snyk/snyk-ls
GitHub: snyk/snyk-ls
Snyk 官方的语言服务器实现，通过 LSP 协议为 IDE 提供实时的开源漏洞、代码安全、IaC 风险和密钥泄露检测后端服务。
Stars: 79 | Forks: 15
# Snyk Language Server (Snyk-LS)
[](https://github.com/snyk/snyk-ls/actions/workflows/build.yaml)
[](https://github.com/snyk/snyk-ls/actions/workflows/release.yaml)
[](CODE_OF_CONDUCT.md)
## 支持的功能
该语言服务器遵循
[Language Server Protocol](https://microsoft.github.io/language-server-protocol/specifications/specification-current/)
并集成了 Snyk Open Source、Snyk Infrastructure as Code、Snyk Code 和 Snyk Secrets。对于 Open Source 和 IaC，它使用 Snyk CLI 作为数据提供者；Snyk Code 使用 Snyk Code API；Secrets 扫描在适用时使用 CLI。
目前，该语言服务器支持以下操作：
- 如果文档是当前文件夹集的一部分，则在打开文档时向客户端发送诊断信息。
- 在启动时开始文件夹扫描并发送诊断信息。
- 根据命令开始所有文件夹的工作区扫描。
- 缓存诊断信息，直到保存或触发新的工作区扫描。
- 保存文档时使缓存失效并重新获取已保存文档的诊断信息。
- 提供范围计算，以在其文件中正确高亮显示 Snyk Open Source 问题。
- 提供带有诊断详细信息和后续链接的格式化悬停提示
- 向客户端报告后台作业的进度
- 向客户端发送通知和日志消息
- 需要时进行身份验证，使用 OAuth2 或 Token 身份验证，并在必要时打开网页
- 如果在打开网页时遇到问题，将身份验证 URL 复制到剪贴板
- 如果找不到或未配置 Snyk CLI，则自动下载到 XDG_DATA_HOME
- 根据传输的设置选择性激活产品
- 扫描错误将作为诊断信息报告给 Language Server Client
- Code Lenses 用于在编辑器内导航 Snyk Code 数据流
- 用于编辑器内命令的 Code Actions，例如打开浏览器、执行快速修复或打开 Snyk Learn 课程
针对发现的诊断
### 已实现的操作
### Language Server Protocol 支持
#### 请求
- initialize
- exit
- textDocument/codeAction
- textDocument/codeLens
- textDocument/didClose
- textDocument/didSave
- textDocument/hover
- textDocument/inlineValue
- shutdown
- workspace/didChangeWorkspaceFolders
- workspace/didChangeConfiguration
- workspace/executeCommand
- window/workDoneProgress/create (从服务器 -> 客户端)
- window/showMessageRequest
- window/showDocument
#### 通知
- $/progress
- $/cancelRequest
- textDocument/publishDiagnostics
- params: `types.PublishDiagnosticsParams`
- 示例: Snyk Open Source
{
"uri": "file:///path/to/file",
"diagnostics": [
{
"range": {
"start": { "line": 1, "character": 0 },
"end": { "line": 2, "character": 0 },
},
"severity": 1,
"code": "S100",
"source": "Snyk",
"message": "Message",
"tags": ["security"],
"data": {
"id": "123",
"issueType": "vulnerability",
"packageName": "packageName",
"packageVersion": "packageVersion",
"issue": "issue",
"additionalData": {
"ruleId": "ruleId",
"identifiers": {
"cwe": ["cwe"],
"cve": ["cve"]
},
"description": "description",
"language": "language",
"packageManager": "packageManager",
"packageName": "packageName"
}
}
}
]
}
- 示例: Snyk Code
{
"uri": "file:///path/to/file",
"diagnostics": [
{
"range": {
"start": { "line": 1, "character": 0 },
"end": { "line": 2, "character": 0 },
},
"severity": 1,
"code": "S100",
"source": "Snyk",
"message": "Message",
"tags": ["security"],
"data": {
"id": "123",
"filePath": "filePath",
"range": {
"start": { "line": 1, "character": 0 },
"end": { "line": 2, "character": 0 },
},
"additionalData": {
