doddi / vuln-lsp

Hi there 👋

vuln-lsp's Issues

Package the binaries for distribution to the 3 major clients

Each major client, Neovim, VsCode and Intellij require the plugin to be package separately. Additionally an understanding on how to distribute the actual LSP binaries as part of hte plugin.

Considerations:

• does the LSP binary get installed as a separate installation from the plugins into a common folder that all clients can access?
• if a plugin installs the LSP does this mean other clients also have a separate installation location?
• What about upgrades?

Improve the pom parsing

As a user of the plugin I want to be aware of as many vulnerabilities as possible and currently the pom parsing is extremely basic

As a minimum the LSP should be able to understand a pom file:

• version in the standard location
• versions are properties defined elsewhere in the pom file
• understand dependencies declared with <DependencyManagement>
• understand version from a parent pom

Add Nexus Lifecycle/Firewal as a backend service

Add a cargo toml parse

As a user of the plugin I want to look at my cargo dependencies for any known vulnerabilities

To accomplish this may require looking at both the Cargo.toml file and Cargo.lock file.

Add caching to backend service

Continually fetching vulnerability information may cause delays and just as important rate limiting issues.

Adding caching to any fetched information would solve these issues. Stage 1 could be as simple as a permanent cache whereby it does not go stale because for the majority of purposes each time a file is loaded is likely more than enough refresh period.

Detect client capabilities

Some clients may not support all the features of the LSP. For example, AFAICT intellij does not support the completion feature.

When the LSP starts it should take into account the features that are available.