EclipseFdn / EclipseFdn/open-vsx.org

Need add restrictions to namespaces and extension names to prevent name-squatting

Open
#10,356 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
394
Forks
145
Avg merge
2d 19h
Merged PRs (30d)
3

Description

__Namespaces__
Currently, through the API and command line, an individual can have any namespace (that doesn't currently exist) created and the requester added as a contributor. We need to restrict this to only namespaces that match the requesting GitHub ID. This is to prevent name-squatting. We grandfather the existing namespaces that have been created and currently have no owners. Perhaps a later exercise to analyze these and decide if we need to take additional steps.

__Extension Names__
Currently, one can create an extension that shares the same name with an existing extension, though different namespace. We want to restrict this so that new extensions cannot be named the same as an existing extension, irrespective of namespace. Again, we grandfather in the existing like named extensions.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing the API and command-line paths that create namespaces and extensions, then inspect where namespace ownership and extension-name uniqueness are validated. Done means new namespaces are limited to the requesting GitHub ID and new extension names are unique across namespaces, while existing unowned namespaces and duplicate names remain grandfathered.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, backend, cli, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.