fix(malysis): support VS Code and OpenVSX ecosystems in OSV reports#751
fix(malysis): support VS Code and OpenVSX ecosystems in OSV reports#751syf2211 wants to merge 2 commits into
Conversation
Add vscode and vscode:open-vsx.org path/ecosystem mappings to the OpenSSF malicious package report generator so --report-osv works for IDE extension malware analysis. Fixes safedep#651
SafeDep Report Summary
No dependency changes detected. Nothing to scan. This report is generated by SafeDep Github App |
There was a problem hiding this comment.
Pull request overview
This PR updates the OpenSSF malicious package OSV report generator (used by vet inspect malware --report-osv) to support VS Code Marketplace and OpenVSX ecosystems, aligning generated report paths and OSV ecosystem strings with OpenSSF’s malicious-packages layout.
Changes:
- Treat VS Code / OpenVSX ecosystems as
Range_ECOSYSTEMwhen generating range-based OSV affected data. - Add path + OSV-ecosystem mappings for VS Code (
vscode/VSCode) and OpenVSX (vscode:open-vsx.org/VSCode:https://open-vsx.org). - Add unit tests covering relative path generation and report output for both ecosystems.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| pkg/malysis/ossf.go | Adds ecosystem mappings and range-type selection for VS Code/OpenVSX OSV report generation. |
| pkg/malysis/ossf_test.go | Adds test coverage for VS Code/OpenVSX path generation and OSV report output. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| }, | ||
| setup: func(t *testing.T, dir string) { |
| assert.Len(t, vuln.Affected[0].Versions, 1) | ||
| assert.Equal(t, "4.5.6", vuln.Affected[0].Versions[0]) |
|
@syf2211 can you check some comment from copilot that i tagged you |
Add UseRange=true to the OpenVSX test case and assert Range_ECOSYSTEM instead of explicit Versions, per maintainer review feedback on safedep#751.
|
Thanks @KunalSin9h — updated the OpenVSX test case in abb3dd2 to use |
Summary
Add VS Code marketplace and OpenVSX extension support to the OpenSSF malicious package OSV report generator used by
vet inspect malware --report-osv.Fixes #651
Motivation
--report-osvfailed withunsupported ecosystemfor VS Code / OpenVSX extension malware analysis. OSSFmalicious-packagesalready maintains advisories underosv/malicious/vscodeandosv/malicious/vscode:open-vsx.org, but the generator only mapped npm, PyPI, RubyGems, Go, Maven, and crates.io.Changes
ECOSYSTEM_VSCODEto file pathvscodeand OSV JSON ecosystemVSCodeECOSYSTEM_OPENVSXto file pathvscode:open-vsx.organd OSV JSON ecosystemVSCode:https://open-vsx.orgECOSYSTEMrange type for VS Code marketplaces (same rationale as PyPI)Tests
go test ./pkg/malysis/... -count=1— pass (all tests including new VS Code / OpenVSX cases)Notes
ossf/malicious-packagessamples.