- About this Extension
- Getting Started
- The Local View
- The CI View
- Extension Settings
- Troubleshooting
- License
- Building and Testing the Sources
- Code Contributions
The cost of remediating a vulnerability is akin to the cost of fixing a bug. The earlier you remediate a vulnerability in the release cycle, the lower the cost. The extension allows developers to find and fix security vulnerabilities in their projects and to see valuable information about the status of their code by continuously scanning it locally with JFrog Xray.
Scan your project dependencies for security issues. For selected security issues, get leverage-enhanced CVE data that is provided by our JFrog Security Research team. To learn more about enriched CVEs, see here
Requires Xray version 3.66.5 or above and Enterprise X / Enterprise+ subscription with Advanced DevSecOps.
With advanced Contextual Analysis, understand the applicability of CVEs in your application and utilize JFrog Security scanners to analyze the way you use 3rd party packages in your projects. Automatically validate some high-impact vulnerabilities, such as vulnerabilities that have prerequisites for exploitations, and reduce false positives and vulnerability noise with smart CVE analysis.
To learn more, see here.
Features | Go | Maven | npm | Yarn v1 | Pypi | .NET |
---|---|---|---|---|---|---|
SCA | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
Upgrade vulnerable dependencies to fixed versions | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
Contextual Analysis | ❌ | ❌ | ✅ | ✅ | ✅ | ❌ |
- Security issues are easily visible inline.
- The results show issues with context, impact, and remediation.
- View all security issues in one place, in the JFrog tab.
- For Security issues with an available fixed version, you can upgrade to the fixed version within the plugin.
- Track the status of the code while it is being built, tested, and scanned on the CI server.
The extension also applies JFrog File Spec JSON schema on the following file patterns: **/filespecs/*.json
, *filespec*.json
and *.filespec
. Read more about JFrog File specs here.
- Install the JFrog extension in VS Code
- Connect VS Code to Your JFrog Environment
- Start using the extension
The extension is available to install from the VS Code extensions marketplace. after installing the JFrog extension tab will appear in the activity bar
Run one of the following commands in your terminal.
MacOS and Linux using cUrl
curl -fL "https://getcli.jfrog.io?setup" | sh
Windows using PowerShell
powershell "Start-Process -Wait -Verb RunAs powershell '-NoProfile iwr https://releases.jfrog.io/artifactory/jfrog-cli/v2-jf/[RELEASE]/jfrog-cli-windows-amd64/jf.exe -OutFile $env:SYSTEMROOT\system32\jf.exe'" ; jf setup
The commands will do the following:
- Install JFrog CLI on your machine.
- Create a FREE JFrog environment in the cloud for you.
- Configure VS Code to connect to your new environment.
Connect to your JFrog environment by clicking on the green Connect button or the provided button in the JFrog extension tab:
You can choose the method that the extension will get your credentials:
JFrog CLI
Try to get and use the credentials that is used by JFrog CLI, if installed and configured.
Enter credentials
Enter your JFrog platform information manually and provide the needed credentials (username + password / access token).
Note: You can leave the platform URL empty, to enter the separate URLs for Artifactory and Xray.
Environment Variables
You may provide basic auth credentials or access token as follows:
JFROG_IDE_URL
- JFrog URLJFROG_IDE_USERNAME
- JFrog usernameJFROG_IDE_PASSWORD
- JFrog passwordJFROG_IDE_ACCESS_TOKEN
- JFrog access tokenJFROG_IDE_STORE_CONNECTION
- Set the value of this environment variable to true, if you'd like VS Code to store the connection details after reading them from the environment variables.
Note: For security reasons, it is recommended to unset the environment variables after launching VS Code.
The extension offers two modes, Local and CI. The two modes can be toggled by pressing on their respective buttons that will appear next to the components tree.
- The Local view displays information about the local code as it is being developed in VS Code. The developer can scan their local workspace continuously. The information is displayed in the Local view.
- The CI view allows the tracking of the code as it is built, tested and scanned by the CI server. It displays information about the status of the build and includes a link to the build log on the CI server.
The icon demonstrates the top severity issue of a selected component and its transitive dependencies. The following table describes the severities from highest to lowest:
The local view of the extension adds JFrog Xray scanning of project dependencies and source code to your VS Code IDE. It allows developers to view panels displaying vulnerability information about their dependencies and source code in their VS Code IDE. With this information, a developer can make an informed decision on whether to use a component or not before it gets entrenched into the organization’s product.
scan your workspace by clicking the Scan/Rescan button, the icon at the extension tab or click on Start Xray Scan from within the editor. The scan will create a list of files with vulnerabilities in the workspace.
