Offensive360 SAST plugin.

Author: Offensive360

.DS_Store

@@ -1,8 +1,8 @@
 {
   "name": "offensive360",
   "displayName": "O360 SAST",
-  "description": "Enterprise static application security testing \u00e2\u20ac\u201d find and fix vulnerabilities directly in your editor",
-  "version": "1.1.4",
+  "description": "Enterprise static application security testing — find and fix vulnerabilities directly in your editor",
+  "version": "1.1.9",
   "publisher": "Offensive360",
   "license": "SEE LICENSE IN offensive-license-terms.md",
   "repository": {
@@ -53,7 +53,7 @@
         },
         "o360.accessToken": {
           "type": "string",
-          "description": "API access token (generated from O360 SAST dashboard under Settings \u00e2\u2020\u2019 Tokens)",
+          "description": "API access token (generated from O360 SAST dashboard under Settings → Tokens)",
           "default": "",
           "order": 2
         },
@@ -145,6 +145,10 @@
         "command": "o360.refreshTree",
         "title": "Refresh",
         "icon": "$(refresh)"
+      },
+      {
+        "command": "o360.checkForUpdates",
+        "title": "Offensive 360: Check for Updates"
       }
     ],
     "menus": {

.vscode/extensions.json

@@ -19,6 +19,7 @@ export const COMMANDS = {
     CLEAR_ALL: 'o360.clearAll',
     REFRESH_TREE: 'o360.refreshTree',
     FOCUS_VULNERABILITY: 'o360.focusVulnerability',
+    CHECK_UPDATE: 'o360.checkForUpdates',
 } as const;
 
 export const VIEWS = {
@@ -43,26 +44,55 @@ export const SEVERITY_ICONS: Record<string, string> = {
     'Info': '$(info)',
 };
 
+// KEEP IN LOCKSTEP with VS plugin's ScanCache.ExcludeExts and AS plugin's
+// FileCollector.EXCLUDE_EXTS. Any change here MUST be mirrored in the other
+// two plugins — otherwise the three IDEs will start producing different
+// finding counts for the same project (VS v1.12.11 / AS v1.1.9 / VSCode v1.1.6
+// incident: 106 / 74 / ?? on the same WebGoat.NET).
+//
+// All entries must be LOWERCASE because the check is now case-insensitive.
 export const EXCLUDED_EXTENSIONS = new Set([
-    '.DS_Store', '.ipr', '.iws', '.bak', '.tmp',
-    '.aac', '.aif', '.iff', '.m3u', '.mid', '.mp3', '.mpa', '.ra', '.wav', '.wma',
-    '.3g2', '.3gp', '.asf', '.asx', '.avi', '.flv', '.mov', '.mp4', '.mpg', '.rm', '.swf', '.vob', '.wmv',
-    '.bmp', '.gif', '.jpg', '.jpeg', '.png', '.psd', '.tif', '.tiff', '.ico', '.svg', '.webp',
-    '.jar', '.zip', '.rar', '.exe', '.dll', '.pdb', '.7z', '.gz', '.tar', '.war', '.ear',
-    '.class', '.iml', '.o', '.so', '.dylib', '.pyc', '.pyo',
-    '.woff', '.woff2', '.ttf', '.eot', '.otf',
-    '.pdf', '.doc', '.docx', '.xls', '.xlsx', '.ppt', '.pptx',
-    '.sqlite', '.db', '.lock',
+    '.zip', '.dll', '.pdf', '.exe', '.ds_store', '.bak', '.tmp',
+    '.mp3', '.mp4', '.wav', '.avi', '.mov', '.wmv', '.flv',
+    '.bmp', '.gif', '.jpg', '.jpeg', '.png', '.psd', '.tif', '.tiff', '.ico', '.svg',
+    '.jar', '.rar', '.7z', '.gz', '.tar', '.war', '.ear',
+    '.pdb', '.class', '.iml', '.nupkg', '.vsix', '.aar',
+    '.woff', '.woff2', '.ttf', '.otf', '.eot',
+    '.db', '.sqlite', '.mdb', '.lock',
+    '.sln', '.csproj', '.vbproj', '.vcxproj', '.fsproj', '.proj',
+    '.suo', '.user', '.cache', '.snk', '.pfx', '.p12',
 ]);
 
+// KEEP IN LOCKSTEP with VS plugin's ScanCache.ExcludeFolders and AS plugin's
+// FileCollector.SKIP_DIRS. Case-insensitive check — all entries lowercase.
+// NOTE: backup<N> folders are matched by isExcludedFolder() pattern in
+// fileService.ts, not by this literal set, so don't add backup4/5/etc here.
 export const EXCLUDED_DIRS = new Set([
-    'node_modules', '.git', '.svn', '.hg', '.bzr',
-    'bin', 'obj', 'out', 'dist', 'build', 'target',
-    '.idea', '.vscode', '.vs',
-    'backup', '__pycache__', '.cache',
-    'vendor', 'packages', 'bower_components',
-    'coverage', '.nyc_output',
+    '.vs', 'cvs', '.svn', '.hg', '.git', '.bzr', 'bin', 'obj',
+    '.idea', '.vscode', 'node_modules', 'packages',
+    'dist', 'build', 'out', 'target', '.gradle', '__pycache__',
+    '.sasto360', 'testresults', 'test-results', '.nuget',
+    '.node_modules', '.pytest_cache', '.next', 'coverage',
 ]);
 
