ktg-plugin-marketplace/plugins/llm-security/tests/scanners/ide-extension-scanner.test.mjs

// ide-extension-scanner.test.mjs — Integration tests for the IDE extension scanner.
//
// Uses fixture trees under tests/fixtures/ide-extensions/ to simulate
// real ~/.vscode/extensions/ layouts via rootsOverride injection.

import { describe, it, beforeEach } from 'node:test';
import assert from 'node:assert/strict';
import { resolve } from 'node:path';
import { fileURLToPath } from 'node:url';
import { resetCounter } from '../../scanners/lib/output.mjs';
import { scan, discoverAll } from '../../scanners/ide-extension-scanner.mjs';
import {
  discoverVSCodeExtensions,
  parseDirName,
} from '../../scanners/lib/ide-extension-discovery.mjs';
import { parseVSCodeExtension } from '../../scanners/lib/ide-extension-parser.mjs';

const __dirname = fileURLToPath(new URL('.', import.meta.url));
const FIXTURES = resolve(__dirname, '../fixtures/ide-extensions');
const ROOT_BENIGN = resolve(FIXTURES, 'root-benign');
const ROOT_MIXED = resolve(FIXTURES, 'root-mixed');

describe('parseDirName', () => {
  it('parses plain publisher.name-version', () => {
    const out = parseDirName('ms-python.python-2024.1.0');
    assert.ok(out);
    assert.equal(out.publisher, 'ms-python');
    assert.equal(out.name, 'python');
    assert.equal(out.version, '2024.1.0');
    assert.equal(out.targetPlatform, null);
  });

  it('parses prerelease suffix', () => {
    const out = parseDirName('publisher.name-1.2.3-beta.1');
    assert.ok(out);
    assert.equal(out.version, '1.2.3-beta.1');
  });

  it('parses target platform suffix', () => {
    const out = parseDirName('publisher.name-1.2.3-darwin-x64');
    assert.ok(out);
    assert.equal(out.version, '1.2.3');
    assert.equal(out.targetPlatform, 'darwin-x64');
  });

  it('returns null for non-version-shaped dir', () => {
    const out = parseDirName('.obsolete');
    assert.equal(out, null);
  });

  it('returns null when identifier has no dot', () => {
    const out = parseDirName('noDotInIdentifier-1.0.0');
    assert.equal(out, null);
  });
});

describe('parseVSCodeExtension', () => {
  it('parses a valid extension manifest', async () => {
    const p = resolve(ROOT_BENIGN, 'publisher.benign-ext-1.0.0');
    const res = await parseVSCodeExtension(p);
    assert.ok(res);
    assert.equal(res.manifest.id, 'publisher.benign-ext');
    assert.equal(res.manifest.publisher, 'publisher');
    assert.equal(res.manifest.name, 'benign-ext');
    assert.equal(res.manifest.main, './extension.js');
    assert.ok(Array.isArray(res.manifest.activationEvents));
  });

  it('returns null when package.json missing', async () => {
    const res = await parseVSCodeExtension('/nonexistent/path');
    assert.equal(res, null);
  });
});

describe('discoverVSCodeExtensions', () => {
  it('discovers extensions under rootsOverride', async () => {
    const { extensions, warnings, rootsScanned } = await discoverVSCodeExtensions({
      rootsOverride: [ROOT_BENIGN],
    });
    assert.equal(rootsScanned.length, 1);
    assert.equal(extensions.length, 2);
    const ids = extensions.map(e => e.id).sort();
    assert.deepEqual(ids, ['publisher.benign-ext', 'theme.goodtheme']);
    assert.equal(warnings.length, 0);
  });

  it('reads source/isBuiltin from extensions.json index', async () => {
    const { extensions } = await discoverVSCodeExtensions({
      rootsOverride: [ROOT_MIXED],
    });
    const sideloaded = extensions.find(e => e.id === 'sideloaded.extension');
    assert.ok(sideloaded);
    assert.equal(sideloaded.source, 'vsix');
    assert.equal(sideloaded.isBuiltin, false);
    const gallery = extensions.find(e => e.id === 'wildcard.activator');
    assert.equal(gallery.source, 'gallery');
  });
});

describe('ide-extension-scanner integration', () => {
  beforeEach(() => {
    resetCounter();
  });

  it('benign root: no CRITICAL or HIGH IDE findings', async () => {
    const env = await scan('all', { rootsOverride: [ROOT_BENIGN], vscodeOnly: true });
    assert.equal(env.meta.extensions_discovered.vscode, 2);
    const ideCrit = env.extensions.flatMap(e => e.scanner_results.IDE.findings)
      .filter(f => f.severity === 'critical');
    assert.equal(ideCrit.length, 0, `Expected no CRITICAL, got ${ideCrit.map(f => f.title).join('; ')}`);
  });

  it('detects theme-with-code (HIGH) on evil.theme-with-code', async () => {
    const env = await scan('all', { rootsOverride: [ROOT_MIXED], vscodeOnly: true });
    const ext = env.extensions.find(e => e.id === 'evil.theme-with-code');
    assert.ok(ext, 'evil.theme-with-code not found');
    const themeFindings = ext.scanner_results.IDE.findings.filter(f =>
      f.title.toLowerCase().includes('theme'));
    assert.ok(themeFindings.length >= 1, 'expected theme-with-code finding');
    assert.equal(themeFindings[0].severity, 'high');
  });

