Skip to content

feat(tree-view): show LS HTML tree view in Eclipse plugin [IDE-1837]#387

Open
bastiandoetsch wants to merge 41 commits into
mainfrom
feat/IDE-1837_show-results-in-tree-view
Open

feat(tree-view): show LS HTML tree view in Eclipse plugin [IDE-1837]#387
bastiandoetsch wants to merge 41 commits into
mainfrom
feat/IDE-1837_show-results-in-tree-view

Conversation

@bastiandoetsch
Copy link
Copy Markdown
Contributor

@bastiandoetsch bastiandoetsch commented May 8, 2026

User description

Description

Implements the Eclipse client side of the language server HTML tree view feature (IDE-1837). The language server already emits $/snyk.treeView notifications containing a fully-rendered HTML tree; this PR wires that into an embedded SWT Browser in the Snyk tool view.

PR stack:

flowchart LR
  main --> pr1["PR #387 ← this PR\nAll steps complete"]
Loading

What this PR includes (Steps 2.1 + 2.2 + 2.3):

LSP wire-up (Step 2.1):

  • LsConstants.SNYK_TREE_VIEW — LSP notification method constant
  • TreeViewParams DTO — deserializes { treeViewHtml } from LS
  • @JsonNotification handler in SnykExtendedLanguageClient — guarded against null params, null HTML, and disabled preference
  • TreeViewBrowserHandler — SWT Browser wrapper; installs ExecuteCommandBridge (reused from settings page) so all snyk.* commands from tree.js reach the LS via workspace/executeCommand
  • Preferences.USE_HTML_TREE_VIEW — feature flag, default OFF

Theme CSS (Step 2.2):

  • EclipseThemeCssProvider — maps 15 Eclipse SWT system colors to --vscode-* CSS variables; uses rgba() for transparency-sensitive properties, properly quoted font families, pt units for font size, Locale.ROOT for decimal formatting

Selection sync + edge cases (Step 2.3):

  • TreeViewBrowserHandler.selectNode(issueId) — injects window.__selectTreeNode__ into the HTML tree browser; full JS string escaping including \n, \r, U+2028, U+2029
  • Selection listener in SnykToolView wired to call selectNode when an IssueTreeNode is selected in the legacy tree
  • pendingHtml buffer (AtomicReference<String>) — stores HTML if treeBrowserHandler not yet initialized; drains in createPartControl
  • treeBrowserHandler declared volatile for safe publication to background threads

Checklist

  • Read and understood the Code of Conduct and Contributing Guidelines.
  • Tests added and all succeed (222 tests, 0 failures with JDK 17)
  • Linted
  • CHANGELOG.md updated
  • README.md updated, if user-facing

Screenshots / GIFs

UI is gated behind USE_HTML_TREE_VIEW=true preference (default OFF). Screenshots to follow when the feature is promoted to default.


PR Type

enhancement


Description

  • Integrate HTML tree view using SWT Browser.

  • Map Eclipse themes to LS HTML styles.

  • Add preference and HTML buffering logic.

  • Enhance LS notification handling and JS bridging.


Diagram Walkthrough

flowchart LR
  LS["Language Server"] -- "$/snyk.treeView" --> LC["SnykExtendedLanguageClient"]
  LC -->|updateTreeViewHtml| STV["SnykToolView"]
  STV -->|uses| TVBH["TreeViewBrowserHandler"]
  TVBH -->|sets text| SWTBrowser["SWT Browser"]
  SWTBrowser -- Renders --> HTMLContent["LS-Generated HTML"]
  style STV fill:#f9f,stroke:#333,stroke-width:2px
  style TVBH fill:#ccf,stroke:#333,stroke-width:2px
Loading

