Contains Vulnerability (CVSS Critical)

Flags items that contain or rely on components with critical severity vulnerabilities, as identified by sources such as Google OSV and NVD. These vulnerabilities may expose the item to exploitation, including risks like backdoors, privilege escalation, or data compromise.

medium

Process Execution

Flags items that initiate new processes by executing files from local or remote paths. This behavior can be used to run additional code outside the extension’s scope, including potentially malicious payloads. Uncontrolled process execution increases the risk of system compromise.

medium

Unverified Publisher

Flags items published by entities that haven’t gone through the publisher verification process of the marketplace. Lack of verification may indicate higher risk, as the publisher’s identity and trustworthiness are unconfirmed.

medium

Key Functionalities:

  • Localization: Loads language files (.po) based on VS Code workspace settings to support multiple locales.
  • Qore Launch Configuration: Determines the Qore executable and environment settings for launching the debugger and language server.
  • Qore Language Server (QLS) Management: Starts, stops, and manages the Qore Language Server process.
  • Commands Registration: Registers VS Code commands for installing, reinstalling, updating the Qore VSCode package, and controlling the QLS.
  • Debug Adapter Integration: Implements a debug adapter descriptor factory to launch or attach the Qore debugger with appropriate arguments.
  • Debug Configuration Provider: Provides default debug configurations and resolves variables.
  • Debug Adapter Command Execution: Executes debug adapter commands synchronously via child process spawning and parses JSON responses.

API Calls and Process Execution:

  • Uses child_process.spawnSync to execute the Qore debugger executable with constructed arguments.
  • Reads and writes files for localization (.po files) using fs-extra.
  • Uses VS Code API extensively for workspace configuration, commands, debug sessions, and UI interactions.

Network Activity:

  • No direct network communication is observed in this code.

Filesystem Activity:

  • Reads localization files from the extension's lang directory.
  • Installs or updates Qore VSCode packages, which may involve file creation (not detailed here).

Obfuscation:

  • The code is not obfuscated; it is well-structured and readable TypeScript compiled to JavaScript.

Potential Malicious Behavior:

  • No indications of malicious behavior such as arbitrary code execution, privilege escalation, persistence mechanisms, registry edits, data exfiltration, or clipboard access.

Summary:

This extension manages Qore language support and debugging within VS Code by launching external processes (Qore debugger and language server) and handling user commands. It interacts with the filesystem for localization and package management but does not perform network communication or other risky operations within the provided code.

Secrets Available for Enterprise Users

GHSA-xvch-5gv4-984h

Prototype Pollution in minimist

CVSS:

9.8

GHSA-c2qf-rxjj-qqgw

semver vulnerable to Regular Expression Denial of Service

CVSS:

7.5

GHSA-gxpj-cx7g-858c

Regular Expression Denial of Service in debug

CVSS:

3.7

Licenses

X11 License

View License

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including...