  it('detects typosquat (MEDIUM at distance=2 against top-50) on ms-pythom.pythom', async () => {
    const env = await scan('all', { rootsOverride: [ROOT_MIXED], vscodeOnly: true });
    const ext = env.extensions.find(e => e.id === 'ms-pythom.pythom');
    assert.ok(ext);
    const typo = ext.scanner_results.IDE.findings.filter(f =>
      f.title.toLowerCase().includes('typosquat'));
    assert.ok(typo.length >= 1, 'expected typosquat finding');
    assert.equal(typo[0].severity, 'medium');
    assert.ok(typo[0].title.includes('ms-python.python'));
  });

  it('detects sideload (HIGH unsigned) on sideloaded.extension', async () => {
    const env = await scan('all', { rootsOverride: [ROOT_MIXED], vscodeOnly: true });
    const ext = env.extensions.find(e => e.id === 'sideloaded.extension');
    assert.ok(ext);
    const sf = ext.scanner_results.IDE.findings.filter(f =>
      f.title.toLowerCase().includes('sideloaded'));
    assert.ok(sf.length >= 1);
    assert.equal(sf[0].severity, 'high');
  });

  it('detects wildcard activation (MEDIUM) on wildcard.activator', async () => {
    const env = await scan('all', { rootsOverride: [ROOT_MIXED], vscodeOnly: true });
    const ext = env.extensions.find(e => e.id === 'wildcard.activator');
    assert.ok(ext);
    const w = ext.scanner_results.IDE.findings.filter(f =>
      f.title.toLowerCase().includes('wildcard activation'));
    assert.ok(w.length >= 1, 'expected wildcard activation finding');
    assert.equal(w[0].severity, 'medium');
  });

  it('detects dangerous uninstall hook (HIGH) on hook.uninstall', async () => {
    const env = await scan('all', { rootsOverride: [ROOT_MIXED], vscodeOnly: true });
    const ext = env.extensions.find(e => e.id === 'hook.uninstall');
    assert.ok(ext);
    const h = ext.scanner_results.IDE.findings.filter(f =>
      f.title.toLowerCase().includes('uninstall hook'));
    assert.ok(h.length >= 1, 'expected uninstall-hook finding');
    assert.equal(h[0].severity, 'high');
  });

  it('detects extension pack expansion (MEDIUM) on pack.big', async () => {
    const env = await scan('all', { rootsOverride: [ROOT_MIXED], vscodeOnly: true });
    const ext = env.extensions.find(e => e.id === 'pack.big');
    assert.ok(ext);
    const p = ext.scanner_results.IDE.findings.filter(f =>
      f.title.toLowerCase().includes('extension pack'));
    assert.ok(p.length >= 1);
    assert.equal(p[0].severity, 'medium');
  });

  it('top-level verdict is WARNING/BLOCK for mixed root', async () => {
    const env = await scan('all', { rootsOverride: [ROOT_MIXED], vscodeOnly: true });
    assert.ok(
      env.aggregate.verdict === 'WARNING' || env.aggregate.verdict === 'BLOCK',
      `Expected WARNING/BLOCK, got ${env.aggregate.verdict}`,
    );
  });

  it('all findings have DS-IDE- prefix', async () => {
    const env = await scan('all', { rootsOverride: [ROOT_MIXED], vscodeOnly: true });
    for (const ext of env.extensions) {
      const ideFindings = ext.scanner_results.IDE.findings;
      for (const f of ideFindings) {
        assert.ok(f.id.startsWith('DS-IDE-'), `Expected DS-IDE- prefix, got ${f.id}`);
      }
    }
  });

  it('single-target mode scans one extracted directory', async () => {
    const target = resolve(ROOT_BENIGN, 'publisher.benign-ext-1.0.0');
    const env = await scan(target, { vscodeOnly: true });
    assert.equal(env.extensions.length, 1);
    assert.equal(env.extensions[0].id, 'publisher.benign-ext');
  });

  it('discoverAll returns extensions list', async () => {
    const exts = await discoverAll({ rootsOverride: [ROOT_BENIGN] });
    assert.equal(exts.length, 2);
  });

  it('envelope shape is valid', async () => {
    const env = await scan('all', { rootsOverride: [ROOT_BENIGN], vscodeOnly: true });
    assert.ok(env.meta);
    assert.ok(env.extensions);
    assert.ok(env.aggregate);
    assert.ok(env.meta.scanner);
    assert.ok(env.meta.version);
    assert.ok(typeof env.meta.duration_ms === 'number');
    assert.ok(Array.isArray(env.meta.roots_scanned));
    assert.ok(env.aggregate.counts);
    assert.ok(typeof env.aggregate.risk_score === 'number');
  });
});

describe('blocklist matching', () => {
  it('matchBlocklistEntry matches wildcard version', async () => {
    // Unit-test the blocklist logic via scan with custom options — we inject
    // a fake blocklist-matching extension via rootsOverride + custom fixture.
    // Since production blocklist may be empty, we test the code path via a
    // minimal manual check: parse an extension and verify scanner does not
    // crash on empty blocklist.
    const env = await scan('all', { rootsOverride: [ROOT_BENIGN], vscodeOnly: true });
    const allFindings = env.extensions.flatMap(e => e.scanner_results.IDE.findings);
    // No blocklist matches expected for the benign root
    const crit = allFindings.filter(f => f.severity === 'critical');
    assert.equal(crit.length, 0);
  });
});