Is Language Support for Java(TM) by Red Hat safe?

Findings

Contains Binary Executable

Flags items that contain binary executable files, which can pose significant security risks. Binary executables can harbor malicious code or exploit vulnerabilities, potentially compromising the integrity and security of the extension and its users.

medium

Data Exfiltration

Flags items that transmit user data, system output, or other collected information to remote servers. This behavior may indicate malicious activity, including unauthorized data harvesting, credential theft, or command-and-control communication. Data exfiltration poses a serious risk to user privacy, organizational security, and compliance posture.

low

File Creation

Flags items that create or drop files onto the filesystem. This may include downloading content from remote sources or generating new files during execution. While file creation can be benign, it may also indicate attempts to persist malicious payloads, stage further actions, or evade detection by writing artifacts outside the monitored runtime.

low

All findings are available for Enterprise users

Code analysis

AI-powered analysis of the extension's source code for security insights and risk assessment.

This Visual Studio Code extension, "Language Support for Java(TM) by Red Hat", provides Java language features including linting, IntelliSense, formatting, refactoring, and build tool support (Maven/Gradle). The code includes modules for telemetry collection and reporting, extension recommendations, and storage management. Key behaviors observed include:

Telemetry and Analytics: The extension collects usage data and sends it to Red Hat's telemetry services using HTTP POST requests to https://api.segment.io/v1/batch and fetches remote configuration from https://raw.githubusercontent.com/redhat-developer/vscode-redhat-telemetry/main/src/config/telemetry-config.json.
Extension Recommendations: It manages extension recommendations, including showing prompts to users, storing user choices, and managing recommendation models in local storage.
File System Access: Uses VSCode workspace file system APIs to read/write files for storing telemetry and recommendation data.
No Shell or PowerShell Execution: No evidence of executing shell commands or PowerShell scripts.
No Arbitrary Code Execution: No dynamic code execution based on runtime configuration.
No Elevated Privileges or Persistence: The extension does not request or use elevated privileges, nor does it establish autostart persistence mechanisms.
No Windows Registry Access: No reading or editing of Windows Registry keys.
No User Account Creation or Clipboard Access: No creation of OS-level user accounts or clipboard monitoring.

Potentially Sensitive URLs:

[
  "https://api.segment.io/v1/batch",
  "https://raw.githubusercontent.com/redhat-developer/vscode-redhat-telemetry/main/src/config/telemetry-config.json"
]

Summary: The extension primarily focuses on Java language support and telemetry reporting to Red Hat's services. It respects user choices for telemetry and recommendations and does not perform any suspicious or malicious operations such as executing arbitrary code, shell commands, or modifying system settings.

API Calls

API calls detected through static analysis of the source code. For more accurate insights, explore our sandbox dynamic analysis.

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

API CALLS ARE AVAILABLE FOR ENTERPRISE USERS

Secrets

Any encoded/decoded secrets we managed to find in the source code, git repository, or related files

JDBC

/extension/server/plugins/jakarta.servlet-api_5.0.0.jar

Unverified

JDBC

/extension/server/plugins/org.eclipse.jetty.servlet-api_4.0.6.jar

Unverified

All secrets are available for Enterprise users

Vulnerabilities

Known vulnerabilities and security issues detected in the extension's dependencies and code.

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

VULNERABILITIES ARE AVAILABLE FOR ENTERPRISE USERS

External communication

Any identifiers we detected that may indicate external communication from the item's code

https://api.segment.io/v1/batch

https://raw.githubusercontent.com/redhat-developer/vscode-redhat-telemetry/main/src/config/telemetry-config.json

https://adoptopenjdk.net/

extension/dist/extension.js

All external communications are available for Enterprise users

Dependencies

Dependencies and third-party libraries used by the extension, including version information and license details.

@redhat-developer/vscode-extension-proposals

Version:

Unknown

@redhat-developer/vscode-redhat-telemetry

Version:

Unknown

@types/fs-extra

Version:

Unknown

All dependencies are available for Enterprise users

Licenses & Compliance

Compliance

Compliance status and certifications for the extension and its publisher

Red Hat

Red Hat explicitly mentions respect for user privacy and adherence to the California Consumer Privacy Act (CCPA) on their website. They have a privacy statement that applies to personal data collected via their website, indicating compliance. Furthermore, their parent company, IBM, also shows compliance with the CCPA through their privacy statements and committed processes. Therefore, both Red Hat and IBM are compliant with CCPA.

Compliant

Red Hat

Red Hat is HIPAA compliant, particularly in its Azure Red Hat OpenShift service. Additionally, its parent company, IBM, also demonstrates HIPAA compliance through its policies and procedures.

Compliant

Red Hat

Red Hat is PCI DSS certified, as they have engaged Coalfire Systems, Inc., a respected PCI qualified security assessor, to assess their compliance. Additionally, since Red Hat's parent company is IBM, and IBM is known for its strong security measures and compliance with PCI DSS, it can be inferred that both the company and the parent company maintain compliance.

Compliant

Licenses

Eclipse Public License 1.0

View License

"Eclipse Public License - v 2.0\n\n THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE\n PUBLIC LICENSE (\u0022AGREEMENT\u0022). ANY USE, REPRODUCTION OR DISTRIBUTION\n OF T...