File Walkthrough

Relevant files
Enhancement
9 files
BaseHtmlProvider.java
Enhance CSS variable replacement and theming support.       
+50/-1   
Preferences.java
Add new preference for HTML tree view.                                     
+4/-0     
ISnykToolView.java
Add method to update HTML tree view content.                         
+2/-0     
SnykToolView.java
Integrate HTML tree view and manage UI stack.                       
+65/-1   
TreeViewBrowserHandler.java
New handler for rendering HTML tree in SWT Browser.           
+46/-0   
LsConstants.java
Add constant for HTML tree view notification.                       
+2/-1     
SnykExtendedLanguageClient.java
Handle `$/snyk.treeView` LSP notification.                             
+61/-5   
SnykShowFixUriDetails.java
Improve URI validation logic.                                                       
+4/-5     
TreeViewParams.java
New message object for HTML tree view payload.                     
+13/-0   
Bug fix
1 files
ContentRootNode.java
Improve error handling in getProductNode.                               
+1/-1     
Tests
6 files
BaseHtmlProviderTest.java
Add tests for CSS variable replacement and formatting.     
+68/-0   
SnykToolViewTest.java
Add tests for HTML tree view buffering and null handlers.
+102/-0 
TreeViewBrowserHandlerTest.java
Add tests for JS string escaping and null handlers.           
+82/-0   
SnykExtendedLanguageClientTest.java
Add tests for showDocument, product codename normalization.
+99/-0   
SnykShowFixUriDetailsTest.java
Add tests for URI validation and product codename mapping.
+110/-0 
TreeViewNotificationTest.java
Add tests for tree view notification handling.                     
+96/-0   
Documentation
1 files
html-tree-view.md
Document the new HTML tree view feature.                                 
+76/-0   
Dependencies
1 files
pom.xml
Update test dependencies and agent configuration.               
+19/-1   

bastiandoetsch and others added 4 commits May 8, 2026 10:30
…owser [IDE-1837]

- Add TreeViewParams DTO mirroring SummaryPanelParams
- Add SNYK_TREE_VIEW constant to LsConstants
- Add @JsonNotification handler in SnykExtendedLanguageClient
- Create TreeViewBrowserHandler (reuses ExecuteCommandBridge)
- Add USE_HTML_TREE_VIEW preference gate (default false)
- Host treeBrowser in SnykToolView.createPartControl behind preference
- Implement updateTreeViewHtml delegating to treeBrowserHandler on SWT thread
- Add TDD tests (T-S-001, T-I-001) verifying DTO and notification dispatch

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
…[IDE-1837]

- Guard snykTreeView() against null params/html at the LSP boundary
- Skip dispatch when USE_HTML_TREE_VIEW preference is disabled (avoids
  invisible browser renders in the default-off configuration)
- Add isDisposed() guard in TreeViewBrowserHandler.setBrowserText()
- Remove leaking OSGi IPreferenceChangeListener (no UI toggle exists yet;
  preference is read once at createPartControl time)
- Remove unused InstanceScope and Activator imports from SnykToolView
- Remove totalIssues dead field from TreeViewParams (no caller)
- Guard treeBrowserHandler null in updateTreeViewHtml
- Expand tests: null params, null html, preference-disabled, and
  preference-enabled dispatch all verified (5 tests, 0 failures)

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
- Add EclipseThemeCssProvider: maps SWT colors to --vscode-* CSS vars
- TreeViewBrowserHandler.setBrowserText injects theme style block
- Tests: EclipseThemeCssProviderTest (toHex, buildStyleBlock),
  TreeViewBrowserHandlerTest (theme injection, null no-op)

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
…-1837]

- Use pt unit for font-size (SWT FontData.getHeight() returns points, not px)
- Quote multi-word font family names to produce valid CSS font-family values
- Use rgba() for widget-shadow and list-hoverBackground to preserve
  transparency intent (consistent with the LS template fallback values)
- Refactor doubled getSystemFont().getFontData()[0] calls into resolveFontData()
- Use replaceFirst("(?i)</head>") instead of replace() to avoid injecting
  style block at multiple </head> occurrences
- Add toRgba, quoteFontFamily, font-size-unit, and rgba-fallback tests

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
@snyk-io
Copy link
Copy Markdown

snyk-io Bot commented May 8, 2026

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues
Licenses 0 0 0 0 0 issues
Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

