Change:
<!-- Do Not Delete This! bugreporttemplate --<!-- Please read our Rules of Conduct: --<!-- Read our guide about submitting issues: --<!-- Search existing issues to avoid creating duplicates. --<!-- Test using the latest Insiders build to see if your issue has already been fixed: --<!-- Instead of creating your report here, use 'Report Issue' from the 'Help' menu in VS Code to pre-fill useful information. --When installing an extensions with , users can freely install extensions which are malicious, which is not possible from the UI. <!-- Launch with to check. --Does this issue occur when all extensions are disabled?: Yes <!-- If you answered No above, use 'Help: Start Extension Bisect' from Command Palette to try to identify the cause. --<!-- Issues caused by an extension need to be reported directly to the extension publisher. The 'Help Report Issue' dialog can assist with this. --- VS Code Version: 1.69.0 OS Version: macOS 13 Steps to Reproduce: your 's to . a terminal inside of VS Code The CLI either refuses to install these extensions or warns the user.
Thanks for creating this issue! It looks like you may be using an old version of VS Code, the latest stable release is 1.69.0. Please try upgrading to the latest version and checking whether this issue remains. Happy Coding!
Sorry, mistyped the version by one patch release, all fixed now.
Can you please let me know which extension you are trying to install that is malicious and VS Code allows it from CLI?
that would be any extension list that I tried and exists in the Marketplace, for example installs just fine although not allowing me to install via the UI <img width="725" alt="image" src="https://user-"

Discussion:
IExtensionsControlManifest, StatisticType, isTargetPlatformCompatible, TargetPlatformToString, ExtensionManagementErrorCode, IServerExtensionManagementService, ServerInstallOptions, ServerInstallVSIXOptions, ServerUninstallOptions, Metadata, ServerInstallExtensionEvent, ServerInstallExtensionResult, ServerUninstallExtensionEvent, ServerDidUninstallExtensionEvent } from 'vs/platform/extensionManagement/common/extensionManagement'; <del> import { areSameExtensions, ExtensionKey, getGalleryExtensionTelemetryData, getLocalExtensionTelemetryData, getMaliciousExtensionsSet } from 'vs/platform/extensionManagement/common/extensionManagementUtil'; </del> <ins> import { areSameExtensions, ExtensionKey, getGalleryExtensionTelemetryData, getLocalExtensionTelemetryData } from 'vs/platform/extensionManagement/common/extensionManagementUtil'; </ins> import { ExtensionType, IExtensionManifest, isApplicationScopedExtension, TargetPlatform } from 'vs/platform/extensions/common/extensions'; import { ILogService } from 'vs/platform/log/common/log'; import { IProductService } from 'vs/platform/product/common/productService';

} private async checkAndGetCompatibleVersion(extension: IGalleryExtension, sameVersion: boolean, installPreRelease: boolean): Promise<{ extension: IGalleryExtension; manifest: IExtensionManifest }> { <del> const report = await this.getExtensionsControlManifest(); if (getMaliciousExtensionsSet(report).has(extension.identifier.id)) { </del> <ins> const extensionsControlManifest = await this.getExtensionsControlManifest(); if (extensionsControlManifest.malicious.some(identifier => areSameExtensions(extension.identifier, identifier))) { </ins> throw new ExtensionManagementError(nls.localize('malicious extension', "Can't install '{0}' extension since it was reported to be problematic.", extension.identifier.id), ExtensionManagementErrorCode.Malicious); }

*--------------------------------------------------------------------------------------------*/ import { compareIgnoreCase } from 'vs/base/common/strings'; <del> import { IExtensionIdentifier, IGalleryExtension, ILocalExtension, IExtensionsControlManifest, getTargetPlatform } from 'vs/platform/extensionManagement/common/extensionManagement'; </del> <ins> import { IExtensionIdentifier, IGalleryExtension, ILocalExtension, getTargetPlatform } from 'vs/platform/extensionManagement/common/extensionManagement'; </ins> import { ExtensionIdentifier, IExtension, TargetPlatform } from 'vs/platform/extensions/common/extensions'; import { IFileService } from 'vs/platform/files/common/files'; import { isLinux, platform } from 'vs/base/common/platform';

export const BetterMergeId = new ExtensionIdentifier('pprice.better-merge'); <del> export function getMaliciousExtensionsSet(manifest: IExtensionsControlManifest): Set<string> { const result = new Set<string>(); if (manifest.malicious) { for (const extension of manifest.malicious) { result.add(extension.id); } } return result; } </del> export function getExtensionDependencies(installedExtensions: ReadonlyArray<IExtension>, extension: IExtension): IExtension[] { const dependencies: IExtension[] = []; const extensions = extension.manifest.extensionDependencies?.slice(0) ?? [];

import { IWorkspaceContextService } from 'vs/platform/workspace/common/workspace'; import { IContextKeyService, ContextKeyExpr, RawContextKey, IContextKey } from 'vs/platform/contextkey/common/contextkey'; import { IContextMenuService } from 'vs/platform/contextview/browser/contextView'; <del> import { getMaliciousExtensionsSet } from 'vs/platform/extensionManagement/common/extensionManagementUtil'; </del> import { ILogService } from 'vs/platform/log/common/log'; import { INotificationService } from 'vs/platform/notification/common/notification'; import { IHostService } from 'vs/workbench/services/host/browser/host';

import { coalesce } from 'vs/base/common/arrays'; import { extractEditorsAndFilesDropData } from 'vs/platform/dnd/browser/dnd'; import { extname } from 'vs/base/common/resources'; <ins> import { areSameExtensions } from 'vs/platform/extensionManagement/common/extensionManagementUtil'; </ins> const SearchMarketplaceExtensionsContext = new RawContextKey<boolean>('searchMarketplaceExtensions', false); const SearchIntalledExtensionsContext = new RawContextKey<boolean>('searchInstalledExtensions', false);

} private checkForMaliciousExtensions(): Promise<void> { <del> return this.extensionsManagementService.getExtensionsControlManifest().then(report => { const maliciousSet = getMaliciousExtensionsSet(report); </del> <ins> return this.extensionsManagementService.getExtensionsControlManifest().then(extensionsControlManifest => { </ins> return this.extensionsManagementService.getInstalled(ExtensionType.User).then(installed => { const maliciousExtensions = installed <del> .filter(e => maliciousSet.has(e.identifier.id)); </del> <ins> .filter(e => extensionsControlManifest.malicious.some(identifier => areSameExtensions(e.identifier, identifier))); </ins> if (maliciousExtensions.length) { return Promises.settled(maliciousExtensions.map(e => this.extensionsManagementService.uninstall(e).then(() => {