalidComponents);
+		}, /Scheme contains illegal characters/);
+	});
+
+	test('URI.revive should validate various invalid schemes', () => {
+		const invalidSchemes = [
+			'invalid scheme',  // contains space
+			'invalid@scheme',  // contains @
+			'invalid/scheme',  // contains /
+			'invalid:scheme',  // contains :
+			'invalid#scheme',  // contains #
+			'123invalid',      // starts with digit
+			'+invalid',        // starts with +
+			'-invalid',        // starts with -
+			'.invalid',        // starts with .
+		];
+
+		for (const scheme of invalidSchemes) {
+			assert.throws(() => {
+				URI.revive({ scheme, authority: '', path: '', query: '', fragment: '' });
+			}, /Scheme contains illegal characters/, `Should throw for scheme: ${scheme}`);
+		}
+	});
+
+	test('URI.revive should allow valid schemes', () => {
+		const validSchemes = [
+			'file',
+			'http',
+			'https',
+			'ftp',
+			'myscheme',
+			'my-scheme',
+			'my.scheme',
+			'my+scheme',
+			'a123',
+			'MyScheme',
+		];
+
+		for (const scheme of validSchemes) {
+			assert.doesNotThrow(() => {
+				URI.revive({ scheme, authority: '', path: '', query: '', fragment: '' });
+			}, `Should not throw for valid scheme: ${scheme}`);
+		}
+	});
+
 
 });