- Remove toRgba regex that could corrupt alpha values >= 0.10/0.20;
  %.2f already produces correct output (0.12, 0.15) without post-processing
- Remove Javadoc from ISnykToolView.updateTreeViewHtml (interface has no
  Javadoc on other abstract methods — consistent with project convention)
- Add missing newline at EOF in LsConstants.java
- Delete redundant TreeViewBridgeTest (tested ExecuteCommandBridge.buildClientScript
  which is already covered by ExecuteCommandBridgeTest; added no tree-view coverage)

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
@bastiandoetsch
Copy link
Copy Markdown
Contributor Author

/describe

@bastiandoetsch
Copy link
Copy Markdown
Contributor Author

/review

@snyk-pr-review-bot
Copy link
Copy Markdown

PR Description updated to latest commit (04c8394)

@snyk-pr-review-bot

This comment has been minimized.

…-1837]

- Add TreeViewBrowserHandler.selectNode(issueId): injects
  window.__selectTreeNode__ into the HTML tree browser
- Wire selectNode into SnykToolView: called on IssueTreeNode selection
  and from selectTreeNode(Issue, String) programmatic navigation
- Buffer pending HTML in SnykToolView when treeBrowserHandler not yet
  initialized; drain buffer in createPartControl after handler init
- Tests: selectNode null-safety (null browser, null/empty id)
… [IDE-1837]

String.format with %.2f uses system locale by default; on non-US locales
(e.g. Germany) this produces a comma as decimal separator, generating
invalid CSS rgba() values. Fix by passing Locale.ROOT explicitly.
- Declare treeBrowserHandler volatile to make safe-publication explicit
  for background-thread reads in updateTreeViewHtml and selectTreeNode
- Remove double selectNode call: selectTreeNode(Issue, String) no longer
  calls treeBrowserHandler.selectNode directly; the selectionChanged
  listener is the sole coupling point from JFace selection to HTML tree
- Fix pendingHtml drain: call setBrowserText directly in createPartControl
  (already on UI thread) instead of via asyncExec to avoid stale-overwrite
  when a concurrent updateTreeViewHtml arrives before the drain executes
- Extract escapeJsSingleQuotedString: extends escaping to \n, \r,
  U+2028, U+2029 which break single-quoted JS string literals
- Remove selectTreeNode(String) from ISnykToolView interface (no external
  callers; removed dead implementation from SnykToolView)
- Add 4 tests for escapeJsSingleQuotedString covering all escape cases

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
bastiandoetsch and others added 4 commits May 8, 2026 15:24
…837]

- Replace volatile String pendingHtml with AtomicReference<String> to
  eliminate NullAssignment PMD violation (priority 3) in createPartControl;
  AtomicReference.getAndSet(null) is both PMD-clean and provides stronger
  atomic semantics than volatile + manual null assignment
- Sync settings-fallback.html from snyk-ls main (sha512 drift caused
  static-resource-checks CI failure; unrelated to IDE-1837 changes)

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Replace catch (Exception e) in resolveFontData with direct call;
the null/disposed guards above make the broad catch unnecessary.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
…ion [IDE-1837]

Add EclipseThemeCssProvider.buildVariableMap() returning a full map of all
--vscode-* variables to their Eclipse SWT colour values. Rewrite
TreeViewBrowserHandler.injectThemeCss() to do a single-pass regex
replacement of var(--vscode-xxx, fallback) expressions with resolved values,
and to strip the ${ideStyle}/${ideScript} placeholders instead of injecting
a :root block. buildStyleBlock() is retained for backward compatibility and
now delegates to buildVariableMap().

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
…[IDE-1837]

Remove the DIAGNOSTIC_SOURCE_SNYK_CODE-only guard from
SnykShowFixUriDetails.isValid() so that OSS, IaC, and Secrets products are
all accepted when the action is showInDetailPanel. Add a guard in
SnykExtendedLanguageClient.showDocument() to return ShowDocumentResult(false)
for any snyk:// URI with an unrecognised action instead of delegating to
super.showDocument() which crashes with "No file system defined for scheme:
snyk".

