CVE Detection on VSCode Extension #6112
Replies: 5 comments 6 replies
-
|
Hello @raghur-orca We check dependency files to detect installed dependencies, but we don't check/compare code of these dependencies/packages.
Looks like there are some vscode npm packages (e.g. https://www.npmjs.com/package/vscode-uri). In this case false positive is better (you can just filter or skip these files. |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for the update, @DmitriyLewen . |
Beta Was this translation helpful? Give feedback.
-
|
Unfortunately, I only see indirect solutions to avoid this case. Up to this point I haven't seen any other false positive issues for VScode. |
Beta Was this translation helpful? Give feedback.
-
|
Sure!. |
Beta Was this translation helpful? Give feedback.
-
|
Definitely interested as we have a large compliance department that keeps asking us about this. It there something the code-server / vs-code team could do to address the issue on their end? |
Beta Was this translation helpful? Give feedback.
-
|
Hello @mjschmidt Is this special custom field only for vs-code extensions? |
Beta Was this translation helpful? Give feedback.
-
|
I'm interested in a fix for this as well |
Beta Was this translation helpful? Give feedback.
-
|
just to confirm, is this limited to vscode extensions or applies to any node package? I mean, if I'm scanning my code repo which has a package.json and my package is called "handlebars", I should expect to see vulnerabilities in the handlebars package in npm? |
Beta Was this translation helpful? Give feedback.
-
|
IIUC This is only related to vs-code extensions. vs-code contains package.json file that is not associated with npm package of the same name and does not use code from that npm package.
if you scan npm project - you should see vulnerabilities for this package. |
Beta Was this translation helpful? Give feedback.
-
|
As a VSCode container template image provider for multiple enterprise customers, this false positive scan result is causing customer escalations, resulting in documentation specifically noting (and linking to) this false-positive bug. It would be wonderful to see this resolved. |
Beta Was this translation helpful? Give feedback.
-
|
I am one of the 'civilians' just beginning my journey, and have spent some considerable time wondering why VS Code was using such an old and vulnerable library before discovering this was not the case, and finding this page and others like it. @robnewman As it is not just Trivy but also Docker Scout (and probably other vulnerability scan services) that waste our collective time on this false alarm, perhaps the solution is not to ask each scanning service to adapt to this edge case, but rather to change the nomenclature of the extension so it is clear that it is different from the npm package? If it was called handlebars-extension, handlebars-in-vscode, etc. then this problem would be moot, right? |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
IDs
CVE-2019-19919, CVE-2021-23369, CVE-2021-23383, CVE-2019-20920
Description
CVE detection on vscode extensions eventhough it is neither linked with the npm package nor contain any code from npm package.
While working on a project, i have used vscode extension (handlebars) on my IDE.
As Trivy considers and scans the
package.jsonfiles with image OR rootfs mode, If we run Trivy on the vscode extension handlebars - we see CVEs associated to any vulnerable handlebars npm package (version < 4.3.0, say handlebars npm package 1.3.0) in the Trivy scan results due to the usage of name "handlebars" and version "1.0.0" in this vscode extension'spackage.jsonfile.Every Visual Studio Code extension needs a manifest file
package.jsonat the root of the extension directory structure.nameandversionsare the fields defined on the extension itself and not associated with any npm package directly.Please correct me if am wrong here.
If this is indeed FP, then we need to have some mechanism to differentiate the npm package and the vscode extensions may by considering the fields in the vscode extension
package.json:a) publisher:
"publisher": "vscode",b) engines
c) repository:
Reproduction Steps
Target
Filesystem
Scanner
Vulnerability
Target OS
No response
Debug Output
Version
Checklist
-f jsonthat shows data sources and confirmed that the security advisory in data sources was correctBeta Was this translation helpful? Give feedback.
All reactions