View all the discovered files with vulnerabilities in a tree. Each descriptor file (like pom.xml in Maven, go.mod in Go, etc.) in the list contains vulnerable dependencies, and each dependency contains the vulnerabilities themselves. Other source code files contains a list of vulnerabilities for each location at the file. In addition the locations with vulnerabilities will be marked in the editor and you can jump from vulnerable location in the editor to the matching entry at the tree by clicking on th light bulb.
Clicking a vulnerability in the list will open the location with the issue in the editor and a vulnerability details view. This view contains information about the vulnerability, the vulnerable component, fixed versions, impact paths and much more.
CVE Research and Enrichment
For selected security issues, get leverage-enhanced CVE data that is provided by our JFrog Security Research team. Prioritize the CVEs based on:- JFrog Severity: The severity given by the JFrog Security Research team after the manual analysis of the CVE by the team. CVEs with the highest JFrog security severity are the most likely to be used by real-world attackers. This means that you should put effort into fixing them as soon as possible.
- Research Summary: The summary that is based on JFrog's security analysis of the security issue provides detailed technical information on the specific conditions for the CVE to be applicable. Remediation: Detailed fix and mitigation options for the CVEs
Check out what our research team is up to and stay updated on newly discovered issues by clicking on this link.
Contextual Analysis
Xray automatically validates some high and very high impact vulnerabilities, such as vulnerabilities that have prerequisites for exploitations, and provides contextual analysis information for these vulnerabilities, to assist you in figuring out which vulnerabilities need to be fixed. Contextual Analysis data includes:- Contextual analysis status: Contextual analysis results indicating if a CVE was found applicable in your application or not applicable.
- Contextual Analysis breakdown: An explanation provided by our research team as to why the CVE was found applicable or not applicable.
- Remediation: Contextual mitigation steps and options provided by our research team that assist you with remediating the issues.
Update a vulnerable direct dependency to a fixed version directly from the vulnerable location at the editor using quick fix
If Xray watches are used, on an icon vulnerability line an closed eye icon will appear by clicking on it you can create an Ignore Rule in Xray.
Behind the scenes, the JFrog VS Code Extension scans all the project dependencies, both direct and indirect (transitive), even if they are not declared in the project's go.mod. It builds the Go dependencies tree by running go mod graph
and intersecting the results with go list -f '{{with .Module}}{{.Path}} {{.Version}}{{end}}' all
command. Therefore, please make sure to have Go CLI in your system PATH.
The JFrog VS Code Extension builds the Maven dependencies tree by running mvn dependency:tree
. View licenses and top issue severities directly from the pom.xml.
Important notes:
- To have your project dependencies scanned by JFrog Xray, make sure Maven is installed, and that the mvn command is in your system PATH.
- For projects which include the Maven Dependency Plugin as a build plugin, with include or exclude configurations, the scanning functionality is disabled. For example:
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-dependency-plugin</artifactId>
<configuration>
<includes>org.apache.*</includes>
</configuration>
</plugin>
</plugins>
Behind the scenes, the extension builds the npm dependencies tree by running npm list
. View licenses and top issue severities directly from the package.json.
Important:
To have your project dependencies scanned by JFrog Xray, make sure the npm CLI is installed on your local machine and that it is in your system PATH.
In addition, the project dependencies must be installed using npm install
.
Behind the scenes, the extension builds the Yarn dependencies tree by running yarn list
. View licenses and top issue severities directly from the yarn.lock.
Important:
- To have your project dependencies scanned by JFrog Xray, make sure the Yarn CLI is installed on your local machine and that it is in your system PATH.
- Yarn v2 is not yet supported.
Behind the scenes, the extension builds the Pypi dependencies tree by running pipdeptree
on your Python virtual environment. It also uses the Python interpreter path configured by the Python extension. View licenses and top issue severities directly from your requirements.txt files. The scan your Pypi dependencies, make sure the following requirements are met:
-
The Python extension for VS Code is installed.
-
Depending on your project, Please make sure Python 2 or 3 are included in your system PATH.
-
Create and activate a virtual env as instructed in VS-Code documentation. Make sure that Virtualenv Python interpreter is selected as instructed here.
-
Open a new terminal and activate your Virtualenv:
-
On macOS and Linux:
source <venv-dir>/bin/activate # For example: source .env/bin/activate
-
On Windows:
.\<venv-dir>\Scripts\activate # For example: .\env\Scripts\activate
-
-
In the same terminal, install your python project and dependencies according to your project specifications.
For .NET projects which use NuGet packages as dependencies, the extension displays the NuGet dependencies tree, together with the information for each dependency. Behind the scenes, the extension builds the NuGet dependencies tree using the NuGet deps tree npm package.