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
@bastiandoetsch
Copy link
Copy Markdown
Contributor Author

/describe

@bastiandoetsch
Copy link
Copy Markdown
Contributor Author

/review

@snyk-pr-review-bot
Copy link
Copy Markdown

PR Description updated to latest commit (ec8d7f1)

@snyk-pr-review-bot

This comment has been minimized.

bastiandoetsch and others added 5 commits May 8, 2026 17:13
…[IDE-1837]

- Increase testSnykTreeViewDispatchesHtmlToToolView timeout 5s→15s to
  accommodate macOS CI thread scheduling latency (test was passing at
  5.155s, just over the 5000ms window)
- Fix showDocument() to return CompletableFuture.completedFuture(false)
  instead of null when URISyntaxException occurs or issue is not in cache;
  lsp4j calls .thenAccept() on the returned future which NPEs on null

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
When toolView is already set, call updateTreeViewHtml synchronously
instead of via CompletableFuture.runAsync — openToolView() is a no-op
in that path anyway. The async path is only needed when the view must
be opened first. This removes the test's dependency on thread-pool
scheduling latency (was causing 15s+ delays on Ubuntu/macOS CI runners).

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
- Normalize LS product codenames (oss/code/iac) to Eclipse cache keys
  (Snyk Open Source/Code/IaC) before cache lookup; the HTML tree sends
  short codenames via data-product attribute, but the cache is keyed on
  display names
- Font size: use px unit (matching IntelliJ) instead of pt; SWT
  FontData.getHeight() returns points but CSS px is the correct unit
  for screen rendering at the browser's reference pixel
- Font family: add system-ui, -apple-system, sans-serif fallback chain
  after the system font name, matching IntelliJ's ThemeBasedStylingGenerator

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
…tion [IDE-1837]

Replace custom --vscode-only regex with IntelliJ's ThemeBasedStylingGenerator
CSS_PATTERN that handles both var(--xxx) usages and --xxx: declarations
in a single pass. Declaration replacement bakes concrete values directly
into the CSS property declarations, eliminating all --vscode-* variable
references from the rendered HTML.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
…837]

- Font family/size now read from JFaceResources.DEFAULT_FONT (same theme
  source as BaseHtmlProvider) instead of SWT system font or hardcoded
  values; font changes with the Eclipse theme
- Navigation: convert issue.filterableIssueType() via SCAN_PARAMS_TO_DISPLAYED
  before calling selectTreeNode; ContentRootNode.getProductNode() expects
  DISPLAYED_* format, not scan-params format, causing IllegalArgumentException

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
…nteraction [IDE-1837]

Replace the three-child SashForm (summaryBrowser + treeViewer + treeBrowser)
with a two-child layout: summaryBrowser and a StackLayout Composite that wraps
both tree controls. This eliminates any ambiguity between SashForm
weight-tracking and control visibility: the SashForm always sees exactly two
children and the StackLayout.topControl selects the active tree.
@bastiandoetsch
Copy link
Copy Markdown
Contributor Author

/describe

@snyk-pr-review-bot
Copy link
Copy Markdown

PR Description updated to latest commit (ce5ceb1)

@snyk-pr-review-bot

This comment has been minimized.

@Override
public void updateTreeViewHtml(String html) {
if (treeBrowserHandler == null) {
pendingHtml.set(html);
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This func does not run on the UI thread (it's called from the SnykExtendedLanguageClient), but the pendingHTML setup runs on the UI thread (in createPartControl above).

If a notification arrives before the tree view is ready, this call will never do anything.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah i see the latest reviewbot also picked up on this

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Confirmed — this is the race where the notification arrives between the null-check and createPartControl's drain. Will fix by always posting to the UI thread: pendingHtml.set(html) then asyncExec to drain, so the null-check and drain are serialized with createPartControl on the same thread.


// Create TreeViewer
treeViewer = new TreeViewer(verticalSashForm, SWT.BORDER);
treeViewer = new TreeViewer(treeStack, SWT.BORDER);
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should lazy-create this instead of alway creating it, even when turned off.

return null;
}
switch (product) {
case "oss":
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should not use magic strings here.

