Show package vulnerabilities in the Visual Studio Package Manager UI #11054
Conversation
chrisraygill
requested review from
anangaur,
aortiz-msft,
dominoFire,
drewgillies,
jebriede,
joelverhagen,
loic-sharma and
skofman1
Updated mockup to accommodate multiple vulnerabilities
| - The warning sign on the Installed tab header will display the number of vulnerable and deprecated packages in the tooltip. | ||
| - The warning icon will appear for all levels of vulnerabilities – consistent with the behavior on NuGet.org. | ||
| - We will use the same warning sign for vulnerabilities as we do for deprecation to avoid the “lucky charms” effect where symbols get ignored because there are too many. | ||
| - The package details window will display a more detailed vulnerability message that includes the total count of advisories and the severities and links to the advisories. |
There was a problem hiding this comment.
nit: when there are multiple advisories, they should be ordered from high to low severity.
There was a problem hiding this comment.
Tracked with this issue: #11091
|
There's a discrepancy between how we show the list of versions in Install Tab between deprecated and vulnerable packages. For deprecated packages we show the word 'deprecated' near each deprecated version, and we don't show anything for vulnerable versions. |
@skofman1 this is being tracked in these issues: |
|
@chgill-MSFT Please feel free to merge this as this has been implemented & approval is there. |
Feature Summary
When a vulnerability in a NuGet package is discovered, surface an indicator of the vulnerability in the Package Manager UI to alert developers and help them take the appropriate action.
Problem
Vulnerabilities in packages can be leveraged by malicious actors to do harm to developers and their users. At the time of writing this, there are 113 NuGet advisories in the GitHub Advisory Database. While package vulnerabilities can be found on NuGet.org and with the dotnet list command, most developer interactions with NuGet occur in the Visual Studio package manager UI where no vulnerability information is currently available.