@vscode/vsce 3.3.3-5 → 3.3.3-6

package/dist/vsce.d.ts

@@ -122,6 +122,9 @@ export declare interface IPackageOptions {
     readonly allowStarActivation?: boolean;
     readonly allowMissingRepository?: boolean;
     readonly allowUnusedFilesPattern?: boolean;
+    readonly allowPackageSecrets?: string[];
+    readonly allowPackageAllSecrets?: boolean;
+    readonly allowPackageEnvFile?: boolean;
     readonly skipLicense?: boolean;
     readonly signTool?: string;
 }
@@ -177,6 +180,9 @@ export declare interface IPublishOptions {
     readonly noVerify?: boolean;
     readonly allowProposedApis?: string[];
     readonly allowAllProposedApis?: boolean;
+    readonly allowPackageSecrets?: string[];
+    readonly allowPackageAllSecrets?: boolean;
+    readonly allowPackageEnvFile?: boolean;
     readonly dependencies?: boolean;
     readonly preRelease?: boolean;
     readonly allowStarActivation?: boolean;

package/out/main.js

@@ -121,10 +121,13 @@ module.exports = function (argv) {
         .option('--allow-star-activation', 'Allow using * in activation events')
         .option('--allow-missing-repository', 'Allow missing a repository URL in package.json')
         .option('--allow-unused-files-pattern', 'Allow include patterns for the files field in package.json that does not match any file')
+        .option('--allow-package-secrets <secrets...>', 'Allow packaging specific secrets. The names of the secrets can be found in the error message ([SECRET_NAME]).')
+        .option('--allow-package-all-secrets', 'Allow to package all kinds of secrets')
+        .option('--allow-package-env-file', 'Allow packaging .env files')
         .option('--skip-license', 'Allow packaging without license file')
         .option('--sign-tool <path>', 'Path to the VSIX signing tool. Will be invoked with two arguments: `SIGNTOOL <path/to/extension.signature.manifest> <path/to/extension.signature.p7s>`.')
         .option('--follow-symlinks', 'Recurse into symlinked directories instead of treating them as files')
-        .action((version, { out, target, ignoreOtherTargetFolders, readmePath, changelogPath, message, gitTagVersion, updatePackageJson, githubBranch, gitlabBranch, rewriteRelativeLinks, baseContentUrl, baseImagesUrl, yarn, ignoreFile, gitHubIssueLinking, gitLabIssueLinking, dependencies, preRelease, allowStarActivation, allowMissingRepository, allowUnusedFilesPattern, skipLicense, signTool, followSymlinks, }) => main((0, package_1.packageCommand)({
+        .action((version, { out, target, ignoreOtherTargetFolders, readmePath, changelogPath, message, gitTagVersion, updatePackageJson, githubBranch, gitlabBranch, rewriteRelativeLinks, baseContentUrl, baseImagesUrl, yarn, ignoreFile, gitHubIssueLinking, gitLabIssueLinking, dependencies, preRelease, allowStarActivation, allowMissingRepository, allowUnusedFilesPattern, allowPackageSecrets, allowPackageAllSecrets, allowPackageEnvFile, skipLicense, signTool, followSymlinks, }) => main((0, package_1.packageCommand)({
         packagePath: out,
         version,
         target,
@@ -148,6 +151,9 @@ module.exports = function (argv) {
         allowStarActivation,
         allowMissingRepository,
         allowUnusedFilesPattern,
+        allowPackageSecrets,
+        allowPackageAllSecrets,
+        allowPackageEnvFile,
         skipLicense,
         signTool,
         followSymlinks,
@@ -179,6 +185,9 @@ module.exports = function (argv) {
         .addOption(new commander_1.Option('--noVerify', 'Allow all proposed APIs (deprecated: use --allow-all-proposed-apis instead)').hideHelp(true))
         .option('--allow-proposed-apis <apis...>', 'Allow specific proposed APIs')
         .option('--allow-all-proposed-apis', 'Allow all proposed APIs')
+        .option('--allow-package-secrets <secrets...>', 'Allow packaging specific secrets. The names of the secrets can be found in the error message ([SECRET_NAME]).')
+        .option('--allow-package-all-secrets', 'Allow to package all kinds of secrets')
+        .option('--allow-package-env-file', 'Allow packaging .env files')
         .option('--ignoreFile <path>', 'Indicate alternative .vscodeignore')
         // default must remain undefined for dependencies or we will fail to load defaults from package.json
         .option('--dependencies', 'Enable dependency detection via npm or yarn', undefined)
@@ -190,7 +199,7 @@ module.exports = function (argv) {
         .option('--skip-duplicate', 'Fail silently if version already exists on the marketplace')
         .option('--skip-license', 'Allow publishing without license file')
         .option('--follow-symlinks', 'Recurse into symlinked directories instead of treating them as files')
-        .action((version, { pat, azureCredential, target, ignoreOtherTargetFolders, readmePath, changelogPath, message, gitTagVersion, updatePackageJson, packagePath, manifestPath, signaturePath, sigzipPath, githubBranch, gitlabBranch, baseContentUrl, baseImagesUrl, yarn, verify, noVerify, allowProposedApis, allowAllProposedApis, ignoreFile, dependencies, preRelease, allowStarActivation, allowMissingRepository, allowUnusedFilesPattern, skipDuplicate, skipLicense, signTool, followSymlinks, }) => main((0, publish_1.publish)({
+        .action((version, { pat, azureCredential, target, ignoreOtherTargetFolders, readmePath, changelogPath, message, gitTagVersion, updatePackageJson, packagePath, manifestPath, signaturePath, sigzipPath, githubBranch, gitlabBranch, baseContentUrl, baseImagesUrl, yarn, verify, noVerify, allowProposedApis, allowAllProposedApis, allowPackageSecrets, allowPackageAllSecrets, allowPackageEnvFile, ignoreFile, dependencies, preRelease, allowStarActivation, allowMissingRepository, allowUnusedFilesPattern, skipDuplicate, skipLicense, signTool, followSymlinks, }) => main((0, publish_1.publish)({
         pat,
         azureCredential,
         version,
@@ -213,6 +222,9 @@ module.exports = function (argv) {
         noVerify: noVerify || !verify,
         allowProposedApis,
         allowAllProposedApis,
+        allowPackageSecrets,
+        allowPackageAllSecrets,
+        allowPackageEnvFile,
         ignoreFile,
         dependencies,
         preRelease,