Comment thread .gitignore
@BeforeEach
void setUp() {
Preferences prefs = Preferences.getTestInstance(new InMemoryPreferenceStore(), new InMemorySecurePreferenceStore());
prefs.store(Preferences.USE_HTML_TREE_VIEW, "false");
Copy link
Copy Markdown
Contributor

@andrewrobinsonhodges-snyk andrewrobinsonhodges-snyk May 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Set to false to exercise the classic tree-viewer code path. Will add equivalent tests with USE_HTML_TREE_VIEW=true to cover the treeBrowserHandler.selectNode() branch.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Set to false to exercise the classic tree-viewer code path. Will add equivalent tests with USE_HTML_TREE_VIEW=true to cover the treeBrowserHandler.selectNode() branch.

return (ProductTreeNode) this.getChildren()[2];
default:
throw new IllegalArgumentException("unknown product in tree");
return null;
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this safe? What's wrong with the old behaviour?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Safe — the old code threw IllegalArgumentException, but the caller uses getOrDefault with a raw fallback, so an unknown filterableIssueType can reach this switch. The call site in SnykToolView.selectTreeNode now guards if (productNode == null) return, so returning null is handled consistently without surfacing an exception.

{{CHANNEL_STABLE_SELECTED}} - "selected" or ""
{{CHANNEL_RC_SELECTED}} - "selected" or ""
{{CHANNEL_PREVIEW_SELECTED}} - "selected" or ""
{{CHANNEL_CUSTOM_SELECTED}} - "selected" or ""
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file needs updating in LS then copying to all the IDE plugins.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed — settings-fallback.html is owned by snyk-ls. Will update it there first, then copy the result to this plugin and the other IDE plugins as a follow-up.

@bastiandoetsch
Copy link
Copy Markdown
Contributor Author

/describe

@snyk-pr-review-bot
Copy link
Copy Markdown

PR Description updated to latest commit (ce5ceb1)

…-1837]

Merge origin/main (IDE-1652 LsSettingsRegistry + FolderConfigSettings
refactor) into the IDE-1837 tree-view branch.

Conflict resolutions:
- Preferences.java: kept both constant sets (USE_HTML_TREE_VIEW /
  USE_LS_HTML_CONFIG_DIALOG from IDE-1837; RELEASE_CHANNEL_* /
  EXPLICIT_CHANGES_KEY from IDE-1652); dropped setDefault(RELEASE_CHANNEL)
  that IDE-1652 moved to LsSettingsRegistry.
- SnykExtendedLanguageClient.java: merged both import sets (LsKey /
  LsSettingsRegistry from IDE-1652; TreeViewParams from IDE-1837).

Also adds -javaagent pre-load of byte-buddy-agent via maven-dependency-
plugin to allow Mockito inline mocking in containerised JVMs where
ByteBuddy self-attachment is blocked by PID namespace restrictions.
…ests [IDE-1837]

- Make toolView field volatile to ensure cross-thread visibility
- Add null guard in showDocument() so a missing tool view returns
  ShowDocumentResult(false) instead of NPE
- Add two regression tests that inject an issue into IssueCacheHolder
  and mock ResourceUtils so the supplyAsync block is actually reached,
  covering the null guard path and the happy path
- Add updateTreeViewHtml buffering tests for pending-HTML when handler
  is null; drop the no-op third test that never exercised the guard branch
@bastiandoetsch
Copy link
Copy Markdown
Contributor Author

/describe

1 similar comment
@bastiandoetsch
Copy link
Copy Markdown
Contributor Author

/describe

@snyk-pr-review-bot
Copy link
Copy Markdown

PR Description updated to latest commit (d83c72a)

@snyk-pr-review-bot

This comment has been minimized.

@snyk-pr-review-bot
Copy link
Copy Markdown

PR Description updated to latest commit (d83c72a)

…UI-thread drain, html-view tests [IDE-1837]

- Lazy-create treeBrowser/treeBrowserHandler behind useHtmlTreeView flag
  so no SWT Browser is allocated when the HTML tree view is disabled
- Replace "oss"/"code"/"iac" literals in normalizeProductCodename with
  SCAN_PARAMS_OSS/CODE/IAC constants from ProductConstants
- Fix updateTreeViewHtml race: always set pendingHtml first, then post
  a drain via asyncExec so the null-check and drain are serialized on
  the UI thread with createPartControl
- Narrow drainPendingHtmlAsync catch from Exception|Error to
  UnsatisfiedLinkError|NoClassDefFoundError (SWT native absence)
- Add SnykToolViewTest cases with USE_HTML_TREE_VIEW=true to cover
  the treeBrowserHandler.selectNode() branch
…uplicate test [IDE-1837]

