Skip to content

Commit b7220e3

Browse files
satyamchaurasiapersistentsatyamchaurasiapersistent
authored
Merge pull request #437 from checkmarx-ltd/develop
Release Items of Cx-flow 1.7.07
2 parents c27101a + c03361a commit b7220e3

File tree

7 files changed

+122
-19
lines changed

7 files changed

+122
-19
lines changed

‎pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
</parent>
1111
<groupId>com.github.checkmarx-ltd</groupId>
1212
<artifactId>cx-spring-boot-sdk</artifactId>
13-
<version>0.6.19</version>
13+
<version>0.6.20</version>
1414

1515

1616
<name>cx-spring-boot-sdk</name>

‎src/main/java/com/checkmarx/sdk/config/CxProperties.java‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,22 @@ public class CxProperties extends CxPropertiesBase{
3838
@Setter
3939
private Boolean cancelInpregressScan = false;
4040

41+
@Getter
42+
@Setter
43+
44+
private Boolean enableTokenLogin = false;
45+
46+
@Getter
47+
@Setter
48+
private String token ;
49+
50+
51+
@Getter
52+
@Setter
53+
@Builder.Default
54+
private Boolean isDefaultBranchEmpty = false;
55+
56+
4157
@Getter
4258
@Setter
4359
@Builder.Default
@@ -125,6 +141,9 @@ public class CxProperties extends CxPropertiesBase{
125141
@Getter @Setter
126142
private Boolean considerScanningStatus = false;
127143

144+
@Getter @Setter
145+
private Boolean projectSummary= false;
146+
128147

129148
/**
130149
* Maps finding state ID (as returned in CxSAST report) to state name (as specified in filter configuration).
@@ -136,6 +155,14 @@ public class CxProperties extends CxPropertiesBase{
136155
"4", "PROPOSED NOT EXPLOITABLE"
137156
);
138157

158+
private static final Map<String, String> CXSAST_SEVERITY_ID_TO_NAME = ImmutableMap.of(
159+
"0", "INFO",
160+
"1","LOW",
161+
"2", "MEDIUM",
162+
"3", "HIGH",
163+
"4", "CRITICAL"
164+
);
165+
139166
public void setEnabledZipScan(Boolean enabledZipScan){
140167
this.enabledZipScan = enabledZipScan;
141168
}
@@ -342,6 +369,10 @@ public String getStateFullName(String key){
342369
return stateFullName;
343370
}
344371

372+
public String getSeverityFullName(String key){
373+
return CXSAST_SEVERITY_ID_TO_NAME.get(key);
374+
}
375+
345376
public String checkCustomFalsePositive(String key){
346377
try {
347378
return customStateFalsePositiveMap.get(key);

‎src/main/java/com/checkmarx/sdk/config/CxPropertiesBase.java‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,13 @@ public abstract class CxPropertiesBase {
3232
private String excludeFolders;
3333
private Boolean offline = false;
3434
private String teamScript;
35+
36+
@Getter
37+
@Setter
38+
private String branchScript;
39+
@Getter
40+
@Setter
41+
private String defaultBranchScript;
3542
private String projectScript;
3643
private Boolean enablePostActionMonitor = false;
3744
private String postCloneScript;

‎src/main/java/com/checkmarx/sdk/dto/ScanResults.java‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,9 @@ public class ScanResults{
6161
private String output;
6262
private Map<String, Object> additionalDetails;
6363
private CxScanSummary scanSummary;
64+
@Getter
65+
@Setter
66+
private CxScanSummary projectScanSummary;
6467
private SCAResults scaResults;
6568
private ASTResults astResults;
6669

@@ -71,7 +74,7 @@ public class ScanResults{
7174
@Getter @Setter
7275
private String latestCommitterEmail;
7376
public ScanResults(Boolean osa, String projectId,String deepLink, String reportCreationTime, String scanTime, String team, String project, String link, String files, String loc, String scanType,String version,
74-
List<XIssue> xIssues,List<XIssue> unFilteredIssues, Map<String, Object> additionalDetails, CxScanSummary scanSummary, SCAResults scaResults, ASTResults astResults) {
77+
List<XIssue> xIssues,List<XIssue> unFilteredIssues, Map<String, Object> additionalDetails, CxScanSummary scanSummary,CxScanSummary projectScanSummary, SCAResults scaResults, ASTResults astResults) {
7578
this.osa = osa;
7679
this.projectId = projectId;
7780
this.DeepLink = deepLink;
@@ -88,6 +91,7 @@ public ScanResults(Boolean osa, String projectId,String deepLink, String reportC
8891
this.unFilteredIssues = unFilteredIssues;
8992
this.additionalDetails = additionalDetails;
9093
this.scanSummary = scanSummary;
94+
this.projectScanSummary = projectScanSummary;
9195
this.scaResults = scaResults;
9296
this.astResults = astResults;
9397
}
@@ -809,6 +813,7 @@ public static class ScanResultsBuilder {
809813
private List<XIssue> unFilteredIssues;
810814
private Map<String, Object> additionalDetails;
811815
private CxScanSummary scanSummary;
816+
private CxScanSummary projectScanSummary;
812817
private SCAResults scaResults;
813818
private ASTResults astResults;
814819