package/out/package.js

@@ -1557,33 +1557,59 @@ async function printAndValidatePackagedFiles(files, cwd, manifest, options) {
     }
     message += '\n';
     util.log.info(message);
-    await scanFilesForSecrets(files);
+    const fileExclusion = hasIgnoreFile ? FileExclusionType.VSCodeIgnore : manifest.files ? FileExclusionType.PackageFiles : FileExclusionType.None;
+    await scanFilesForSecrets(files, fileExclusion, options);
 }
 exports.printAndValidatePackagedFiles = printAndValidatePackagedFiles;
-async function scanFilesForSecrets(files) {
+var FileExclusionType;
+(function (FileExclusionType) {
+    FileExclusionType["None"] = "none";
+    FileExclusionType["VSCodeIgnore"] = "vscodeIgnore";
+    FileExclusionType["PackageFiles"] = "package.files";
+})(FileExclusionType || (FileExclusionType = {}));
+async function scanFilesForSecrets(files, fileExclusion, options) {
     const onDiskFiles = files.filter(file => !isInMemoryFile(file));
     const inMemoryFiles = files.filter(file => isInMemoryFile(file));
     const onDiskResult = await (0, secretLint_1.lintFiles)(onDiskFiles.map(file => file.localPath));
     const inMemoryResults = await Promise.all(inMemoryFiles.map(file => (0, secretLint_1.lintText)(typeof file.contents === 'string' ? file.contents : file.contents.toString('utf8'), file.path)));
     const secretsFound = [...inMemoryResults, onDiskResult].filter(result => !result.ok).flatMap(result => result.results);
-    if (secretsFound.length === 0) {
-        return;
-    }
     // secrets found
-    const noneDotEnvSecretsFound = secretsFound.filter(result => result.ruleId !== '@secretlint/secretlint-rule-no-dotenv');
+    const noneDotEnvSecretsFound = secretsFound.filter(result => result.ruleId &&
+        result.ruleId !== '@secretlint/secretlint-rule-no-dotenv' &&
+        !options.allowPackageAllSecrets &&
+        !options.allowPackageSecrets?.includes((0, secretLint_1.getRuleNameFromRuleId)(result.ruleId)));
     if (noneDotEnvSecretsFound.length > 0) {
-        let errorOutput = '';
-        for (const secret of noneDotEnvSecretsFound) {
-            errorOutput += '\n' + (0, secretLint_1.prettyPrintLintResult)(secret);
-        }
-        util.log.error(`Secrets have been detected in the files which are being packaged:\n\n${errorOutput}`);
+        const uniqueSecretIds = new Set(noneDotEnvSecretsFound.map(result => result.ruleId));
+        const secretsFoundRuleNames = Array.from(uniqueSecretIds).map(secretLint_1.getRuleNameFromRuleId);
+        let errorMessage = `${chalk_1.default.bold('Potential security issue detected:')}`;
+        errorMessage += ` Your extension package contains sensitive information that should not be published.`;
+        errorMessage += ` Please remove these secrets before packaging.`;
+        errorMessage += `\n` + noneDotEnvSecretsFound.map(secretLint_1.prettyPrintLintResult).join('\n');
+        let hintMessage = `\nIn case of a false positives, you can allowlist secrets with `;
+        hintMessage += secretsFoundRuleNames.map(name => `--allow-package-secrets ${name}`).join(' ');
+        hintMessage += ` or use --allow-package-all-secrets to skip this check (not recommended).`;
+        util.log.error(errorMessage + chalk_1.default.italic(hintMessage));
+        process.exit(1);
     }
     // .env file found
