this post was submitted on 16 Aug 2024
23 points (100.0% liked)

VS Code

818 readers
3 users here now

founded 1 year ago
MODERATORS
Ategon
Lodra
23
Do you know the .vscode/tasks.json file? You can add it to your project, and will run your configured commands automatically when you open the project ✨ (files.mastodon.social)
submitted 4 months ago* (last edited 4 months ago) by [email protected] to c/vscode
12 comments fedilink hide all child comments
 

Do you know the .vscode/tasks.json file? You can add it to your project, and @vscode will run your configured commands automatically when you open the project ✨

I use this for the Inertia Table so it starts the web server and Vite without me having to open terminals for them 👌

#Laravel #PHP #JS #coding

top 12 comments
sorted by: hot top controversial new old
[–] [email protected] 13 points 4 months ago (1 children)

Hm, yeah ok, should really be careful with that "I trust the developers of this repo" button (or whatever it says)

[–] Lodra 5 points 4 months ago* (last edited 4 months ago) (3 children)

100%

I know a guy that considers git pre-commit hooks a form of code injection and thus a security risk. So he disables them on repos he works with. And to be fair, it’s absolutely a viable vector for attacking developer machines. I think a tasks.json fits into that exact same bucket.

These kinds of automations are suuuper useful and I do like to use them. But also review a code base before cloning!

[–] expr 2 points 4 months ago

Yeah, it's a little insane to me to automatically run code that exists in a file in the current directory, by default.

Like there's a reason that direnv requires you to execute direnv allow if you enter a directory with an .envrc that you hadn't previously approved.

I don't know of any other editor that has this as standard behavior, and for good reason.

[–] FizzyOrange 1 points 4 months ago

I mean... You're probably going to run the code in the repo eventually anyway right? At least in the majority of cases. Tbh I don't think it really changes the threat model significantly.

[–] kogasa 1 points 4 months ago (1 children)

Pre-commit hooks aren't committed to the repo though. What's to disable? Unless it's something like python's precommit module I guess

[–] Lodra 1 points 4 months ago (1 children)

The configuration is often committed to the repo. And some repos heavily rely on the precommit actions running before you can push or have pipelines function correctly

[–] kogasa 1 points 4 months ago

You'd still need to manually install the git hooks though, the .git folder isn't part of the repo

[–] [email protected] 4 points 4 months ago

Can't wait to see CVEs popping up exploiting this feature

[–] [email protected] 2 points 4 months ago

@pascalbaljet @vscode no I did not know, thanks!

[–] [email protected] 1 points 4 months ago (1 children)

@pascalbaljet @vscode nice! Do you know if there‘s anything similar for PhpStorm?