Offensive360 SAST plugin.

Author: Offensive360

.DS_Store

@@ -0,0 +1,24 @@
+{
+    "root": true,
+    "parser": "@typescript-eslint/parser",
+    "parserOptions": {
+        "ecmaVersion": 6,
+        "sourceType": "module"
+    },
+    "plugins": [
+        "@typescript-eslint"
+    ],
+    "rules": {
+        "@typescript-eslint/naming-convention": "warn",
+        "@typescript-eslint/semi": "warn",
+        "curly": "warn",
+        "eqeqeq": "warn",
+        "no-throw-literal": "warn",
+        "semi": "off"
+    },
+    "ignorePatterns": [
+        "out",
+        "dist",
+        "**/*.d.ts"
+    ]
+}

.eslintrc.json

@@ -0,0 +1,37 @@
+name: Publish VS Code Extension
+
+on:
+  push:
+    branches: [ master, main ]
+  workflow_dispatch:
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Setup Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: "20"
+
+    - name: Install dependencies
+      run: npm install
+
+    - name: Package extension
+      run: npx @vscode/vsce package --no-dependencies
+
+    - name: Upload VSIX artifact
+      uses: actions/upload-artifact@v4
+      with:
+        name: o360-sast-vscode
+        path: "*.vsix"
+        if-no-files-found: error
+        retention-days: 30
+
+    - name: Publish to VS Code Marketplace
+      env:
+        MARKETPLACE_PAT: ${{ secrets.MARKETPLACE_PAT }}
+      run: npx @vscode/vsce publish --no-dependencies -p "$MARKETPLACE_PAT"

.github/workflows/publish.yml

@@ -0,0 +1,6 @@
+out
+dist
+node_modules
+.vscode-test/
+*.vsix
+/.vs

.gitignore

@@ -0,0 +1,7 @@
+{
+	// See http://go.microsoft.com/fwlink/?LinkId=827846
+	// for the documentation about the extensions.json format
+	"recommendations": [
+		"dbaeumer.vscode-eslint"
+	]
+}

.vscode/extensions.json

@@ -0,0 +1,34 @@
+// A launch configuration that compiles the extension and then opens it inside a new window
+// Use IntelliSense to learn about possible attributes.
+// Hover to view descriptions of existing attributes.
+// For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
+{
+	"version": "0.2.0",
+	"configurations": [
+		{
+			"name": "Run Extension",
+			"type": "extensionHost",
+			"request": "launch",
+			"args": [
+				"--extensionDevelopmentPath=${workspaceFolder}"
+			],
+			"outFiles": [
+				"${workspaceFolder}/out/**/*.js"
+			],
+			"preLaunchTask": "${defaultBuildTask}"
+		},
+		{
+			"name": "Extension Tests",
+			"type": "extensionHost",
+			"request": "launch",
+			"args": [
+				"--extensionDevelopmentPath=${workspaceFolder}",
+				"--extensionTestsPath=${workspaceFolder}/out/test/suite/index"
+			],
+			"outFiles": [
+				"${workspaceFolder}/out/test/**/*.js"
+			],
+			"preLaunchTask": "${defaultBuildTask}"
+		}
+	]
+}

.vscode/launch.json

@@ -0,0 +1,11 @@
+// Place your settings in this file to overwrite default and user settings.
+{
+    "files.exclude": {
+        "out": false // set this to true to hide the "out" folder with the compiled JS files
+    },
+    "search.exclude": {
+        "out": true // set this to false to include "out" folder in search results
+    },
+    // Turn off tsc task auto detection since we have the necessary tasks as npm scripts
+    "typescript.tsc.autoDetect": "off"
+}

.vscode/settings.json

@@ -0,0 +1,20 @@
+// See https://go.microsoft.com/fwlink/?LinkId=733558
+// for the documentation about the tasks.json format
+{
+	"version": "2.0.0",
+	"tasks": [
+		{
+			"type": "npm",
+			"script": "watch",
+			"problemMatcher": "$tsc-watch",
+			"isBackground": true,
+			"presentation": {
+				"reveal": "never"
+			},
+			"group": {
+				"kind": "build",
+				"isDefault": true
+			}
+		}
+	]
+}

.vscode/tasks.json

@@ -0,0 +1,11 @@
+.vscode/**
+.vscode-test/**
+src/**
+.gitignore
+.eslintrc.json
+tsconfig.json
+vsc-extension-quickstart.md
+**/node_modules/**
+**/.DS_Store
+*.ts
+!out/**

.vscodeignore

@@ -0,0 +1,40 @@
+# Change Log
+
+All notable changes to the O360 SAST extension will be documented in this file.
+
+## [1.0.0] - 2026-03-10
+
+### Added
+- Dedicated sidebar panel with vulnerability tree view (grouped by severity, file, and finding)
+- Six code actions: Fix Recommendation, Explain Vulnerability, View References, Suppress, Mark as False Positive, Clear All
+- Rich WebView detail panel with tabbed UI (Vulnerability Details, How to Fix, References)
+- Hover provider showing inline vulnerability summary with action links
+- File-level scanning via right-click context menu
+- Auto-scan on save (configurable in settings)
+- Dependency scanning (SCA) toggle
+- License compliance scanning toggle
+- Malware detection scanning toggle
+- Native VS Code progress notifications with cancellation support
+- Status bar indicator showing scan status and finding count
+- Output channel for scan logging and debugging
+- False positive tracking with reason tags in `.SASTO360/sastIgnore`
+
+### Changed
+- Rebranded from "Offensive 360" to "O360 SAST"
+- Updated settings namespace from `offensive.*` to `o360.*`
+- Upgraded to TypeScript 5, axios 1.6, VS Code engine 1.75+
+- Improved progress UX using VS Code native progress API
+- Better error messages with quick-link to settings
+
+### Fixed
+- Numeric enum mapping from API (riskLevel and status returned as numbers)
+- HTML entity decoding in vulnerability descriptions
+- Escape sequence handling (`\r\n`) in API response text fields
+- Deprecated `new Buffer()` constructor usage
+
+## [0.2.0] - 2023-12-18
+
+- Initial marketplace release
+- Basic folder and workspace scanning
+- Simple diagnostic display
+- Get Help, Suppress, Clear All Errors code actions