"message": "message",
"rule": "rule",
"ruleId": "ruleId",
"dataFlow": [
{
"filePath": "filePath",
"range": {
"start": { "line": 1, "character": 0 },
"end": { "line": 2, "character": 0 },
},
}
],
"cwe": "cwe",
"isSecurityType": true
}
}
}
]
}
- window/logMessage
- window/showMessage
### Language Server Protocol 的自定义扩展（服务器 -> 客户端）
- SDKs 回调，用于从客户端检索已配置的 SDKs
- 方法：`workspace/snyk.sdks`
- 参数：`types.WorkspaceFolder`
- 示例：
[{
"type": "java", // 或 python 或 go
"path": "/path/to/sdk" // Java 对应 JAVA_HOME，Go 对应 GOROOT，Python 对应 Python 可执行文件
}]
- 配置通知（协议 v25+）
- 方法：`$/snyk.configuration`
- 参数：`types.LspConfigurationParam`
- 注意：统一的基于映射的协议 — 全局设置 + 每个文件夹的设置，每个设置包含 value、source、origin 和 lock 状态
- 示例：
{
"settings": {
"api_endpoint": { "value": "https://api.snyk.io", "source": "global" },
"snyk_oss_enabled": { "value": true, "source": "ldx-sync", "originScope": "organization" },
"proxy_http": { "value": "http://proxy:8080", "source": "ldx-sync-locked", "originScope": "tenant", "isLocked": true }
},
"folderConfigs": [
{
"folderPath": "/path/to/project",
"settings": {
"base_branch": { "value": "main", "source": "folder" },
"preferred_org": { "value": "org-id", "source": "folder" },
"snyk_code_enabled": { "value": false, "source": "ldx-sync-locked", "originScope": "group", "isLocked": true },
"enabled_severities": { "value": ["critical", "high"], "source": "ldx-sync", "originScope": "organization" }
}
}
]
}
- IDE→LS 使用 `changed: true` 表示 PATCH 语义：`{"snyk_oss_enabled": {"value": true, "changed": true}}`
- 自定义发布诊断通知
- 方法：`$/snyk.publishDiagnostics316`
- 参数：`types.PublishDiagnosticsParams`
- 注意：textDocument/publishDiagnostics 的别名
- 身份验证通知
- 方法：`$/snyk.hasAuthenticated`
- 参数：`types.AuthenticationParams`
- 示例：
{
"token": "the snyk token", // 这可以是一个 oauth2.Token 字符串或传统令牌
"apiUrl": "https://api.snyk.io"
}
- 请参阅 https://pkg.go.dev/golang.org/x/oauth2@v0.6.0#Token 了解有关 oauth 令牌的更多详细信息。
- CLI 路径通知
- 方法：`$/snyk.isAvailableCli`
- 参数：`types.SnykIsAvailableCli`
- 示例：
{
"cliPath": "/a/path/to/cli-executable"
}
- 受信任文件夹通知
- 方法：`$/snyk.addTrustedFolders`
- 参数：`types.SnykTrustedFoldersParams`
- 示例：
{
"trustedFolders": ["/a/path/to/trust"]
}
- 扫描通知
- 方法：`$/snyk.scan`
- 参数：`types.ScanParams`
- 示例：成功扫描
{
"status": "success", // 可能的值："error", "inProgress", "success"
"product": "code", // 可能的值："code", "oss", "iac", "secrets"
"folderPath": "/a/path/to/folder",
}
- 示例：扫描失败并带有错误
{
"status": "error",
"product": "code",
"folderPath": "/a/path/to/folder",
"presentableError": {
"cliError": {
"code": "CLI_ERROR_CODE",
"error": "An error occurred"
},
"showNotification": true,
"treeNodeSuffixError": "(failed)"
}
}
- 摘要面板状态通知
- 方法：`$/snyk.scanSummary`
- 参数：`types.ScanSummary`
- 示例：
{
"scanSummary": " Summary