EclipseFdn / EclipseFdn/open-vsx.org
Need add restrictions to namespaces and extension names to prevent name-squatting
- Dominant language
- TypeScript
- Stars
- 394
- Forks
- 145
- Avg merge
- 2d 19h
- Merged PRs (30d)
- 3
Description
__Namespaces__
Currently, through the API and command line, an individual can have any namespace (that doesn't currently exist) created and the requester added as a contributor. We need to restrict this to only namespaces that match the requesting GitHub ID. This is to prevent name-squatting. We grandfather the existing namespaces that have been created and currently have no owners. Perhaps a later exercise to analyze these and decide if we need to take additional steps.
__Extension Names__
Currently, one can create an extension that shares the same name with an existing extension, though different namespace. We want to restrict this so that new extensions cannot be named the same as an existing extension, irrespective of namespace. Again, we grandfather in the existing like named extensions.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by tracing the API and command-line paths that create namespaces and extensions, then inspect where namespace ownership and extension-name uniqueness are validated. Done means new namespaces are limited to the requesting GitHub ID and new extension names are unique across namespaces, while existing unowned namespaces and duplicate names remain grandfathered.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api, backend, cli, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100