@vscode/vsce 3.4.2-1 → 3.4.2-2

package/out/main.js

@@ -185,7 +185,7 @@ module.exports = function (argv) {
         .addOption(new commander_1.Option('--noVerify', 'Allow all proposed APIs (deprecated: use --allow-all-proposed-apis instead)').hideHelp(true))
         .option('--allow-proposed-apis <apis...>', 'Allow specific proposed APIs')
         .option('--allow-all-proposed-apis', 'Allow all proposed APIs')
-        .option('--allow-package-secrets <secrets...>', 'Allow packaging specific secrets. The names of the secrets can be found in the error message ([SECRET_NAME]).')
+        .option('--allow-package-secrets <secret_type>', 'Allow packaging a specific type of secret. The type of the secrets can be found in the error message ([SECRET_TYPE]).')
         .option('--allow-package-all-secrets', 'Allow to package all kinds of secrets')
         .option('--allow-package-env-file', 'Allow packaging .env files')
         .option('--ignoreFile <path>', 'Indicate alternative .vscodeignore')

package/out/package.js

@@ -1568,14 +1568,16 @@ var FileExclusionType;
     FileExclusionType["PackageFiles"] = "package.files";
 })(FileExclusionType || (FileExclusionType = {}));
 async function scanFilesForSecrets(files, fileExclusion, options) {
-    if (options.allowPackageAllSecrets && options.allowPackageEnvFile) {
+    const scanForSecrets = !options.allowPackageAllSecrets;
+    const scanDotEnv = !options.allowPackageEnvFile;
+    if (!scanForSecrets && !scanDotEnv) {
         return; // No need to scan
     }
     const onDiskFiles = files.filter(file => !isInMemoryFile(file));
     const onDiskNoneNodeModulesFiles = onDiskFiles.filter(file => !file.localPath.includes('node_modules'));
     const inMemoryFiles = files.filter(file => isInMemoryFile(file));
-    const onDiskResult = await (0, secretLint_1.lintFiles)(onDiskNoneNodeModulesFiles.map(file => file.localPath));
-    const inMemoryResults = await Promise.all(inMemoryFiles.map(file => (0, secretLint_1.lintText)(typeof file.contents === 'string' ? file.contents : file.contents.toString('utf8'), file.path)));
+    const onDiskResult = await (0, secretLint_1.lintFiles)(onDiskNoneNodeModulesFiles.map(file => file.localPath), scanForSecrets, scanDotEnv);
+    const inMemoryResults = await Promise.all(inMemoryFiles.map(file => (0, secretLint_1.lintText)(typeof file.contents === 'string' ? file.contents : file.contents.toString('utf8'), file.path, scanForSecrets, scanDotEnv)));
     const secretsFound = [...inMemoryResults, onDiskResult].filter(result => !result.ok).flatMap(result => result.results);
     // secrets found
     const noneDotEnvSecretsFound = secretsFound.filter(result => result.ruleId &&
@@ -1589,9 +1591,9 @@ async function scanFilesForSecrets(files, fileExclusion, options) {
         errorMessage += ` Your extension package contains sensitive information that should not be published.`;
         errorMessage += ` Please remove these secrets before packaging.`;
         errorMessage += `\n` + noneDotEnvSecretsFound.map(secretLint_1.prettyPrintLintResult).join('\n');
-        let hintMessage = `\nIn case of a false positives, you can allowlist secrets with `;
+        let hintMessage = `\nIn case of false positives, you can allow specific types of secrets with `;
         hintMessage += secretsFoundRuleNames.map(name => `--allow-package-secrets ${name}`).join(' ');
-        hintMessage += ` or use --allow-package-all-secrets to skip this check (not recommended).`;
+        hintMessage += ` or use --allow-package-all-secrets to skip this check entirely (not recommended).`;
         util.log.error(errorMessage + chalk_1.default.italic(hintMessage));
         process.exit(1);
     }