Important:
- Does your project define its NuGet dependencies using a packages.config file? If so, then please make sure the
nuget
CLI is installed on your local machine and that it is in your system PATH. The extension uses thenuget
CLI to find the location of the NuGet packages on the local file-system. - The project must be restored using
nuget restore
ordotnet restore
prior to scanning. After this action, you should click on the Refresh button, for the tree view to be refreshed and updated.
The CI view of the extension allows you to view information about your builds directly from your CI system. This allows developers to keep track of the status of their code, while it is being built, tested and scanned as part of the CI pipeline, regardless of the CI provider used.
This information can be viewed inside JFrog VS Code Extension, from the JFrog Panel, after switching to CI mode.
The following details can be made available in the CI view.
- Status of the build run (passed or failed)
- Build run start time
- Git branch and latest commit message
- Link to the CI run log
- Security information about the build artifacts and dependencies
The CI information displayed in VS Code is pulled by the JFrog Extension directly from JFrog Artifactory. This information is stored in Artifactory as part of the build-info, which is published to Artifactory by the CI server.
Read more about build-info in the Build Integration documentation page. If the CI pipeline is also configured to scan the build-info by JFrog Xray, the JFrog VS Code Extension will pull the results of the scan from JFrog Xray and display them in the CI view as well.
Before VS Code can display information from your CI in the CI View, your CI pipeline needs to be configured to expose this data. Read this guide which describes how to configure your CI pipeline.
Set your CI build name in the Build name pattern field at the Extension Settings. This is the name of the build published to Artifactory by your CI pipeline. You have the option of setting * to view all the builds published to Artifactory.
After your builds were fetched from Artifactory, press on the Builds button to choose what build to display.
To open the extension settings, use the extension settings icon: Or use the following VS Code menu command:
- On Windows/Linux - File > Preferences > Settings > Extensions > JFrog
- On macOS - Code > Preferences > Settings > Extensions > JFrog
You can configure the JFrog VS-Code extension to use the security policies you create in Xray. Policies enable you to create a set of rules, in which each rule defines security criteria, with a corresponding set of automatic actions according to your needs. Policies are enforced when applying them to Watches.
If you'd like to use a JFrog Project that is associated with the policy, follow these steps:
- Create a JFrog Project, or obtain the relevant JFrog Project key.
- Create a Policy on JFrog Xray.
- Create a Watch on JFrog Xray and assign your Policy and Project as resources to it.
- Configure your Project key in the Extension Settings.
If however your policies are referenced through an Xray Watch or Watches, follow these steps instead:
- Create one or more Watches on JFrog Xray.
- Configure your Watches in the Extension Settings.
By default, paths containing the words test
, venv
and node_modules
are excluded from Xray scan.
The exclude pattern can be configured in the Extension Settings.
If your JFrog environment is behind an HTTP/S proxy, follow these steps to configure the proxy server:
- Go to Preferences --> Settings --> Application --> Proxy
- Set the proxy URL under 'Proxy'.
- Make sure 'Proxy Support' is 'override' or 'on'.
- Alternatively, you can use the HTTP_PROXY and HTTPS_PROXY environment variables.
If your proxy server requires credentials, follow these steps:
- Follow 1-3 steps under Proxy configuration.
- Encode with base64:
[Username]:[Password]
. - Under 'Proxy Authorization' click on 'Edit in settings.json'.
- Add to settings.json:
"http.proxyAuthorization": "Basic [Encoded credentials]"
.
- Under 'Proxy Authorization' click on 'Edit in settings.json'.
- Add to settings.json:
"http.proxyAuthorization": "Bearer [Access token]"
.
Username: foo
Password: bar
settings.json:
{
"http.proxyAuthorization": "Basic Zm9vOmJhcg=="
}
Change the log level to 'debug', 'info', 'warn', or 'err' in the Extension Settings.
The extension is licensed under Apache License 2.0.
- npm 7 and above
- JFrog CLI's
jf
executable - required for tests
To build the extension from sources, please follow these steps:
- Clone the code from Github.
- Update submodules:
git submodule init
git submodule update
- Build and create the VS-Code extension vsix file by running the following npm command:
npm i
npm run package
After the build finishes, you'll find the vsix file in the jfrog-vscode-extension directory. The vsix file can be loaded into VS-Code
To run the tests:
npm t
We welcome community contribution through pull requests.
- Before creating your first pull request, please join our contributors community by signing JFrog's CLA.
- If the existing tests do not already cover your changes, please add tests.
- Pull requests should be created on the dev branch.
- Please run
npm run format
for formatting the code before submitting the pull request.