     const allRuleIds = new Set(secretsFound.map(result => result.ruleId).filter(Boolean));
-    if (allRuleIds.has('@secretlint/secretlint-rule-no-dotenv')) {
-        util.log.error(`${chalk_1.default.bold.red('.env')} files should not be packaged. Ignore them in your ${chalk_1.default.bold('.vscodeignore')} file or exclude them from the package.json ${chalk_1.default.bold('files')} property.`);
+    if (!options.allowPackageEnvFile && allRuleIds.has('@secretlint/secretlint-rule-no-dotenv')) {
+        let errorMessage = `${chalk_1.default.bold.red('.env')} files should not be packaged.`;
+        switch (fileExclusion) {
+            case FileExclusionType.None:
+                errorMessage += ` Ignore the file in your ${chalk_1.default.bold('.vscodeignore')} or exclude it from the package.json ${chalk_1.default.bold('files')} property.`;
+                break;
+            case FileExclusionType.VSCodeIgnore:
+                errorMessage += ` Ignore the file in your ${chalk_1.default.bold('.vscodeignore')}.`;
+                break;
+            case FileExclusionType.PackageFiles:
+                errorMessage += ` Do not include the file in your package.json ${chalk_1.default.bold('files')} property.`;
+                break;
+        }
+        const hintMessage = `\nTo ignore this check, you can use --allow-package-env-file (not recommended).`;
+        util.log.error(errorMessage + chalk_1.default.italic(hintMessage));
+        process.exit(1);
     }
-    process.exit(1);
 }
 exports.scanFilesForSecrets = scanFilesForSecrets;
 //# sourceMappingURL=package.js.map

package/out/secretLint.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.prettyPrintLintResult = exports.lintText = exports.lintFiles = void 0;
+exports.prettyPrintLintResult = exports.getRuleNameFromRuleId = exports.lintText = exports.lintFiles = void 0;
 const chalk_1 = __importDefault(require("chalk"));
 const secret_lint_types_1 = require("./typings/secret-lint-types");
 const lintConfig = {
@@ -57,6 +57,11 @@ function parseResult(result) {
     const results = output.runs.at(0)?.results ?? [];
     return { ok: result.ok, results };
 }
+function getRuleNameFromRuleId(ruleId) {
+    const parts = ruleId.split('-rule-');
+    return parts[parts.length - 1];
+}
+exports.getRuleNameFromRuleId = getRuleNameFromRuleId;
 function prettyPrintLintResult(result) {
     if (!result.message.text) {
         return JSON.stringify(result);
@@ -64,7 +69,8 @@ function prettyPrintLintResult(result) {
     const text = result.message.text;
     const titleColor = result.level === undefined || result.level === secret_lint_types_1.Level.Error ? chalk_1.default.bold.red : chalk_1.default.bold.yellow;
     const title = text.length > 54 ? text.slice(0, 50) + '...' : text;
-    let output = `\t${titleColor(title)}\n`;
+    const ruleName = result.ruleId ? getRuleNameFromRuleId(result.ruleId) : 'unknown';
+    let output = `\t${titleColor(title)} [${ruleName}]\n`;
     if (result.locations) {
         result.locations.forEach(location => {
             output += `\t${prettyPrintLocation(location)}\n`;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@vscode/vsce",
-	"version": "3.3.3-5",
+	"version": "3.3.3-6",
 	"description": "VS Code Extensions Manager",
 	"repository": {
 		"type": "git",