Week_3 : Coding period - Progress Report

GSoC Projects Plugin Ecosystem Security
1

PROGRESS :

I ran more tests on all the tools and figured out new XSS related attack vector that can be a good addition to the threat model, and based on the new test data the top tool choices remains CodeQl and LLM.

CodeQl and LLM has similar results in the end testings but with few very obvious and visible trade-offs :

  1. Codeql has a blind spot for zero day malicious code and heavily depend on the threat model defined to check for attacks, LLM can actively check for new similar attack vectors.

  2. The scan quality of LLM is far better than that of codeql, the reviewer will be able to know what the code is flagged for right at the issue page, this case is not same for the tool as the message it will display is hard coded by us.

  3. The more custom rules we add CodeQl will become more prone to giving false positive noises, though in the recent tests the noise remained minimum but the slow rise is visible.

Review in progress : All: Resolves #15595: Added local validations for new publish workflow for plugin ecosystem by akshajrawat · Pull Request #15596 · laurent22/joplin · GitHub

Next Week Scope

  • Raise PR 2 if the 1st one get merged, finallizing the whole generator-joplin changes.

  • Start reviewing of the branch of plugin-repo-cli related changes.

  • Conduct more tests on tools if needed and actively update the threat model.

4 Likes