validate manifest from VSIX with gallery (microsoft#221409)

SimonSiefke · Jul 10, 2024 · fc2e429 · fc2e429
1 parent 9f983cb
commit fc2e429
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/src/vs/platform/extensionManagement/node/extensionManagementService.ts b/src/vs/platform/extensionManagement/node/extensionManagementService.ts
@@ -300,7 +300,10 @@ export class ExtensionManagementService extends AbstractExtensionManagementServi
 			}
 
 			// validate manifest
-			await getManifest(location.fsPath);
+			const manifest = await getManifest(location.fsPath);
+			if (!new ExtensionKey(gallery.identifier, gallery.version).equals(new ExtensionKey({ id: getGalleryExtensionId(manifest.publisher, manifest.name) }, manifest.version))) {
+				throw new ExtensionManagementError(nls.localize('invalidManifest', "Cannot install '{0}' extension because of manifest mismatch with Marketplace", gallery.identifier.id), ExtensionManagementErrorCode.Invalid);
+			}
 
 			const local = await this.extensionsScanner.extractUserExtension(
 				extensionKey,