search

SonarSource / sonarlint-visualstudio

SonarLint extension for VisualStudio
https://redirect.sonarsource.com/doc/sonar-visualstudio.html
GNU Lesser General Public License v3.0
463 stars 77 forks source link

Disclose solution-related info only to trusted servers #2470

Open jblievremont opened 3 years ago

jblievremont commented 3 years ago

The Security Hotspots discovery endpoint (/sonarlint/api/status) should disclose solution-related information in the description field only to trusted servers, a.k.a servers for which SonarLint already has connection settings and credentials. The response to untrusted servers should only contain the name/version of the IDE.

rita-gorokhod commented 3 years ago

@jblievremont FYI at the moment SLVS doesn't store connection settings at a global level - we have no record of which servers were previously used. This would require more implementation on our side.