@@ -874,6 +879,11 @@ public ScanResults.ScanResultsBuilder scanSummary(CxScanSummary scanSummary) {
874879
this.scanSummary = scanSummary;
875880
return this;
876881
}
882+
public ScanResults.ScanResultsBuilder projectScanSummary(CxScanSummary projectScanSummary) {
883+
this.projectScanSummary = projectScanSummary;
884+
return this;
885+
}
886+
877887

878888
public ScanResults.ScanResultsBuilder scaResults(SCAResults scaResults) {
879889
this.scaResults = scaResults;
@@ -886,7 +896,7 @@ public ScanResults.ScanResultsBuilder astResults(ASTResults astResults) {
886896
}
887897

888898
public ScanResults build() {
889-
return new ScanResults(osa, projectId, DeepLink, ReportCreationTime, ScanTime, team, project, link, files, loc, scanType,version, xIssues,unFilteredIssues ,additionalDetails, scanSummary, scaResults, astResults);
899+
return new ScanResults(osa, projectId, DeepLink, ReportCreationTime, ScanTime, team, project, link, files, loc, scanType,version, xIssues,unFilteredIssues ,additionalDetails, scanSummary,projectScanSummary, scaResults, astResults);
890900
}
891901

892902
public String getVersion() {

‎src/main/java/com/checkmarx/sdk/service/CxAuthService.java‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -225,7 +225,13 @@ public HttpHeaders createAuthHeaders() {
225225
//
226226
/// If shards are enabled then fetch the token from the shard; otherwise, use the local one
227227
//
228-
String authToken = token;
228+
String authToken ;
229+
230+
if(cxProperties.getEnableTokenLogin()){
231+
token= cxProperties.getToken();
232+
}
233+
234+
authToken = token;
229235
if(cxProperties.getEnableShardManager()) {
230236
ShardSession shard = sessionTracker.getShardSession();
231237
authToken = shard.getAccessToken();
@@ -234,7 +240,11 @@ public HttpHeaders createAuthHeaders() {
234240
/// Get a new access token if missing or has expired.
235241
//
236242
if (authToken == null || isTokenExpired()) {
237-
getAuthToken();
243+
if(cxProperties.getEnableTokenLogin()){
244+
token= cxProperties.getToken();
245+
}else{
246+
getAuthToken();
247+
}
238248
authToken = token;
239249
}
240250
//

‎src/main/java/com/checkmarx/sdk/service/CxService.java‎

Lines changed: 57 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -409,6 +409,29 @@ public Integer getScanStatus(Integer scanId) {
409409
return UNKNOWN_INT;
410410
}
411411