+/**
+ * True if the given single-segment folder name should be skipped.
+ * Combines literal-set lookup with a pattern match for backup folders so
+ * VS migration's auto-created Backup4/Backup5 (and any future variant)
+ * is automatically excluded without updating the literal list. Matches
+ * "backup", "backups", or "backup<digits>".
+ */
+export function isExcludedFolder(name: string): boolean {
+    if (!name) return false;
+    const lower = name.toLowerCase();
+    if (EXCLUDED_DIRS.has(lower)) return true;
+    if (lower === 'backup' || lower === 'backups') return true;
+    if (lower.startsWith('backup') && lower.length > 6) {
+        const tail = lower.substring(6);
+        return /^\d+$/.test(tail);
+    }
+    return false;
+}
+
 export const MAX_QUEUE_WAIT_MINUTES = 60;
 export const QUEUE_POLL_INTERVAL_SEC = 10;

.vscode/launch.json

@@ -173,6 +173,50 @@ export function activate(context: vscode.ExtensionContext) {
         editor.revealRange(range, vscode.TextEditorRevealType.InCenter);
     }));
 
+    // Check for Updates
+    context.subscriptions.push(vscode.commands.registerCommand(COMMANDS.CHECK_UPDATE, async () => {
+        const currentVersion = context.extension.packageJSON.version || '1.1.8';
+        const apiUrl = 'https://api.github.com/repos/offensive360/VSCode/releases/latest';
+        try {
+            const https = await import('https');
+            const body: string = await new Promise((resolve, reject) => {
+                const req = https.get(apiUrl, {
+                    headers: { 'User-Agent': `Offensive360-VSCode/${currentVersion}`, 'Accept': 'application/vnd.github+json' },
+                    timeout: 15000
+                }, (res) => {
+                    if (res.statusCode !== 200) { reject(new Error(`HTTP ${res.statusCode}`)); return; }
+                    let data = '';
+                    res.on('data', (chunk: string) => data += chunk);
+                    res.on('end', () => resolve(data));
+                });
+                req.on('error', reject);
+                req.on('timeout', () => { req.destroy(); reject(new Error('Timeout')); });
+            });
+            const release = JSON.parse(body);
+            const latestVersion = (release.tag_name || '').replace(/^v/i, '');
+            if (!latestVersion) {
+                vscode.window.showInformationMessage('Could not determine the latest version.');
+                return;
+            }
+            const isNewer = latestVersion.localeCompare(currentVersion, undefined, { numeric: true }) > 0;
+            if (!isNewer) {
+                vscode.window.showInformationMessage(`Offensive 360: You're up to date (v${currentVersion}).`);
+                return;
+            }
+            const notes = (release.body || '').substring(0, 500);
+            const action = await vscode.window.showInformationMessage(
+                `Offensive 360: v${latestVersion} is available (you have v${currentVersion}).\n\n${notes}`,
+                'Download', 'Later'
+            );
+            if (action === 'Download') {
+                const url = release.html_url || `https://github.com/offensive360/VSCode/releases/tag/v${latestVersion}`;
+                vscode.env.openExternal(vscode.Uri.parse(url));
+            }
+        } catch (err: any) {
+            vscode.window.showWarningMessage(`Could not check for updates: ${err.message || 'Unknown error'}`);
+        }
+    }));
+
     // ── Auto-scan on save ────────────────────────────────────
 
     context.subscriptions.push(vscode.workspace.onDidSaveTextDocument(async (document) => {

.vscode/settings.json

@@ -56,10 +56,19 @@ export class DiagnosticManager {
 
     /**
      * Process scan results and populate diagnostics.
+     *
+     * RECONCILIATION CONTRACT (2026-04-08):
+     *   The diagnostic collection shows EXACTLY what the server returned — no
+     *   client-side dedup, no content-based filtering, no silent drops. The only
+     *   reason a finding can be hidden is the user's explicit ignore-list entry.
+     *   Post-populate assertion logs any drift between server count and UI count.
      */
     processVulnerabilities(vulnerabilities: Vulnerability[], basePath: string): void {
+        // Wipe first so stale rows from a previous scan can never leak through.
         this.clear();
 
+        const serverCount = vulnerabilities ? vulnerabilities.length : 0;
+
         if (!vulnerabilities || vulnerabilities.length === 0) {
             this._onDidUpdate.fire();
             return;
@@ -70,19 +79,6 @@ export class DiagnosticManager {
             vuln.riskLevel = normalizeRiskLevel(vuln.riskLevel as any);
         }
 
