Attacking Language Server JSON RPC

While auditing a VSCode Extension + Language Server I noticed something interesting. This turned into the research question "can we attack the extension from the browser?". After a bit of preliminary research I decided to do it again on stream, and eventually made this video. This is how security research can look like.

What is a Server? https://www.youtube.com/watch?v=VXmvM2QtuMU
What is a Protocol? https://www.youtube.com/watch?v=d-zn-wv4Di8
GitLab 11.4.7 RCE https://www.youtube.com/watch?v=LrLJuyAdoAg

Live Stream: https://www.youtube.com/watch?v=jc7S6TtLK_c

My Font (advertisement): https://shop.liveoverflow.com/

Chapters:
00:00 - Why Security Research? …

attack auditing browser code extension json language question rce research rpc security security research server stream video vscode what is