Define in the user preferences a list of file hashes to be trusted when jar files are added to the classpath of jdt.ls

[provide a description of the issue]

Environment

• Operating System:
• JDK version:
• Visual Studio Code version: Che-theia
• Java extension version:

Steps To Reproduce

When we add a jar file in the classpath like

      java.jdt.ls.vmargs: '-javaagent:/lombok.jar'

a Security Warning is popping up and this is an issue in Che the option is not persisted in the user preferences (but in the global state which is gone when starting a new workspace).

For security reasons, we would like to provide a list of jar files that can be trusted in the preferences. Would be something similar to https://github.com/redhat-developer/vscode-xml/blob/985705ebd603bd08ee8ca149484d3ea48841007a/docs/Preferences.md#trusted-binary-hashes

[Please attach a sample project reproducing the error] Please attach logs

Current Result

Expected Result

Additional Informations

[rgrunber]

I think a good compromise would be what you suggested, to confirm that the path provided by javaagent corresponds to a file that is not provided by the workspace.

[rgrunber]

Just a few workaround to consider before we look at providing some kind of trusted resource store :

1. Can you provide javaagent argument to java.jdt.ls.vmargs under user settings (not workspace settings) ?

As you’ve discovered in https://github.com/redhat-developer/vscode-java/blob/master/src/settings.ts#L141-L158 , when the workspace settings contain javaagent in java.jdt.ls.vmargs, we bring up a popup to warn the user. However, if the setting comes from the user settings, we allow it. On most VSCode instances, this would be under ${userDataDir}/User/settings.json, and ${userDataDir} usually defaults to $HOME/.config/Code/. I’m able to get javaagent accepted as an argument without any prompt using this approach. If so, you’d probably just need to figure out what corresponds to ${userDataDir} in your environment.

1. Can you provision the contents of globalState ?

From https://github.com/redhat-developer/vscode-java/blob/master/src/settings.ts#L141-L158 , the property written to globalState to skip the security check when javaagent is defined in workspace settings, is :

key = redhat.java
value = {"java.ls.isVmargsAllowed::${workspacePath}/jdt_ws::${javaAgentFlag}":true}

where the globalState is usually the sqlite database at ${userDataDir}/User/globalStorage/state.vscdb, ${workspacePath} would be something like /tmp/code-tmp/config/User/workspaceStorage/d7f5a8f370269b38c3449ecf3ba23efb/redhat.java and ${javaAgentFlag} would be something like -javaagent:/tmp/code-tmp/lombok.jar

I’m fairly certain (2) isn’t easy to do, but (1) seems possible. If neither work, we can probably look at some kind of trustedHash setting like we do for vscode-xml.