Is Qore safe?

Findings

Contains Vulnerability (CVSS Critical)

Flags items that contain or rely on components with critical severity vulnerabilities, as identified by sources such as Google OSV and NVD. These vulnerabilities may expose the item to exploitation, including risks like backdoors, privilege escalation, or data compromise.

medium

Process Execution

Flags items that initiate new processes by executing files from local or remote paths. This behavior can be used to run additional code outside the extension’s scope, including potentially malicious payloads. Uncontrolled process execution increases the risk of system compromise.

medium

Unverified Publisher

Flags items published by entities that haven’t gone through the publisher verification process of the marketplace. Lack of verification may indicate higher risk, as the publisher’s identity and trustworthiness are unconfirmed.

medium

All findings are available for Enterprise users

Code analysis

AI-powered analysis of the extension's source code for security insights and risk assessment.

This code is a Visual Studio Code extension that provides support for the Qore programming language, including debugging capabilities and language server integration.

Key Functionalities:

Localization: Loads language files (.po) based on VS Code workspace settings to support multiple locales.
Qore Launch Configuration: Determines the Qore executable and environment settings for launching the debugger and language server.
Qore Language Server (QLS) Management: Starts, stops, and manages the Qore Language Server process.
Commands Registration: Registers VS Code commands for installing, reinstalling, updating the Qore VSCode package, and controlling the QLS.
Debug Adapter Integration: Implements a debug adapter descriptor factory to launch or attach the Qore debugger with appropriate arguments.
Debug Configuration Provider: Provides default debug configurations and resolves variables.
Debug Adapter Command Execution: Executes debug adapter commands synchronously via child process spawning and parses JSON responses.

API Calls and Process Execution:

Uses child_process.spawnSync to execute the Qore debugger executable with constructed arguments.
Reads and writes files for localization (.po files) using fs-extra.
Uses VS Code API extensively for workspace configuration, commands, debug sessions, and UI interactions.

Network Activity:

No direct network communication is observed in this code.

Filesystem Activity:

Reads localization files from the extension's lang directory.
Installs or updates Qore VSCode packages, which may involve file creation (not detailed here).

Obfuscation:

The code is not obfuscated; it is well-structured and readable TypeScript compiled to JavaScript.

Potential Malicious Behavior:

No indications of malicious behavior such as arbitrary code execution, privilege escalation, persistence mechanisms, registry edits, data exfiltration, or clipboard access.

Summary:

This extension manages Qore language support and debugging within VS Code by launching external processes (Qore debugger and language server) and handling user commands. It interacts with the filesystem for localization and package management but does not perform network communication or other risky operations within the provided code.

API Calls

API calls detected through static analysis of the source code. For more accurate insights, explore our sandbox dynamic analysis.

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

API CALLS ARE AVAILABLE FOR ENTERPRISE USERS

Secrets

Any encoded/decoded secrets we managed to find in the source code, git repository, or related files

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

SECRETS ARE AVAILABLE FOR ENTERPRISE USERS

Vulnerabilities

Known vulnerabilities and security issues detected in the extension's dependencies and code.

GHSA-xvch-5gv4-984h

Prototype Pollution in minimist

CVSS:

9.8

GHSA-c2qf-rxjj-qqgw

semver vulnerable to Regular Expression Denial of Service

CVSS:

7.5

GHSA-gxpj-cx7g-858c

Regular Expression Denial of Service in debug

CVSS:

3.7

All vulnerabilities are available for Enterprise users

External communication

Any identifiers we detected that may indicate external communication from the item's code

https://github.com/qorelanguage/qore-vscode/wiki/Visual-Code-for-Qore-Language-Setup

extension/out/extension.js

https://github.com/qorelanguage/qore-vscode/wiki/Visual-Code-for-Qore-Language-Setup

extension/out/extension.js

https://github.com/qorelanguage/qore/releases/download/release-

extension/out/qoreVscPkg.js

All external communications are available for Enterprise users

Dependencies

Dependencies and third-party libraries used by the extension, including version information and license details.

@types/glob

Version:

Unknown

@types/mocha

Version:

Unknown

@types/node

Version:

Unknown

All dependencies are available for Enterprise users

Licenses & Compliance

Licenses

X11 License

View License

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, includin...