Upcoming Security Enhancement: Secret Detection for Extensions

[mariaghiondea]

We’re introducing a new security mechanism to help protect the Visual Studio Marketplace ecosystem.

Soon, we’ll begin scanning for and preventing the publishing of extensions that contain embedded secrets (such as Azure DevOps PAT tokens, other API keys or credentials).
This proactive measure is designed to reduce the risk of compromised extensions and protect both publishers and users.

In addition to blocking new uploads with secrets, we will also be actively cleaning up existing cases to ensure a safer environment for everyone.

If you encounter any issues once this system is in place, please log an issue or reach out to our support team for assistance.

For more details on our security efforts and what this means for you, please visit our https://aka.ms/vsmsecurityblog.

[jessehouwing]

It might be useful to exclude a number of well-known test keys part of existing node_modules. Many node modules include a test project and some security modules include test keys.

Modifying the node_modules folder post-install isn't ideal.

Example projects:

Project	Files
tunnel	tunnel/test/keys/*.pem
http-signature	http-signature/http_signing.md
azure-pipelines-tasks-azure-arm-rest	azure-pipelines-tasks-azure-arm-rest/openssl/PEM/*.pem

See also:

• jessehouwing/azure-pipelines-tasks-zips@b3ab314
• https://github.com/microsoft/azure-devops-extension-tasks/blob/main/azure-pipelines.yml#L105
• [BUG]: Included test signing keys in Vstest task azure-pipelines-tasks#21221

[microhobby]

I'm using the https://www.npmjs.com/package/ssh2
I'm in the same situation.

[microhobby]

#1439

[mariaghiondea]

@microhobby your case was already suppressed as a false positive.

[mariaghiondea]

Thank you for the feedback. Based on the data that we’ve analyzed so far and the feedback that we’ve gotten, we are disabling some of the rules (e.g. PemPrivateKey) since they are producing too many false positives. We will analyze these further.

[sourishkrout]

Thank you for the feedback. Based on the data that we’ve analyzed so far and the feedback that we’ve gotten, we are disabling some of the rules (e.g. PemPrivateKey) since they are producing too many false positives. We will analyze these further.

Hi @mariaghiondea, what's the status of this? I'm getting emails from the Microsoft team that my 30d-rotated mTLS certificate that's not hard-coded (not part of the codebase!) triggers this scanning target. If I removed it from our extension, I'd have to remove mTLS and make a unencrypted and unauth'd TCP connection which can't be in the interest of best practice security.

Also, just because the certificate is dynamically written under the extension folder (one of few places that is writeable across platforms) does not make it hard-coded.

Please let me know.

[mariaghiondea]

This was a bulk, wide warning message since we are transitioning to Blocking phase soon.
The PemPrivateKey was turned into a warning (it was causing too many false positives) shortly after the first warning email..

[sourishkrout]

Great. Thank you!

[smcenlly]

It would be nice to be able to run the same set of rules from our own CI / build processes prior to publishing (or being rejected by the VS Code Marketplace in the future). Can you provide guidance on how to do that?

[mariaghiondea]

VS Marketplace will be using an internal secret detection mechanism, so unfortunately, that can't be shared.
The message that you will receive includes details about the secrets found (type, where) and how to contact support if you are facing issues or have questions.

[Amark19]

Updating node_modules not at all a correct way I think, because I have received a warning to remove http-signature/http_signing.md .
Although, its still possible to delete this file while building .vsix using bash script or so but is this something we should do to fix this warning asap ?
Or still is there some discussion going on for these false positives warnings as discussed above ?
What is the next action to be taken from publishers ?

[mariaghiondea]

@Amark19 I believe that you were flagged for PemPrivateKey - that rule has been disabled since (it was producing too many false positives)

[Amark19]

Hi @mariaghiondea as you said its disabled but I received reminder email today on transition from warning mode to blocking mode but 3 of my alerts are only flagged for PemPrivateKey but still receiving this email , is there anything we still need do ?

[mariaghiondea]

The emails were sent in bulk to anyone who was flagged during our silent warning mode. If you are only flagged for that, you won't encounter issues since that particular rule is non blocking.

[chemodun]

Hi.
I have a question about telemetry-module - I have plan to use it, But I see no other possibility, except to embed a connection string into the code ...
Will it be detected as an issue?

[KevinIlPazzo]

Nice feature.
But how to delete a specific version that has an issue?

[v-sulagnapal]

Hi,
Thank you for reaching out to us. Could you please contact our support team (VSMarketplace@microsoft.com)to request the removal of a specific version? Please note that the latest version cannot be removed.

[smcenlly]

2 days ago, we received another notification re:

extension/node_modules/http-signature/http_signing.md

We had already fixed the issue 2 weeks ago, but the notification is for an older version. Is this is a bug with the detection mechanism? Shouldn't it be testing against the latest version of the extension?

[madhurivadaligithub]

Hi @smcenlly

Could you please reach out to our support team (VSMarketplace@microsoft.com )with your extension details so we can address the detection-related queries?

[chemodun]

Any comments regarding embedding connection string into extension, to make telemetry-module working?
Will it be detected as issue?

[mariaghiondea]

Secret prevention is now in Blocking mode: #1442

[jedwards1211]

I'm confused, is publishing a new version with the secret removed sufficient to keep our extension from being taken offline?

I got a notice for one of my packages, ironically the secret was an NPM_TOKEN vscode-test put in the .vscode-test dir:

Extension	Version	Rule	Target
vscode-dude-wheres-my-module	2.1.1	NpmLegacyAuthorToken	extension/core.1297.!home!circleci!project!.vscode-test!vscode-1.56.2!VSCode-linux-x64!code

I really don't know why this directory was included since I have .vscode-test in my .vscodeignore, but I never actually used vscode-test so I just removed it from the deps and published a new version of my extension without it. But nevertheless I got a notice today that my extension has been locked

[mariaghiondea]

You can respond to the email you got for the extension to be unlocked. You will be able to publish afterwards, and if it passes validation, you are good to go.

[katorymnd]

i responded to the email and my extension Remote File Sync is still blocked i even made updates but i can publish them. How long does it take?

[mariaghiondea]

I see that your email came in today. The extension should be unlocked now.