v22-2.1.2: Extension is very slow and blocks Visual Studio 2022, it forces a rescan if the window get hidden and showed again

[mikeKuester]

Describe the bug

I installed the JFrog VS extension v2.1.2 in my Visual Studio Enterprise 17.11.6. After solving some problems with the authentication, it seems to work "in principal", but is very, very slow and blocks always Visual Studio.

I have - I would say - a mid size .NET solution with 38 projects. If I open the JFrog Windows nothing seems to happen. Then this "VS is busy" dialog appears:

and after nearly 6 minutes the "Component Tree" gets filled:

The issue about the missing icons is about 1,5 years open now: #30

18:24:46 [Info] Calculating NuGet dependencies...
18:25:29 [Info] [Thread 0] Running SCA scan for C:\source\xxx\sources\xxx vulnerable dependencies in C:\source\xxx\sources\xxx directory...
18:25:29 [Info] Scanning 176 nuget dependencies...
18:25:30 [Info] Waiting for scan to complete on JFrog Xray...
18:25:30 [Info] [Thread 2] Running secrets scan...
18:25:35 [Info] [Thread 0] Running IaC scan...
18:25:35 [Info] [Thread 1] Running SAST scan...
18:25:48 [Info] [Thread 0] Found 0 IaC vulnerabilities
18:26:03 [Info] [Thread 1] Found 3 SAST vulnerabilities
18:29:42 [Info] [Thread 2] Found 27 secrets vulnerabilities

[13/11/2024 18:29:42] c:\users\xxx\appdata\local\microsoft\visualstudio\17.0_0e6e98ad\extensions\zgtiqjvl.0ge\Resources\jfrog.exe audit --format="json" --server-id="jfrog-visual-studio-extension" --licenses --fail="false" --working-dirs="C:\source\xxx\sources\xxx" finished successfully

If I switch to another window (like Output) and than back to the JFrog window, the Component Tree is again empty. I didn't click the "refresh" icon! After another 5-6 minutes the tree view gets filled again. It seems, that hiding and showing the window again removes the old scan results and it starts a complete new scan of the project.

18:34:59 [Info] Calculating NuGet dependencies...
18:35:41 [Info] [Thread 0] Running SCA scan for C:\source\xxx\sources\xxx vulnerable dependencies in C:\source\xxx\sources\xxx directory...
18:35:41 [Info] Scanning 176 nuget dependencies...
18:35:41 [Info] Waiting for scan to complete on JFrog Xray...
18:35:42 [Info] [Thread 2] Running secrets scan...
18:35:47 [Info] [Thread 0] Running IaC scan...
18:35:47 [Info] [Thread 1] Running SAST scan...
18:35:59 [Info] [Thread 0] Found 0 IaC vulnerabilities
18:36:14 [Info] [Thread 1] Found 3 SAST vulnerabilities
18:39:46 [Info] [Thread 2] Found 27 secrets vulnerabilities

If I only try to filter a list, this takes nearly a minute to update the tree view.

Current behavior

• Extension doesn't provide a visual feedback, that a scan of the solution is running (with the CLI in the background).
• It blocks Visual Studio.
• It forces always a rescan if the Jfrog window gets hidden and than showed again. The window is empty during the rescan.
• Filtering the result takes also very long.

Reproduction steps

• Load a larger project.
• Open the JFrog window.
• Wait until the results are displayed.
• Switch to another window like Output or ErrorList and than back to the JFrog window.

Expected behavior

• If a scan takes 5-6 minutes, I would expect to see a kind of a progress bar in the window. (The JFrog CLI takes the same time for a scan, so the extension can't be faster, but the user has to get a visual feedback what's going on.)
• A scan should never block Visual Studio.
• Switching the windows must not force a rescan.
• Filtering the tree view should be fast (< 1s).
• The icon issue should also be fixed, as a long list of projects without any indicator doesn't help.

JFrog Visual Studio Extension version

vs22-2.1.2

Operating system type and version

Windows 11 Enterprise 22H2

JFrog Xray version

{"xsc_version":"1.12.5","xray_version":"3.106.7"}

[RobinDinkel]

Even with 64 GB RAM this extension kills the entire machine. The extension seems to be poorly optimized. Pretty much unusable the way it is now.

[kerenr-jfrog]

Hi @mikeKuester and @RobinDinkel, thank you for your valuable feedback!
We are currently addressing the bug fixes and enhancements for the extension and anticipate releasing a new version soon. I will update here once the new version is available.

[kerenr-jfrog]

Hi @mikeKuester and @RobinDinkel , a new version of the extension (v2.1.3) is now available in Visual Studio Marketplace. You can find the detailed change log here.

[mikeKuester]

Hi @kerenr-jfrog ,

thanks, the new version doesn't block Visual Studio and switching the window doesn't restart the scan, but ...

The icon issue is not fixed. Without that getting fixed I can't see if there are any findings:

And the filtering is still broken! Every click on a level starts a new JFrog.exe task which runs several minutes:

I don't know why the extension calls the Jfrog.exe again at all - it should only filter the treeview items in the UI.

With that it's still unusable.