ADMX policies for controlling VSCode extensions

[o-l-a-v]

As the VSCode marketplace does not seem to be sufficiently regulated from a security point of view:

• https://www.bleepingcomputer.com/news/microsoft/vscode-marketplace-can-be-abused-to-host-malicious-extensions/
• https://devclass.com/2023/01/09/researchers-demonstrate-a-thousand-installs-of-fake-vs-code-extension-in-48-hours/
• https://thehackernews.com/2023/01/hackers-distributing-malicious-visual.html

It would be great with ADMX policies for specifying extension policies, like:

• Allowed sources (VSCode Marketplace vs. other marketplaces (?) vs. sideload)
• Preaccepted extensions / whitelist:
  • A list of extensions from a source that are allowed to be installed.
  • Maybe even preaccepted publishers, like Microsoft, to make the management overhead smaller.

---

ATM, update mode seems to be the only thing one can control with VSCode.

VSCode.admx from VSCode v1.74.2

<?xml version="1.0" encoding="utf-8"?>
<policyDefinitions revision="1.1" schemaVersion="1.0">
	<policyNamespaces>
		<target prefix="VSCode" namespace="Microsoft.Policies.VSCode" />
	</policyNamespaces>
	<resources minRequiredRevision="1.0" />
	<supportedOn>
		<definitions>
			<definition name="Supported_1_67" displayName="$(string.Supported_1_67)" />
		</definitions>
	</supportedOn>
	<categories>
		<category displayName="$(string.Application)" name="Application" />
		<category displayName="$(string.Category_updateConfigurationTitle)" name="updateConfigurationTitle"><parentCategory ref="Application" /></category>
	</categories>
	<policies>
		<policy name="UpdateMode" class="Both" displayName="$(string.UpdateMode)" explainText="$(string.UpdateMode_updateMode)" key="Software\Policies\Microsoft\VSCode" presentation="$(presentation.UpdateMode)">
			<parentCategory ref="updateConfigurationTitle" />
			<supportedOn ref="Supported_1_67" />
			<elements>
		<enum id="UpdateMode" valueName="UpdateMode">
			<item displayName="$(string.UpdateMode_none)"><value><string>none</string></value></item>
			<item displayName="$(string.UpdateMode_manual)"><value><string>manual</string></value></item>
			<item displayName="$(string.UpdateMode_start)"><value><string>start</string></value></item>
			<item displayName="$(string.UpdateMode_default)"><value><string>default</string></value></item>
		</enum>
			</elements>
		</policy>
	</policies>
</policyDefinitions>

[gjsjohnmurray]

See #84756

[o-l-a-v]

Duplicate issue, thanks for pointing that out @gjsjohnmurray.