We will disable command-links in the (deprecated) MarkedString and extension should use the new MarkdownString for command-links.

Background

When using markdown-formatted content, VS Code supports "links" that invoke a command, like so: [Hello](command:myExt.myCommand). This is a powerful feature but has a security concern: With a carefully crafted document and an extension that creates a markdown-string from that content users can be tricked into clicking on what appears to be a link but actually executed a command. Consider the following sample:

• I happen to know that you use an extension that includes potential dangers commands, e.g. running arbitrary commands in a shell
• I make you use my library file that contains a jsdoc-comment invoking such a command via a command-link
• While coding you get a hover saying "click here for more info" which in reality runs a command

To tackle this, we ask extensions to identify their markdown contents as trusted or not. E.g. TypeScript will say it don't trust markdown contents because it doesn't generate it, it just forwards. Other extensions, esp. those that generate command-links on purpose will mark their contents as trusted. To support that we have introduced a new type, MarkdownString. The MarkdownString can be used wherever the MarkedString can be used and when constructing it, you can say if you trust the contents, e.g.

// trusted
const md = new MarkdownString('[My Cool Feature](command:myTrustedContents)')
md.isTrusted = true;

// not trusted
new MarkdownString(forgeinContentsLikeJsDoc)