vsx-registry: implement verified extension filtering #12995

vladarama · 2023-10-12T19:25:13Z

What it does

This PR implements various features allowing for the filtering of verified vsx-extensions. This helps the user distinguish verified extensions from non-verified ones which might pose a security risk. The changes include:

Adding a blue checkmark near the publisher name for verified extensions.
Implementing a extensions.onlyShowVerifiedExtensions preference to control the default behavior of the vsx-registry.
Creating a toggle to only show verified extensions when searching in the vsx-registry.
Showing a ConfirmDialog to warn the user when he is trying to install an unverified extension.

Demo:

How to test

Open Theia.
Visit the extension view and perform a search.
Verified extensions should have a blue checkmark near the publisher name.
Try installing an unverified extension -> It should open a confirmation dialog.
Toggle the Only Show Verified Extension button near the search-bar -> Only verified extensions should be shown.
The extensions.onlyShowVerifiedExtensions preference should now be set to True.
Untoggle the Only Show Verified Extension button -> All extensions should be shown -> The preference should be set to False or removed.

Review checklist

As an author, I have thoroughly tested my changes and carefully followed the review guidelines

Reminder for reviewers

As a reviewer, I agree to behave in accordance with the review guidelines

tsmaeder

See the comments. There is also the problem that when I change the "only show verified extensions" preference in the preference editor, the VSX search results are not refreshed. When I click the little start icon in the search field, it is refreshed.

packages/vsx-registry/src/browser/vsx-extension.tsx

tsmaeder · 2023-10-30T10:25:22Z

packages/vsx-registry/src/browser/vsx-extensions-model.ts

-                    version: allVersions.version
-                }));
-                searchResult.add(id);
+                const res = await client.query({ extensionId: id, extensionVersion: allVersions.version, includeAllVersions: true });


We're doing an extra query for each extension. Can't we get this info from the initial query? If not, let's open an issue a https://github.com/eclipse/openvsx to either be able to specify "verified" as a criterion or to get the flag in the search result.

During the search, we are using the Search API (https://open-vsx.org/swagger-ui/index.html#/registry-api/search) to get the list of extensions but they do not include the verified flag, which is why I had to do this extra query.

I have opened an issue: eclipse/openvsx#824

Thanks for the feedback.

Thanks for opening the issue, it would be by far the best solution to just do this in the original search.

Mehmethanife · 2023-11-02T19:16:21Z

What it does

This PR implements various features allowing for the filtering of verified vsx-extensions. This helps the user distinguish verified extensions from non-verified ones which might pose a security risk. The changes include:

Adding a blue checkmark near the publisher name for verified extensions.

Implementing a extensions.onlyShowVerifiedExtensions preference to control the default behavior of the vsx-registry.

Creating a toggle to only show verified extensions when searching in the vsx-registry.

Showing a ConfirmDialog to warn the user when he is trying to install an unverified extension.

Demo:

How to test

Open Theia.

Visit the extension view and perform a search.

Verified extensions should have a blue checkmark near the publisher name.

Try installing an unverified extension -> It should open a confirmation dialog.

Toggle the Only Show Verified Extension button near the search-bar -> Only verified extensions should be shown.

The extensions.onlyShowVerifiedExtensions preference should now be set to True.

Untoggle the Only Show Verified Extension button -> All extensions should be shown -> The preference should be set to False or removed.

Review checklist

As an author, I have thoroughly tested my changes and carefully followed the review guidelines

Reminder for reviewers

As a reviewer, I agree to behave in accordance with the review guidelines

tsmaeder · 2023-11-10T07:32:35Z

packages/vsx-registry/src/browser/vsx-extension.tsx

+                msg: nls.localize('theia/vsx-registry/confirmDialogMessage', 'The extension "{0}" is unverified and might pose a security risk.', this.displayName)
+            }).open();
+            if (choice) {
+                this._busy++;


This code is duplicated just below. You could easily clean this up writing

if (this.verified || this.confirmUnverifiedInstallation(this.displayName)) { ... }

or by extracting the installation into a doInstall method.

