Clarify in UI if extensions run code

[isidorn]

Currently there is no difference in the extension UI if an extension is running code or has no code - like themes.
Also I believe that most of our users are unaware that extensions that they install can execute any code they want.
I think we should:

• Make it more transparent that extensions with code can execute any code they want. The message should be informative but not scary.
• Make it obvious extensions like themes do not run code and thus are "safe"
• If an extension that has no code updates to a version that introduces code we should show a model dialog to the user to ask them if they want to apply the update. The wording of the dialog should be geared towards not allowing the update.

fyi @daviddossett @alexdima

[daviddossett]

Probably also needs to be considered alongside #151599 if we're surfacing this in the list view. Otherwise we can think about how this might be surface on the detail and marketplace pages.

[isidorn]

@daviddossett I would not put this in the list view but only in the extension details page. That page has details that users can look at before installing an extension, and I feel like that is the right spot for this.

[sandy081]

May I know the root cause that is driving this?

[isidorn]

@sandy081 lot's of security features are about preventing something, there is no cause other than making VS Code secure and trustworthy.
What we want to prevent is the following:

1. Malicious actor publishes a nice theme extension on the marketplace
2. everybody install the theme seeing as it has no code they can trust this extension
3. Malicious actor updates the theme extension to contain malicious code
4. Everybody gets auto updated 💣

[sandy081]

Wondering any extension that a malicious author publishes has the same security concerns even if the extension had code or not before?

CC @alexdima

[isidorn]

@sandy081 I actually pinged Alex Dima on the first comment because this is his idea :) I should have mentioned that - sorry.

[vscodenpa]

We closed this issue because we don't plan to address it in the foreseeable future. If you disagree and feel that this issue is crucial: we are happy to listen and to reconsider.

If you wonder what we are up to, please see our roadmap and issue reporting guidelines.

Thanks for your understanding, and happy coding!