Skip to content

v3.0.4 — fix tool window navigation: highlighted line + code now match selected finding

Choose a tag to compare

View all tags
@JameelNabbo JameelNabbo released this 03 May 20:48
· 2 commits to main since this release
v3.0.4
648710e

Fixed — tool window navigation

Customer reported: "the highlighted line is different and the code is different" — clicking a finding in the Offensive 360 tool window left the editor caret parked on a previously-selected line, and the Code panel only showed the literal value (e.g. "AKIAIOSFODNN7EXAMPLE") instead of the actual source line at File:Line.

Three issues addressed:

  1. ResolveAbsoluteFilePath was returning the server's relative path (Controllers/Foo.cs) whenever File.Exists() happened to succeed against VS's working directory. dte.ItemOperations.OpenFile() silently returns null for non-rooted paths, so navigation appeared to do nothing. Now only absolute paths are returned (Path.IsPathRooted + Path.GetFullPath at every branch).
  2. Selection-driven navigation — FindingsGrid_SelectionChanged updated only the detail pane. Single-clicking a row left the editor stale relative to the highlighted finding. It now also calls NavigateTo(row) so the editor caret tracks the selection.
  3. Code snippet fidelity — the server's codeSnippet for hardcoded-secret findings is sometimes just the literal value. The Code panel now prefers the actual source line at File:Line via a new ReadFileLineSafe helper, falling back to the server snippet only if the file is unreadable.

Also: NavigateTo now reads Selection from dte.ActiveDocument after win.Activate() (the previous code preferred win.Document.Selection, which was stale on selection-driven navigation), and a relative-path guard on the navigation side prevents any survivor from reaching OpenFile.

Diagnostic [Nav] traces are written to %LOCALAPPDATA%\Offensive360\o360_scan_log.txt for future support.

Verified end-to-end

Tested live against o360.madfoat.com, scanning LargeTestProject (.NET, 63 findings):

Click row at line 32 → caret at line=32 column=28 (stripeApiKey)
Click row at line 34 → caret at line=34 column=28 (awsAccessKey)
Detail Code panel: awsAccessKey = "AKIAIOSFODNN7EXAMPLE",

The API line numbers are correct — comparison against the source file for 7 different finding types (Hardcoded Password, Missing AntiForgeryToken, XSS Reflected) all matched the actual code.

Install

Download OffensiveVS360-v3.0.4.vsix below, close all Visual Studio instances, and double-click it to install via VSIX Installer (or use Tools > Extensions > Install from VSIX... inside Visual Studio). Restart Visual Studio when prompted. No configuration changes required.

Manifest version: v1.12.22.

Targets: Visual Studio 2022 (Community / Professional / Enterprise), .NET Framework 4.7.2+.

Assets 3
Loading