tsmaeder · 2023-11-10T07:57:17Z

packages/vsx-registry/src/browser/vsx-extensions-model.ts

-                    version: allVersions.version
-                }));
-                searchResult.add(id);
+                const res = await client.query({ extensionId: id, extensionVersion: allVersions.version, includeAllVersions: true });


Thanks for opening the issue, it would be by far the best solution to just do this in the original search.

tsmaeder · 2023-11-10T08:02:42Z

I've done some more testing, and the added queries for the "verified" status make searching for something like "github" got from < two seconds to > 9 seconds. IMO, this is not what we want.
My proposal would be to make sure that we only do the extra queries when we really care about them. The idea would be to remove the "verified" icon from the individual elements in the search result view and only keep the filter preference. I know this is not ideal, but until we can filter for the "verified" flag in the search (or get it back in the search result), I don't think it's worth the performance hit.
@MatthewKhouzam any thoughts on the matter?

MatthewKhouzam · 2023-11-10T13:48:27Z

I would propose we disucss at the theia-dev meeting on tuesday. @vladarama can you make it? Having the verified items pop in asynchronously would be cool too. But I would rather involve the author.

tsmaeder · 2023-11-10T14:01:50Z

Doing async queries would work for me: since they are i/o-bound, the local performance hit would be negligible. We'd have to introduce a third value for "verified" (unknown). Sounds like a neat exercise in managing parallel promises, as well ;-)

vladarama · 2023-11-10T14:46:21Z

Thanks for the feedback Thomas,
Let's discuss it on tuesday, I should be able to attend the dev-meeting.

vladarama · 2023-11-23T19:49:39Z

Hey @tsmaeder ,
The behavior should be a lot cleaner now. During a default search, the verified (or unverified) icons will only pop in when the fetching is done, which should not cause any performance issue from my testing. If the users are willing to take the small performance hit, the toggle (or preference) can be activated to only show verified extensions.

Here is a quick demo:

tsmaeder

Much better, I still have a couple of questions/suggestions.

packages/vsx-registry/src/browser/vsx-extensions-model.ts

JonasHelming · 2023-12-23T11:28:06Z

@tsmaeder Could you have a final look and merge if OK, please?

tsmaeder · 2024-01-05T09:02:18Z

@vladarama I'll get to this one next week.

tsmaeder · 2024-01-15T12:08:27Z

@vladarama thanks for this PR, it works very nicely now. Sorry it took so long, but Dec./Jan. was very busy for me. Before I merge this, could you please rebase the PR on master in order to make sure the license check is O.K.?

This commit handles the contribution of the 'verified' field when searching for extensions in the vsx-registry. It implements a checkmark near the publisher name when the extension's publisher is verified. Signed-off-by: Vlad Arama <vlad.arama@ericsson.com>

This commit adds a toggle button near the search bar in the vsx registry which allows for the filtering of extensions. When toggled, only verified extensions will be shown during the search which allows the user to quickly filter out extensions that might be deemed unsafe. Signed-off-by: Vlad Arama <vlad.arama@ericsson.com>

This commit does the following: - Adds `extensions.onlyShowVerifiedExtensions` preference to control default behavior of the vsx-registry. - Changes the `verified` icon to `codicon-verified-filled` and registers a blue color to match vscode styling. - Adds a `ConfirmDialog` when trying to install an unverified extension Signed-off-by: Vlad Arama <vlad.arama@ericsson.com>

This commit fixes the following issues: - Stops preventing the installation of verified extensions. - Refresh search results when the preference is changed from the preference editor.

This commit removes duplicated code by adding a `doInstall` protected method. Signed-off-by: Vlad Arama <vlad.arama@ericsson.com>

This commit allows the fetching of the verified status to be performed asynchronously during the search to avoid causing a performance hit. The verified (or unverified) icons will pop in asynchronously when the fetching is done. The following has been added: - `verified-filled` icon for verified extensions - `verified` icon for unverified extensions (unfilled verified) - `question` icon for extensions with an unknown verification status (appears before the fetching is completed) A small cleanup has also been performed with the creation of the following functions: - `fetchVerifiedStatus` - `updateExtensions` Signed-off-by: Vlad Arama <vlad.arama@ericsson.com>