412+
public String getScanStatusName(Integer scanId) {
413+
HttpEntity httpEntity = new HttpEntity<>(authClient.createAuthHeaders());
414+
log.debug("Retrieving xml status of xml Id {}", scanId);
415+
try {
416+
ResponseEntity<String> projects = restTemplate.exchange(cxProperties.getUrl().concat(SCAN_STATUS), HttpMethod.GET, httpEntity, String.class, scanId);
417+
JSONObject obj = new JSONObject(projects.getBody());
418+
JSONObject status = obj.getJSONObject("status");
419+
log.debug("status id {}, status name {}", status.getInt("id"), status.getString("name"));
420+
return status.getString("name");
421+
} catch (HttpStatusCodeException e) {
422+
log.error("HTTP Status Code of {} while getting xml status for xml Id {}", e.getStatusCode(), scanId);
423+
log.error(ExceptionUtils.getStackTrace(e));
424+
} catch (JSONException e) {
425+
log.error("Error processing JSON Response");
426+
log.error(ExceptionUtils.getStackTrace(e));
427+
}
428+
catch (Exception e) {
429+
log.error("Error occurred while getting scan status");
430+
log.error(ExceptionUtils.getStackTrace(e));
431+
}
432+
return "NA";
433+
}
434+
412435
/**
413436
* Generate a scan report request (xml) based on ScanId
414437
*/
@@ -639,12 +662,17 @@ public ScanResults getReportContent(Integer reportId, FilterConfiguration filter
639662
cxScanBuilder.setVersion(cxResults.getCheckmarxVersion());
640663
cxScanBuilder.additionalDetails(getAdditionalScanDetails(cxResults));
641664
CxScanSummary scanSummary = null;
665+
CxScanSummary projectSummary = null;
642666
if (cxProperties.getRestrictResultsToBranch() != null && cxProperties.getRestrictResultsToBranch()) {
667+
if(cxProperties.getProjectSummary()!=null && cxProperties.getProjectSummary()){
668+
projectSummary = getScanSummaryByScanId(Integer.valueOf(cxResults.getScanId()));
669+
}
643670
scanSummary = new CxScanSummary(summary);
644671
} else {
645672
scanSummary = getScanSummaryByScanId(Integer.valueOf(cxResults.getScanId()));
646673
}
647674
cxScanBuilder.scanSummary(scanSummary);
675+
cxScanBuilder.projectScanSummary(projectSummary);
648676
ScanResults results = cxScanBuilder.build();
649677
//Add the summary map (severity, count)
650678
results.getAdditionalDetails().put(Constants.SUMMARY_KEY, summary);
@@ -837,12 +865,17 @@ public ScanResults getReportContent(File file, FilterConfiguration filter) throw
837865
ScanResults results = cxScanBuilder.build();
838866
if (!cxProperties.getOffline() && !ScanUtils.empty(cxResults.getScanId())) {
839867
CxScanSummary scanSummary = null;
868+
CxScanSummary projectSummary = null;
840869
if (cxProperties.getRestrictResultsToBranch() != null && cxProperties.getRestrictResultsToBranch()) {
870+
if(cxProperties.getProjectSummary()!=null && cxProperties.getProjectSummary()){
871+
projectSummary = getScanSummaryByScanId(Integer.valueOf(cxResults.getScanId()));
872+
}
841873
scanSummary = new CxScanSummary(summary);
842874
} else {
843875
scanSummary = getScanSummaryByScanId(Integer.valueOf(cxResults.getScanId()));
844876
}
845877
results.setScanSummary(scanSummary);
878+
results.setProjectScanSummary(projectSummary);
846879
}
847880
results.getAdditionalDetails().put(Constants.SUMMARY_KEY, summary);
848881
return results;
@@ -1028,7 +1061,7 @@ private ScanResults.XIssue buildIssue(ScanResults.XIssue.XIssueBuilder xIssueBui
10281061
xIssueBuilder.severity(result.getSeverity());
10291062
xIssueBuilder.vulnerability(result.getName());
10301063
xIssueBuilder.file(resultType.getFileName());
1031-
xIssueBuilder.severity(resultType.getSeverity());
1064+
xIssueBuilder.severity(cxProperties.getSeverityFullName(resultType.getSeverityIndex()));
10321065
xIssueBuilder.link(resultType.getDeepLink());
10331066
xIssueBuilder.vulnerabilityStatus(cxProperties.getStateFullName(resultType.getState()));
10341067
xIssueBuilder.queryId(result.getId());
@@ -1171,6 +1204,7 @@ private Map<String, String> getNodeData(List<PathNodeType> nodes, int nodeIndex)
11711204
private void prepareIssuesRemoveDuplicates(List<ScanResults.XIssue> cxIssueList, ResultType resultType, Map<Integer, ScanResults.IssueDetails> details,
11721205
boolean falsePositive, ScanResults.XIssue issue, Map<String, Integer> summary) {
11731206
try {
1207+
String severityName = cxProperties.getSeverityFullName(resultType.getSeverityIndex());
11741208
if (!cxProperties.getDisableClubbing() && cxIssueList.contains(issue)) {
11751209
/*Get existing issue of same vuln+filename*/
11761210
ScanResults.XIssue existingIssue = cxIssueList.get(cxIssueList.indexOf(issue));
@@ -1179,12 +1213,12 @@ private void prepareIssuesRemoveDuplicates(List<ScanResults.XIssue> cxIssueList,
11791213
if (falsePositive) {
11801214
existingIssue.setFalsePositiveCount((existingIssue.getFalsePositiveCount() + 1));
11811215
} else {
1182-
if (!summary.containsKey(resultType.getSeverity())) {
1183-
summary.put(resultType.getSeverity(), 0);
1216+
if (!summary.containsKey(severityName)) {
1217+
summary.put(severityName, 0);
11841218
}
1185-
int severityCount = summary.get(resultType.getSeverity());
1219+
int severityCount = summary.get(severityName);
11861220
severityCount++;
1187-
summary.put(resultType.getSeverity(), severityCount);
1221+
summary.put(severityName, severityCount);
11881222
}
11891223
existingIssue.getDetails().putAll(details);
11901224
} else { //reference exists, ensure fp flag is maintained
@@ -1194,9 +1228,9 @@ private void prepareIssuesRemoveDuplicates(List<ScanResults.XIssue> cxIssueList,
11941228
existingDetails.setFalsePositive(true);
11951229
existingIssue.setFalsePositiveCount((existingIssue.getFalsePositiveCount() + 1));
11961230
//bump down the count for the severity
1197-
int severityCount = summary.get(resultType.getSeverity());
1231+
int severityCount = summary.get(severityName);
11981232
severityCount--;
1199-
summary.put(resultType.getSeverity(), severityCount);
1233+
summary.put(severityName, severityCount);
12001234
}
12011235
}
12021236
//adding description if existing ref found
@@ -1227,12 +1261,12 @@ private void prepareIssuesRemoveDuplicates(List<ScanResults.XIssue> cxIssueList,
12271261
if (falsePositive) {
12281262
issue.setFalsePositiveCount((issue.getFalsePositiveCount() + 1));
12291263
} else {
1230-
if (!summary.containsKey(resultType.getSeverity())) {
1231-
summary.put(resultType.getSeverity(), 0);
1264+
if (!summary.containsKey(severityName)) {
1265+
summary.put(severityName, 0);
12321266
}
1233-
int severityCount = summary.get(resultType.getSeverity());
1267+
int severityCount = summary.get(severityName);
12341268
severityCount++;
1235-
summary.put(resultType.getSeverity(), severityCount);
1269+
summary.put(severityName, severityCount);
12361270
}
12371271
cxIssueList.add(issue);
12381272
}
@@ -2298,7 +2332,11 @@ public Integer createScan(CxScanParams params, String comment) throws CheckmarxE
22982332

