CVE Detection on VSCode Extension #6112
Replies: 4 comments 5 replies
-
|
Hello @raghur-orca We check dependency files to detect installed dependencies, but we don't check/compare code of these dependencies/packages.
Looks like there are some vscode npm packages (e.g. https://www.npmjs.com/package/vscode-uri). In this case false positive is better (you can just filter or skip these files. |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for the update, @DmitriyLewen . |
Beta Was this translation helpful? Give feedback.
-
|
Unfortunately, I only see indirect solutions to avoid this case. Up to this point I haven't seen any other false positive issues for VScode. |
Beta Was this translation helpful? Give feedback.
-
|
Sure!. |
Beta Was this translation helpful? Give feedback.
-
|
Definitely interested as we have a large compliance department that keeps asking us about this. It there something the code-server / vs-code team could do to address the issue on their end? |
Beta Was this translation helpful? Give feedback.
-
|
Hello @mjschmidt Is this special custom field only for vs-code extensions? |
Beta Was this translation helpful? Give feedback.
-
|
I'm interested in a fix for this as well |
Beta Was this translation helpful? Give feedback.
-
|
just to confirm, is this limited to vscode extensions or applies to any node package? I mean, if I'm scanning my code repo which has a package.json and my package is called "handlebars", I should expect to see vulnerabilities in the handlebars package in npm? |
Beta Was this translation helpful? Give feedback.
-
|
IIUC This is only related to vs-code extensions. vs-code contains package.json file that is not associated with npm package of the same name and does not use code from that npm package.
if you scan npm project - you should see vulnerabilities for this package. |
Beta Was this translation helpful? Give feedback.
-
IDs
CVE-2019-19919, CVE-2021-23369, CVE-2021-23383, CVE-2019-20920
Description
CVE detection on vscode extensions eventhough it is neither linked with the npm package nor contain any code from npm package.
While working on a project, i have used vscode extension (handlebars) on my IDE.
As Trivy considers and scans the
package.jsonfiles with image OR rootfs mode, If we run Trivy on the vscode extension handlebars - we see CVEs associated to any vulnerable handlebars npm package (version < 4.3.0, say handlebars npm package 1.3.0) in the Trivy scan results due to the usage of name "handlebars" and version "1.0.0" in this vscode extension'spackage.jsonfile.Every Visual Studio Code extension needs a manifest file
package.jsonat the root of the extension directory structure.nameandversionsare the fields defined on the extension itself and not associated with any npm package directly.Please correct me if am wrong here.
If this is indeed FP, then we need to have some mechanism to differentiate the npm package and the vscode extensions may by considering the fields in the vscode extension
package.json:a) publisher:
"publisher": "vscode",b) engines
c) repository:
Reproduction Steps
Target
Filesystem
Scanner
Vulnerability
Target OS
No response
Debug Output
Version
Checklist
-f jsonthat shows data sources and confirmed that the security advisory in data sources was correctBeta Was this translation helpful? Give feedback.
All reactions