This commit addresses review feedback and cleansup the code in the following way: - rename `updateExtensions` to `addExtensions` which is more appropriate - remove unnecessary `async` - fire parallel requests instead of serializing them Signed-off-by: Vlad Arama <vlad.arama@ericsson.com>

vladarama · 2024-01-15T12:49:36Z

@tsmaeder no worries,
Thank you for taking the time to review it. I rebased the PR on master.

tsmaeder self-requested a review October 30, 2023 09:49

tsmaeder requested changes Oct 30, 2023

View reviewed changes

packages/vsx-registry/src/browser/vsx-extension.tsx Show resolved Hide resolved

tsmaeder reviewed Oct 30, 2023

View reviewed changes

vladarama requested a review from tsmaeder November 1, 2023 15:13

tsmaeder requested changes Nov 10, 2023

View reviewed changes

vladarama requested a review from tsmaeder November 23, 2023 19:39

tsmaeder reviewed Nov 27, 2023

View reviewed changes

vladarama requested a review from tsmaeder November 27, 2023 17:25

JonasHelming assigned tsmaeder Dec 19, 2023

Mehmethanife approved these changes Dec 22, 2023

View reviewed changes

tsmaeder approved these changes Jan 15, 2024

View reviewed changes

Vlad Arama added 7 commits January 15, 2024 07:44

address comments and fix issues

10614d5

This commit fixes the following issues: - Stops preventing the installation of verified extensions. - Refresh search results when the preference is changed from the preference editor.

cleanup duplicated code

39a9361

This commit removes duplicated code by adding a `doInstall` protected method. Signed-off-by: Vlad Arama <vlad.arama@ericsson.com>

vladarama force-pushed the vsx-filtering branch from 6d1f700 to 68c39a0 Compare January 15, 2024 12:46

tsmaeder merged commit abc49cd into eclipse-theia:master Jan 15, 2024
14 checks passed

jfaltermeier added this to the 1.46.0 milestone Jan 25, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

vsx-registry: implement verified extension filtering #12995

vsx-registry: implement verified extension filtering #12995

vladarama commented Oct 12, 2023 •

edited

tsmaeder left a comment

tsmaeder Oct 30, 2023

vladarama Nov 1, 2023

tsmaeder Nov 10, 2023

Mehmethanife commented Nov 2, 2023

What it does

How to test

Review checklist

Reminder for reviewers

tsmaeder Nov 10, 2023

tsmaeder Nov 10, 2023

tsmaeder commented Nov 10, 2023

MatthewKhouzam commented Nov 10, 2023 •

edited

tsmaeder commented Nov 10, 2023

vladarama commented Nov 10, 2023

vladarama commented Nov 23, 2023 •

edited

tsmaeder left a comment

JonasHelming commented Dec 23, 2023

tsmaeder commented Jan 5, 2024

tsmaeder commented Jan 15, 2024

vladarama commented Jan 15, 2024

vsx-registry: implement verified extension filtering #12995

vsx-registry: implement verified extension filtering #12995

Conversation

vladarama commented Oct 12, 2023 • edited

What it does

How to test

Review checklist

Reminder for reviewers

tsmaeder left a comment

Choose a reason for hiding this comment

tsmaeder Oct 30, 2023

Choose a reason for hiding this comment

vladarama Nov 1, 2023

Choose a reason for hiding this comment

tsmaeder Nov 10, 2023

Choose a reason for hiding this comment

Mehmethanife commented Nov 2, 2023

What it does

How to test

Review checklist

Reminder for reviewers

tsmaeder Nov 10, 2023

Choose a reason for hiding this comment

tsmaeder Nov 10, 2023

Choose a reason for hiding this comment

tsmaeder commented Nov 10, 2023

MatthewKhouzam commented Nov 10, 2023 • edited

tsmaeder commented Nov 10, 2023

vladarama commented Nov 10, 2023

vladarama commented Nov 23, 2023 • edited

tsmaeder left a comment

Choose a reason for hiding this comment

JonasHelming commented Dec 23, 2023

tsmaeder commented Jan 5, 2024

tsmaeder commented Jan 15, 2024

vladarama commented Jan 15, 2024

vladarama commented Oct 12, 2023 •

edited

MatthewKhouzam commented Nov 10, 2023 •

edited

vladarama commented Nov 23, 2023 •

edited