GIANT SECURITY HOLE: Settings Sync captures contents of open files and its history

🐛 Describe the bug
A clear and concise description of what the bug is. You are always welcome to check the Troubleshooting section before filing the ticket.

🌴 Visual Studio Code Version : v1.66.2 🌴 Code Settings Sync Version : v3.4.3 🌴 Standard or Insiders : Standard 🌴 Portable or Installed : Installed 🌴 OSS or Official Build : Official 🌴 Operating System :
🌴 Occurs On: Upload 🌴 Proxy Enabled: No 🌴 Gist Id:

An automated sync uploaded the contents of a git ignored tab which contained secrets to a public gist.

Previously settings sync only uploaded extension list, vscode settings, keybindings. But it seems it now captures UI state including the contents of open tabs. This is a huge security hole.

The files are named History|-46774cc7|entries.json, History|-46774cc7|entries.json e.t.c

It seems this plugin is capturing not only the current open tabs but also the undo history of the file. The gist is massive and contains so much sensitive information.

Please fix this.

📰 To Reproduce Steps to reproduce the behavior:

1. Open a file with secrets.
2. Upload to settings. The contents of file will be synced to public gist.

💪 Expected behavior Only sync settings. Not the files users have open in VSCode.

📺 Additional context

[Diogo-Rossi]

This could solve:

    "ignoreUploadFolders": [
        "sync",
        "workspaceStorage",
        "History"
    ],

[maxweisspoker]

For those who can read and are able to use the search functionality: browse the repo issues, that is NOT a “giant security hole”. Please update the title, as it is misleading or at least do a little research beforehand.

#1341

Uploading user files is absolutely a giant security hole. It’s not Settings Sync’s fault, but it’s definitely a security problem that needs to be address in the next update.