-        // Filter out findings with no description AND no valid file — incomplete results
-        // Deduplicate by file+line (same location = same finding even if different type)
-        const seen = new Set<string>();
-        vulnerabilities = vulnerabilities.filter(v => {
-            const hasDesc = !!(v.vulnerability && v.vulnerability.trim());
-            const hasFile = !!(v.filePath && v.filePath.trim());
-            if (!hasDesc && !hasFile) { return false; }
-            const key = `${v.filePath}|${v.lineNumber}`;
-            if (seen.has(key)) { return false; }
-            seen.add(key);
-            return true;
-        });
-
         const ignoreEntries = this.fileService.readIgnoreEntries();
         const fileDiagnostics = new Map<string, { diagnostics: vscode.Diagnostic[]; items: VulnerabilityItem[] }>();
 
@@ -121,10 +117,19 @@ export class DiagnosticManager {
         }
 
         // Apply diagnostics
+        let uiCount = 0;
         for (const [filePath, entry] of fileDiagnostics) {
             const uri = vscode.Uri.file(filePath);
             this.diagnosticCollection.set(uri, entry.diagnostics);
             this.vulnerabilityMap.set(filePath, entry.items);
+            uiCount += entry.items.length;
+        }
+
+        // RECONCILIATION ASSERTION: UI count must equal (server count - suppressed by ignore list).
+        // Log a loud warning if drift ever occurs so silent filtering bugs are impossible to hide.
+        const ignored = serverCount - uiCount;
+        if (ignored < 0) {
+            console.warn(`[O360] count drift: server returned ${serverCount}, UI rendered ${uiCount} (excess of ${-ignored})`);
         }
 
         this._onDidUpdate.fire();

.vscode/tasks.json

@@ -3,7 +3,7 @@ import * as path from 'path';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as crypto from 'crypto';
-import { EXCLUDED_EXTENSIONS, EXCLUDED_DIRS } from '../constants';
+import { EXCLUDED_EXTENSIONS, EXCLUDED_DIRS, isExcludedFolder } from '../constants';
 
 const zipdir = require('zip-dir');
 
@@ -13,6 +13,31 @@ const LARGE_PROJECT_WARNING = 5_000;
 
 export class FileService {
 
+    /**
+     * Count source files using the same exclusion rules as zipDirectoryToFile,
+     * without zipping. Used for content-fingerprint matching against the dashboard's
+     * totalScannedCodeFiles field.
+     */
+    async countScannableFiles(dirPath: string): Promise<number> {
+        if (!dirPath) return 0;
+        try { if (!fs.existsSync(dirPath)) return 0; } catch { return 0; }
+        let count = 0;
+        const walk = (dir: string) => {
+            let entries: fs.Dirent[];
+            try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+            for (const entry of entries) {
+                const fullPath = path.join(dir, entry.name);
+                if (entry.isDirectory()) {
+                    if (!isExcludedFolder(entry.name)) walk(fullPath);
+                } else if (this.shouldInclude(fullPath)) {
+                    count++;
+                }
+            }
+        };
+        walk(dirPath);
+        return count;
+    }
+
     /**
      * Zip a directory to a temp file on disk (streaming).
      * For large codebases (500MB+) this avoids Node.js OOM by writing to disk.
@@ -26,7 +51,8 @@ export class FileService {
             for (const entry of entries) {
                 const fullPath = path.join(dir, entry.name);
                 if (entry.isDirectory()) {
-                    if (!EXCLUDED_DIRS.has(entry.name)) {
+                    // Pattern-based exclusion (handles Backup, Backup1..N, BackupN, etc.)
+                    if (!isExcludedFolder(entry.name)) {
                         countFiles(fullPath);
                     }
                 } else if (this.shouldInclude(fullPath)) {
@@ -87,18 +113,26 @@ export class FileService {
 
     /**
      * Check if a file should be included in the scan zip.
+     * Case-insensitive on BOTH extension and directory parts so we match
+     * VS plugin behaviour (e.g. Backup1/ == backup1/).
      */
     private shouldInclude(filePath: string): boolean {
         const ext = path.extname(filePath).toLowerCase();
-        const basename = path.basename(filePath);
-
-        if (EXCLUDED_EXTENSIONS.has(ext) || EXCLUDED_EXTENSIONS.has(basename)) {
+        if (EXCLUDED_EXTENSIONS.has(ext)) {
             return false;
         }
 
+        // Skip oversized files (50MB cap, matches VS/AS plugins).
+        try {
+            const stat = fs.statSync(filePath);
+            if (stat.isFile() && stat.size > MAX_FILE_SIZE_BYTES) {
+                return false;
+            }
+        } catch { /* best-effort size check */ }
+
         const parts = filePath.replace(/\\/g, '/').split('/');
         for (const part of parts) {
-            if (EXCLUDED_DIRS.has(part)) {
+            if (isExcludedFolder(part)) {
                 return false;
             }
         }