- Add SWTException to the catch in drainPendingHtmlAsync alongside
  UnsatisfiedLinkError/NoClassDefFoundError — Display.asyncExec() can
  raise SWTException(ERROR_DEVICE_DISPOSED) if the display is disposed
  in the TOCTOU window between the isDisposed() guard and the asyncExec
  call; without this catch it propagates to the LSP message handler
- Remove updateTreeViewHtml_alwaysSetsPendingHtmlBeforeAsyncExec which
  was structurally identical to the existing buffer test (treeBrowserHandler
  is always null in headless tests so both assertions were equivalent)
@bastiandoetsch
Copy link
Copy Markdown
Contributor Author

/describe

}
});
}
} catch (SWTException | UnsatisfiedLinkError | NoClassDefFoundError e) { // NOPMD — SWT unavailable in headless/test environments
@snyk-pr-review-bot
Copy link
Copy Markdown

PR Description updated to latest commit (5843599)

@snyk-pr-review-bot

This comment has been minimized.

@bastiandoetsch
Copy link
Copy Markdown
Contributor Author

/describe

@snyk-pr-review-bot
Copy link
Copy Markdown

PR Description updated to latest commit (5843599)

@snyk-pr-review-bot

This comment has been minimized.

… [IDE-1837]

PMD UnnecessaryWarningSuppression CI failure: the // NOPMD annotation on
the drainPendingHtmlAsync catch was left over from when the catch caught
bare Exception|Error. After narrowing to SWTException|UnsatisfiedLinkError
|NoClassDefFoundError, no PMD rule fires on those specific types, so the
suppression itself became a violation. Remove the comment; the explanatory
rationale is preserved in the adjacent logInfo message.
@bastiandoetsch
Copy link
Copy Markdown
Contributor Author

/describe

@snyk-pr-review-bot
Copy link
Copy Markdown

PR Description updated to latest commit (5e12eb3)

@snyk-pr-review-bot

This comment has been minimized.

@snyk-pr-review-bot
Copy link
Copy Markdown

PR Reviewer Guide 🔍

🧪 PR contains tests
🔒 No security concerns identified
⚡ Recommended focus areas for review

Mismatched Default 🟠 [major]

The USE_HTML_TREE_VIEW preference is set to TRUE by default. This contradicts the PR description which states the feature should default to 'OFF'. Defaulting to ON for an experimental browser-based view poses a systemic risk for users on platforms with broken or missing SWT Browser support (e.g., some Linux distros or older Windows environments), potentially breaking the primary Snyk tool view upon upgrade.

insecureStore.setDefault(USE_HTML_TREE_VIEW, TRUE);
Possible NPE 🟠 [major]

In replaceRemainingCssVars, the code calls Matcher.quoteReplacement(replacement != null ? replacement : m.group(0)). While this handles nulls from the map, if m.group(0) were null (theoretically impossible if m.find() is true) or if the map lookup logic changes, Matcher.quoteReplacement will throw a NullPointerException. More importantly, if a token is matched by CSS_VAR_PATTERN but is NOT in vsCodeVarMap, it returns the original string. However, if the LS sends a variable that isn't mapped, the UI may look broken or unreadable in dark/light mode due to missing theme variables.

m.appendReplacement(sb, Matcher.quoteReplacement(replacement != null ? replacement : m.group(0)));
Resource Leak 🟡 [minor]

The volatile TreeViewBrowserHandler treeBrowserHandler and AtomicReference<String> pendingHtml provide a mechanism to buffer HTML, but there is no cleanup of pendingHtml if the view is closed before createPartControl completes or if initialization fails. This could lead to a small memory leak of the last received (and potentially large) HTML string.

private final AtomicReference<String> pendingHtml = new AtomicReference<>();
📚 Repository Context Analyzed

This review considered 108 relevant code sections from 11 files (average relevance: 0.75)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants