From 0c916cded6d9bdf1bf51d95dcc64eeaa61f95176 Mon Sep 17 00:00:00 2001 From: Daniel Federschmidt Date: Mon, 20 Jul 2026 16:38:23 +0200 Subject: [PATCH 1/3] fix vulns --- .eslintrc.json | 3 +- .github/workflows/ci.yml | 21 +- .github/workflows/docs_deploy.yml | 9 +- .nvmrc | 1 + .vscode/extensions.json | 2 +- .vscode/launch.json | 14 - .vscode/settings.json | 4 +- .vscode/tasks.json | 30 +- .vscodeignore | 5 +- .yarnrc | 1 - README.md | 86 + app/build/appwizard.js | 4859 ++-- app/build/appwizard.js.LICENSE.txt | 24 + app/build/appwizard.js.map | 2 +- app/build/playbookviewer.js | 1481 -- app/build/playbookviewer.js.LICENSE.txt | 59 - app/build/playbookviewer.js.map | 1 - app/src/appWizard/AppWizard.jsx | 54 +- app/src/playbookViewer/DataPanel.js | 83 - app/src/playbookViewer/Flow.js | 204 - app/src/playbookViewer/PlaybookRunInput.js | 38 - app/src/playbookViewer/PlaybookViewer.css | 49 - app/src/playbookViewer/PlaybookViewer.jsx | 46 - app/src/playbookViewer/context.js | 2 - app/src/playbookViewer/index.js | 14 - app/src/playbookViewer/nodes/ActionNode.js | 22 - app/src/playbookViewer/nodes/CodeNode.js | 18 - .../nodes/CustomFunctionNode.js | 19 - app/src/playbookViewer/nodes/DecisionNode.js | 18 - app/src/playbookViewer/nodes/FilterNode.js | 18 - app/src/playbookViewer/nodes/FormatNode.js | 18 - app/src/playbookViewer/nodes/PlaybookNode.js | 22 - app/src/playbookViewer/nodes/PromptNode.js | 18 - app/src/playbookViewer/nodes/StartEndNode.js | 24 - docs/docs/development-guide/documentation.md | 4 +- docs/docs/development-guide/extension.md | 2 +- docs/docusaurus.config.js | 11 +- docs/package-lock.json | 21749 ---------------- docs/package.json | 31 +- docs/yarn.lock | 16164 ++++++------ package-lock.json | 6937 ----- package.json | 98 +- src/commands/commands.ts | 7 +- src/inspect/inspect.ts | 3 +- src/soar/models.ts | 4 +- src/webviews/visualPlaybookViewer.ts | 230 - tsconfig.json | 3 +- webpack.config.js | 12 +- yarn.lock | 4882 ++-- 49 files changed, 14896 insertions(+), 42510 deletions(-) create mode 100644 .nvmrc delete mode 100644 .yarnrc delete mode 100644 app/build/playbookviewer.js delete mode 100644 app/build/playbookviewer.js.LICENSE.txt delete mode 100644 app/build/playbookviewer.js.map delete mode 100644 app/src/playbookViewer/DataPanel.js delete mode 100644 app/src/playbookViewer/Flow.js delete mode 100644 app/src/playbookViewer/PlaybookRunInput.js delete mode 100644 app/src/playbookViewer/PlaybookViewer.css delete mode 100644 app/src/playbookViewer/PlaybookViewer.jsx delete mode 100644 app/src/playbookViewer/context.js delete mode 100644 app/src/playbookViewer/index.js delete mode 100644 app/src/playbookViewer/nodes/ActionNode.js delete mode 100644 app/src/playbookViewer/nodes/CodeNode.js delete mode 100644 app/src/playbookViewer/nodes/CustomFunctionNode.js delete mode 100644 app/src/playbookViewer/nodes/DecisionNode.js delete mode 100644 app/src/playbookViewer/nodes/FilterNode.js delete mode 100644 app/src/playbookViewer/nodes/FormatNode.js delete mode 100644 app/src/playbookViewer/nodes/PlaybookNode.js delete mode 100644 app/src/playbookViewer/nodes/PromptNode.js delete mode 100644 app/src/playbookViewer/nodes/StartEndNode.js delete mode 100644 docs/package-lock.json delete mode 100644 package-lock.json delete mode 100644 src/webviews/visualPlaybookViewer.ts diff --git a/.eslintrc.json b/.eslintrc.json index f9b22b7..87b1c0b 100644 --- a/.eslintrc.json +++ b/.eslintrc.json @@ -10,11 +10,10 @@ ], "rules": { "@typescript-eslint/naming-convention": "warn", - "@typescript-eslint/semi": "warn", "curly": "warn", "eqeqeq": "warn", "no-throw-literal": "warn", - "semi": "off" + "semi": "warn" }, "ignorePatterns": [ "out", diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cb24d5c..2244755 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -10,15 +10,16 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 - - uses: actions/setup-node@v3 + - uses: actions/checkout@v4 + - uses: actions/setup-node@v4 with: - node-version: 18 + node-version: 22.18.0 + cache: yarn - run: yarn install --frozen-lockfile env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - run: npx vsce package --out vscode-splunk-soar.vsix - - uses: actions/upload-artifact@v3 + - run: yarn vsce package --out vscode-splunk-soar.vsix + - uses: actions/upload-artifact@v4 with: name: vscode-splunk-soar.vsix path: "*.vsix" @@ -28,7 +29,13 @@ jobs: needs: build if: success() && startsWith( github.ref, 'refs/tags/') steps: - - uses: actions/download-artifact@v3 + - uses: actions/checkout@v4 + - uses: actions/setup-node@v4 + with: + node-version: 22.18.0 + cache: yarn + - run: yarn install --frozen-lockfile + - uses: actions/download-artifact@v4 with: name: vscode-splunk-soar.vsix - uses: ncipollo/release-action@v1 @@ -36,6 +43,6 @@ jobs: artifacts: "*.vsix" token: ${{ secrets.GITHUB_TOKEN }} - - run: npx vsce publish --packagePath $(find . -type f -iname '*.vsix') + - run: yarn vsce publish --packagePath vscode-splunk-soar.vsix env: VSCE_PAT: ${{ secrets.VSCE_PAT }} diff --git a/.github/workflows/docs_deploy.yml b/.github/workflows/docs_deploy.yml index 14907d1..25fd4e6 100644 --- a/.github/workflows/docs_deploy.yml +++ b/.github/workflows/docs_deploy.yml @@ -12,11 +12,12 @@ jobs: name: Deploy to GitHub Pages runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 - - uses: actions/setup-node@v3 + - uses: actions/checkout@v4 + - uses: actions/setup-node@v4 with: - node-version: 18 + node-version: 22.18.0 cache: yarn + cache-dependency-path: docs/yarn.lock - name: Install dependencies working-directory: docs run: yarn install --frozen-lockfile @@ -39,5 +40,3 @@ jobs: # You can swap them out with your own user credentials. user_name: github-actions[bot] user_email: 41898282+github-actions[bot]@users.noreply.github.com - - diff --git a/.nvmrc b/.nvmrc new file mode 100644 index 0000000..91d5f6f --- /dev/null +++ b/.nvmrc @@ -0,0 +1 @@ +22.18.0 diff --git a/.vscode/extensions.json b/.vscode/extensions.json index 57dbdae..c0a2258 100644 --- a/.vscode/extensions.json +++ b/.vscode/extensions.json @@ -1,5 +1,5 @@ { // See http://go.microsoft.com/fwlink/?LinkId=827846 // for the documentation about the extensions.json format - "recommendations": ["dbaeumer.vscode-eslint", "amodio.tsl-problem-matcher"] + "recommendations": ["dbaeumer.vscode-eslint"] } diff --git a/.vscode/launch.json b/.vscode/launch.json index 343ee6f..135612e 100644 --- a/.vscode/launch.json +++ b/.vscode/launch.json @@ -17,20 +17,6 @@ "${workspaceFolder}/dist/**/*.js" ], "preLaunchTask": "${defaultBuildTask}" - }, - { - "name": "Extension Tests", - "type": "extensionHost", - "request": "launch", - "args": [ - "--extensionDevelopmentPath=${workspaceFolder}", - "--extensionTestsPath=${workspaceFolder}/out/test/suite/index" - ], - "outFiles": [ - "${workspaceFolder}/out/**/*.js", - "${workspaceFolder}/dist/**/*.js" - ], - "preLaunchTask": "tasks: watch-tests" } ] } diff --git a/.vscode/settings.json b/.vscode/settings.json index ce34750..c8164ee 100644 --- a/.vscode/settings.json +++ b/.vscode/settings.json @@ -8,7 +8,7 @@ "out": true, // set this to false to include "out" folder in search results "dist": true // set this to false to include "dist" folder in search results }, - // Turn off tsc task auto detection since we have the necessary tasks as npm scripts + // Turn off tsc task auto detection since we have the necessary Yarn scripts "typescript.tsc.autoDetect": "off", "git.mergeEditor": true -} \ No newline at end of file +} diff --git a/.vscode/tasks.json b/.vscode/tasks.json index 2acd96d..40d111f 100644 --- a/.vscode/tasks.json +++ b/.vscode/tasks.json @@ -4,11 +4,12 @@ "version": "2.0.0", "tasks": [ { - "type": "npm", - "script": "watch", + "label": "yarn: watch", + "type": "shell", + "command": "yarn", + "args": ["watch"], "problemMatcher": [ - "$ts-webpack-watch", - "$tslint-webpack-watch" + "$ts-webpack-watch" ], "isBackground": true, "presentation": { @@ -19,25 +20,6 @@ "kind": "build", "isDefault": true } - }, - { - "type": "npm", - "script": "watch-tests", - "problemMatcher": "$tsc-watch", - "isBackground": true, - "presentation": { - "reveal": "never", - "group": "watchers" - }, - "group": "build" - }, - { - "label": "tasks: watch-tests", - "dependsOn": [ - "npm: watch", - "npm: watch-tests" - ], - "problemMatcher": [] } ] -} \ No newline at end of file +} diff --git a/.vscodeignore b/.vscodeignore index ab31306..872dea1 100644 --- a/.vscodeignore +++ b/.vscodeignore @@ -11,4 +11,7 @@ vsc-extension-quickstart.md **/.eslintrc.json **/*.map **/*.ts -docs/** \ No newline at end of file +docs/** +.github/** +.nvmrc +audits/** diff --git a/.yarnrc b/.yarnrc deleted file mode 100644 index f757a6a..0000000 --- a/.yarnrc +++ /dev/null @@ -1 +0,0 @@ ---ignore-engines true \ No newline at end of file diff --git a/README.md b/README.md index 9293442..1238961 100644 --- a/README.md +++ b/README.md @@ -113,6 +113,92 @@ Execution logs can be displayed by: * right-clicking on a run listed under the Playbook Runs View * clicking on "Logs" +## Development + +### Prerequisites + +- VS Code 1.101 or newer +- Node.js 22.18.0 (the repository includes an `.nvmrc`) +- Yarn 1.22.22 + +This repository uses Yarn exclusively. Do not use npm to install or update dependencies; the root extension and the documentation site each have their own `yarn.lock`. + +### Set up the repository + +```bash +git clone https://github.com/splunk/vscode-extension-splunk-soar.git +cd vscode-extension-splunk-soar +nvm use +yarn install --frozen-lockfile +code . +``` + +If the requested Node.js version is not installed yet, run `nvm install` before `nvm use`. + +### Inner development loop + +1. Open **Run and Debug** in VS Code and start the **Run Extension** configuration, or press `F5`. +2. The default `yarn: watch` task starts webpack in watch mode and opens an Extension Development Host window with a temporary VS Code profile. +3. Exercise the change in the Extension Development Host. Open the Splunk SOAR view or invoke a contributed command to activate the extension. +4. After changing extension or webview source code, wait for webpack to finish rebuilding, then run **Developer: Reload Window** in the Extension Development Host to load the new bundles. +5. Set breakpoints in `src/` and inspect extension-host output in the Debug Console. Webview code is bundled from `app/src/` into `app/build/`. + +The temporary profile does not inherit environments configured in your regular VS Code profile. If a change requires a SOAR connection, configure a non-production SOAR environment inside the Extension Development Host. + +### Local checks + +Run these before opening a pull request: + +```bash +# Type-check the extension without emitting JavaScript +yarn check-types + +# Lint extension and webview sources +yarn lint + +# Create development bundles once, without watch mode +yarn compile + +# Create optimized production bundles +yarn package + +# Build the same VSIX artifact produced by CI +yarn vsce package --out vscode-splunk-soar.vsix +``` + +The current lint configuration reports an existing warning backlog but should complete with zero errors. Webpack also reports bundle-size recommendations for the webviews; these warnings do not fail the build. + +There is currently no automated extension-host test suite. The required verification is type-checking, linting, production bundling, and exercising the affected workflow in the Extension Development Host. + +### Updating dependencies + +Run dependency commands from the directory whose manifest is being updated: + +```bash +# Runtime dependency +yarn add + +# Development dependency +yarn add --dev + +# Remove a dependency +yarn remove +``` + +Commit both the affected `package.json` and its `yarn.lock`. Verify the resulting graph with `yarn install --frozen-lockfile` and `yarn audit`. + +### Documentation site + +The Docusaurus site is an independent Yarn project under `docs/`: + +```bash +cd docs +yarn install --frozen-lockfile +yarn start +``` + +The development server is available at [http://localhost:3000](http://localhost:3000). Run `yarn build` from `docs/` to verify a production documentation build. + ## Documentation The documentation is located on https://splunk.github.io/vscode-extension-splunk-soar/ and hosted via Github Pages. diff --git a/app/build/appwizard.js b/app/build/appwizard.js index e90fe63..d23fdac 100644 --- a/app/build/appwizard.js +++ b/app/build/appwizard.js @@ -1,1481 +1,3420 @@ /*! For license information please see appwizard.js.LICENSE.txt */ -(()=>{"use strict";var e={4448:(e,t,n)=>{var i=n(7294),r=n(3840);function o(e){for(var t="https://reactjs.org/docs/error-decoder.html?invariant="+e,n=1;n