22992333
derivedProjectName = params.getProjectName().replace(params.getModifiedProjectName(),defaultBranch);
23002334
}else{
2301-
derivedProjectName = params.getProjectName() + "-" + defaultBranch;
2335+
if(cxProperties.getIsDefaultBranchEmpty() && (defaultBranch==null || defaultBranch.isEmpty())){
2336+
derivedProjectName = params.getProjectName();
2337+
}else{
2338+
derivedProjectName = params.getProjectName() + "-" + defaultBranch;
2339+
}
23022340
}
23032341
}
23042342

@@ -2307,7 +2345,13 @@ public Integer createScan(CxScanParams params, String comment) throws CheckmarxE
23072345
if(baseProjectId.equals(UNKNOWN_INT)){
23082346
baseProjectId = createProject(teamId, derivedProjectName);
23092347
}
2310-
projectId = branchProject(baseProjectId, params.getProjectName());
2348+
2349+
if(cxProperties.getIsDefaultBranchEmpty() && (defaultBranch==null || defaultBranch.isEmpty()) && (currentBranch!=null || !currentBranch.isEmpty())){
2350+
projectId = branchProject(baseProjectId, params.getProjectName()+"-"+currentBranch);
2351+
}else{
2352+
projectId = branchProject(baseProjectId, params.getProjectName());
2353+
}
2354+
23112355
} else {
23122356
projectId = createProject(teamId, params.getProjectName());
23132357
}

‎src/main/java/com/checkmarx/sdk/service/FilterInputFactory.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,12 +37,13 @@ public class FilterInputFactory {
3737

3838
public FilterInput createFilterInputForCxSast(QueryType findingGroup, ResultType finding) {
3939
String stateName = cxProperties.getStateFullName(finding.getState());
40+
String severityName = cxProperties.getSeverityFullName(finding.getSeverityIndex());
4041

4142
return FilterInput.builder()
4243
.id(finding.getNodeId())
4344
.category(findingGroup.getName().toUpperCase(Locale.ROOT))
4445
.cwe(findingGroup.getCweId())
45-
.severity(finding.getSeverity().toUpperCase(Locale.ROOT))
46+
.severity(severityName)
4647
.status(finding.getStatus().toUpperCase(Locale.ROOT))
4748
.state(stateName)
4849
.build();

0 commit comments

Comments
 (0)