dequelabs / dequelabs/axe-core

vs code plugin downloads binary outside of extension code, which attempts to send usage data by an unsigned process every few seconds even after uninstalling plugin

Open
#2,932 2 comments 0 reactions 0 assignees View on GitHub
linting
Dominant language
JavaScript
Stars
7.5k
Forks
933
Avg merge
2d 23h
Merged PRs (30d)
17

Description

Product: axe Linter

Expectation:

1. Plugin does not spam the network pinging usage stats
2. Plugin does not download binaries into the Downloads folder

Actual:

1. After installing the VS Code extension (in VS Code Insiders), every 6 seconds or so Little Snitch notifies about this already-terminated network request:

```
Code - Insiders Helper (Renderer) via axe-linter-server-macos
wants to connect to usage.deque.com on TCP port 443 (https)
```

```
Warnings
Suspicious process “Code - Insiders Helper (Renderer)”!
validation error 255
Suspicious process “axe-linter-server-macos”!
The process has no code signature. This means that the developer is anonymous and their real-life identity cannot be determined.
```

```
IP Address 52.6.83.30
Reverse DNS Name ec2-52-6-83-30.compute-1.amazonaws.com
Established by /Users/home/Downloads/axe-linter-server-macos
Process ID 78799
Code Signature Not signed
User home (UID: 501)
Parent Application /Applications/Visual Studio Code - Insiders.app/Contents/Frameworks/Code - Insiders Helper (Renderer).app/Contents/MacOS/Code - Insiders Helper (Renderer)
Process ID 95490
Code Signature Signed by Microsoft Corporation (UBF8T346G9)
```

![image](https://user-images.githubusercontent.com/3282350/118025435-db5ae700-b32d-11eb-98ca-59018123c1c7.png)

![image](https://user-images.githubusercontent.com/3282350/118025823-41476e80-b32e-11eb-8417-e4dc6ae7f55d.png)

This continues to happen after telling Little Snitch to allow all future requests from the "axe-linter-server-macos" VS Code Insiders process, and after telling Little Snitch to deny all future requests.

This continues after uninstalling the plugin.

Fix is to stop the two axe linter server processes. For good measure I deleted the binary the plugin downloaded to my Downloads folder.

Motivation: putting aside the question of whether a plugin should constantly send up usage data, it certainly should not after it's uninstalled. In addition the particular way it's implemented is tripping up Little Snitch in a way that makes the monitor unusable — the user has to choose between running Little Snitch and constantly closing notifications.



axe-core version: X.Y.Z
axe-webdriver, extension or other integration version: X.Y.Z

👆 whatever's in the VS Code extension v4.1.1

Browser and Assistive Technology versions

For Tooling issues:
- Node version: 14.16.0 running in VS Code Insiders 1.5.7.0-insider
- Platform: macOS

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.