package/out/secretLint.js

@@ -7,55 +7,64 @@ exports.prettyPrintLintResult = exports.getRuleNameFromRuleId = exports.lintText
 const chalk_1 = __importDefault(require("chalk"));
 const secret_lint_types_1 = require("./typings/secret-lint-types");
 const util_1 = require("./util");
-const lintConfig = {
-    rules: [
-        {
-            id: "@secretlint/secretlint-rule-preset-recommend",
-            rules: [
-                {
-                    id: "@secretlint/secretlint-rule-basicauth",
-                    allowMessageIds: ["BasicAuth"]
-                }, {
-                    id: "@secretlint/secretlint-rule-privatekey",
-                    options: {
-                        allows: [
-                            // Allow all keys which do not start and end with the BEGIN/END PRIVATE KEY and has at least 50 characters in between
-                            // https://github.com/microsoft/vscode-vsce/issues/1147
-                            "/^(?![\\s\\S]*-----BEGIN .*PRIVATE KEY-----[A-Za-z0-9+/=\\r\\n]{50,}-----END .*PRIVATE KEY-----)[\\s\\S]*$/"
-                        ]
-                    }
-                }, {
-                    id: "@secretlint/secretlint-rule-npm",
-                    options: {
-                        allows: [
-                            // An npm token has the prefix npm_ followed by 36 Base62 characters (30 random + 6-character checksum), totaling 40 characters.
-                            // https://github.com/microsoft/vscode-vsce/issues/1153
-                            "/^(?!(?:npm_[0-9A-Za-z]{36})$).+$/"
-                        ]
-                    }
+const secretsScanningRules = [
+    {
+        id: "@secretlint/secretlint-rule-preset-recommend",
+        rules: [
+            {
+                id: "@secretlint/secretlint-rule-basicauth",
+                allowMessageIds: ["BasicAuth"]
+            },
+            {
+                id: "@secretlint/secretlint-rule-privatekey",
+                options: {
+                    allows: [
+                        // Allow all keys which do not start and end with the BEGIN/END PRIVATE KEY and has at least 50 characters in between
+                        // https://github.com/microsoft/vscode-vsce/issues/1147
+                        "/^(?![\\s\\S]*-----BEGIN .*PRIVATE KEY-----[A-Za-z0-9+/=\\r\\n]{50,}-----END .*PRIVATE KEY-----)[\\s\\S]*$/"
+                    ]
                 }
-            ]
-        }, {
-            id: "@secretlint/secretlint-rule-no-dotenv"
-        }
-    ]
-};
-const lintOptions = {
-    configFileJSON: lintConfig,
-    formatter: "@secretlint/secretlint-formatter-sarif",
-    color: true,
-    maskSecrets: false
-};
+            }, {
+                id: "@secretlint/secretlint-rule-npm",
+                options: {
+                    allows: [
+                        // An npm token has the prefix npm_ followed by 36 Base62 characters (30 random + 6-character checksum), totaling 40 characters.
+                        // https://github.com/microsoft/vscode-vsce/issues/1153
+                        "/^(?!(?:npm_[0-9A-Za-z]{36})$).+$/"
+                    ]
+                }
+            }
+        ]
+    }
+];
+const dotEnvRules = [
+    {
+        id: "@secretlint/secretlint-rule-no-dotenv"
+    }
+];
 // Helper function to dynamically import the createEngine function
-async function getEngine() {
+async function getEngine(scanSecrets, scanDotEnv) {
     // Use a raw dynamic import that will not be transformed
     // This is necessary because @secretlint/node is an ESM module
     const secretlintModule = await eval('import("@secretlint/node")');
+    const rules = [];
+    if (scanSecrets) {
+        rules.push(...secretsScanningRules);
+    }
+    if (scanDotEnv) {
+        rules.push(...dotEnvRules);
+    }
+    const lintOptions = {
+        configFileJSON: { rules: rules },
+        formatter: "@secretlint/secretlint-formatter-sarif",
+        color: true,
+        maskSecrets: false
+    };
     const engine = await secretlintModule.createEngine(lintOptions);
     return engine;
 }
-async function lintFiles(filePaths) {
-    const engine = await getEngine();
+async function lintFiles(filePaths, scanSecrets, scanDotEnv) {
+    const engine = await getEngine(scanSecrets, scanDotEnv);
     let engineResult;
     try {
         engineResult = await engine.executeOnFiles({
@@ -69,8 +78,8 @@ async function lintFiles(filePaths) {
     return parseResult(engineResult);
 }
 exports.lintFiles = lintFiles;
-async function lintText(content, fileName) {
-    const engine = await getEngine();
+async function lintText(content, fileName, scanSecrets, scanDotEnv) {
+    const engine = await getEngine(scanSecrets, scanDotEnv);
     let engineResult;
     try {
         engineResult = await engine.executeOnContent({

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@vscode/vsce",
-	"version": "3.4.2-1",
+	"version": "3.4.2-2",
 	"description": "VS Code Extensions Manager",
 	"repository": {
 		"type": "git",