feat(vscode-extension): SARIF import/export + security hardening#926
Merged
Gbangbolaoluwagbemiga merged 2 commits intoJun 25, 2026
Conversation
Closes HyperSafeD#610, HyperSafeD#667, HyperSafeD#741, HyperSafeD#743 - Add sanctifier.exportSarif command: exports active file findings as SARIF 2.1.0 JSON with workspace-boundary guard before writing - Add sanctifier.importSarif command: reads and validates an external SARIF file with size (5 MB) and result count (10k) caps - Add sarif.ts: pure EditorFinding <-> SARIF 2.1.0 conversion utilities - Add security.ts: path-traversal guard, file-size limits, filename sanitisation — no VS Code API dependency, fully unit-testable - Add jest + ts-jest unit test suite (26 tests, analyzer + sarif) - Add ESLint with @typescript-eslint; all warnings resolved - Fix two no-useless-escape lint errors in existing analyzer.ts regexes - Add THREAT_MODEL.md documenting T1-T6 threats and mitigations - Update package.json: test/lint scripts, new devDependencies - Update tsconfig.json to exclude test files from production build
|
@oluwagbemigaphilip is attempting to deploy a commit to the gbangbolaoluwagbemiga's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
@anuoluwaponiorimi Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
Gbangbolaoluwagbemiga
merged commit 5cfe9ac
into
HyperSafeD:main
13 of 23 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
sanctifier.exportSarifcommand: converts active-file findings to a SARIF 2.1.0 JSON file with a workspace-boundary path guard before writing to disksanctifier.importSarifcommand: reads an external SARIF file with size (5 MB) and result-count (10 000) caps before renderingsarif.ts: pureEditorFinding ↔ SARIF 2.1.0conversion utilities (no VS Code API, fully unit-testable)security.ts: path-traversal guard, file-size limits, filename sanitisation@typescript-eslint; zero warnings innpm run lintno-useless-escapelint errors inanalyzer.tsregexesTHREAT_MODEL.mddocumenting T1–T6 threats and mitigations (path traversal, DoS via large files, malformed JSON, CLI substitution)testandlintnpm scripts so thevscode-extension-ci.ymlworkflow passes on all three platformsCloses #610
Closes #667
Closes #741
Closes #743
Test plan
npm run compile— zero TypeScript errorsnpm test— 26 tests pass (ubuntu, windows, macos)npm run lint— zero ESLint errors or warningsnpx @vscode/vsce package --no-dependencies— extension packages cleanly.rsfile containing Soroban code, run Sanctifier: Export findings as SARIF →.sariffile written and opened