Skip to content

Commit 959443b

Browse files
cx-atish-jadhavcx-atish-jadhav
authored
Merge branch 'main' into feature/update_cli_2.3.47
2 parents dfc079e + 098f2ec commit 959443b

4 files changed

Lines changed: 112 additions & 5 deletions

File tree

‎pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@
3434
<dependency>
3535
<groupId>com.fasterxml.jackson.core</groupId>
3636
<artifactId>jackson-databind</artifactId>
37-
<version>2.16.1</version>
37+
<version>2.21.1</version>
3838
</dependency>
3939
<dependency>
4040
<groupId>org.projectlombok</groupId>

‎src/main/java/com/checkmarx/ast/wrapper/CxConstants.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ public final class CxConstants {
4343
static final String SCAN_ID = "--scan-id";
4444
static final String PROJECT_ID = "--project-id";
4545
static final String SIMILARITY_ID = "--similarity-id";
46+
static final String VULNERABILITY_IDENTIFIERS = "--vulnerability-identifiers";
4647
static final String QUERY_ID = "--query-id";
4748
static final String STATE = "--state";
4849
static final String COMMENT = "--comment";

‎src/main/java/com/checkmarx/ast/wrapper/CxWrapper.java‎

Lines changed: 68 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,14 +29,12 @@
2929
import org.slf4j.Logger;
3030
import org.slf4j.LoggerFactory;
3131

32-
import java.io.File;
3332
import java.io.IOException;
3433
import java.nio.file.Files;
3534
import java.nio.file.Path;
3635
import java.nio.file.Paths;
3736
import java.util.*;
3837

39-
import static com.checkmarx.ast.wrapper.Execution.*;
4038

4139
public class CxWrapper {
4240

@@ -170,12 +168,46 @@ public List<Predicate> triageShow(@NonNull UUID projectId, String similarityId,
170168
arguments.add(similarityId);
171169
arguments.add(CxConstants.SCAN_TYPE);
172170
arguments.add(scanType);
173-
174171
arguments.addAll(jsonArguments());
175172

176173
return Execution.executeCommand(withConfigArguments(arguments), logger, Predicate::listFromLine, Predicate::validator);
177174
}
178175

176+
/**
177+
* SCA-specific triage show command.
178+
*/
179+
public List<Predicate> triageScaShow(@NonNull UUID projectId, String vulnerabilities, String scanType)
180+
throws IOException, InterruptedException, CxException {
181+
this.logger.info("Executing 'triage show' command using the CLI for SCA.");
182+
183+
if (StringUtils.isBlank(vulnerabilities)) {
184+
this.logger.warn("Skipping SCA triage show: no vulnerability identifiers were provided.");
185+
return Collections.emptyList();
186+
}
187+
188+
List<String> arguments = new ArrayList<>();
189+
arguments.add(CxConstants.CMD_TRIAGE);
190+
arguments.add(CxConstants.SUB_CMD_SHOW);
191+
arguments.add(CxConstants.SCAN_TYPE);
192+
arguments.add(scanType);
193+
arguments.add(CxConstants.VULNERABILITY_IDENTIFIERS);
194+
arguments.add(vulnerabilities);
195+
arguments.add(CxConstants.PROJECT_ID);
196+
arguments.add(projectId.toString());
197+
arguments.addAll(jsonArguments());
198+
199+
try {
200+
return Execution.executeCommand(withConfigArguments(arguments), logger, Predicate::listFromLine, Predicate::validator);
201+
} catch (CxException e) {
202+
String message = e.getMessage();
203+
if (message != null && message.contains("Failed to get SCA predicate result")) {
204+
this.logger.info("No SCA triage history found for vulnerability identifiers: {}", vulnerabilities);
205+
return Collections.emptyList();
206+
}
207+
throw e;
208+
}
209+
}
210+
179211
public List<CustomState> triageGetStates(boolean all) throws IOException, InterruptedException, CxException {
180212
this.logger.info("Executing 'triage get-states' command using the CLI.");
181213

@@ -224,6 +256,39 @@ public void triageUpdate(@NonNull UUID projectId, String similarityId, String sc
224256
Execution.executeCommand(withConfigArguments(arguments), logger, line -> null);
225257
}
226258

259+
/**
260+
* SCA-specific triage update command.
261+
*/
262+
public void triageScaUpdate(@NonNull UUID projectId,
263+
String state,
264+
String comment,
265+
String vulnerabilities,
266+
String scanType)
267+
throws IOException, InterruptedException, CxException {
268+
this.logger.info("Executing 'triage update' command using the CLI for SCA.");
269+
270+
if (StringUtils.isBlank(vulnerabilities)) {
271+
this.logger.warn("Skipping SCA triage update: no vulnerability identifiers were provided.");
272+
return;
273+
}
274+
275+
List<String> arguments = new ArrayList<>();
276+
arguments.add(CxConstants.CMD_TRIAGE);
277+
arguments.add(CxConstants.SUB_CMD_UPDATE);
278+
arguments.add(CxConstants.SCAN_TYPE);
279+
arguments.add(scanType);
280+
arguments.add(CxConstants.VULNERABILITY_IDENTIFIERS);
281+
arguments.add(vulnerabilities);
282+
arguments.add(CxConstants.STATE);
283+
arguments.add(state);
284+
arguments.add(CxConstants.COMMENT);
285+
arguments.add(comment);
286+
arguments.add(CxConstants.PROJECT_ID);
287+
arguments.add(projectId.toString());
288+
289+
Execution.executeCommand(withConfigArguments(arguments), logger, line -> null);
290+
}
291+
227292
public Project projectShow(@NonNull UUID projectId) throws IOException, InterruptedException, CxException {
228293
this.logger.info("Retrieving the details for project id: {}", projectId);
229294

‎src/test/java/com/checkmarx/ast/PredicateTest.java‎

Lines changed: 42 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
import com.checkmarx.ast.scan.Scan;
88
import com.checkmarx.ast.wrapper.CxConstants;
99
import org.junit.jupiter.api.Assertions;
10-
import org.junit.jupiter.api.Disabled;
10+
import org.junit.jupiter.api.Assumptions;
1111
import org.junit.jupiter.api.Test;
1212

1313
import java.util.List;
@@ -52,4 +52,45 @@ void testGetStates() throws Exception {
5252
List<CustomState> states = wrapper.triageGetStates(false);
5353
Assertions.assertNotNull(states);
5454
}
55+
56+
@Test
57+
void testScaTriage() throws Exception {
58+
// Automatically find a completed scan that has SCA results
59+
List<Scan> scans = wrapper.scanList("statuses=Completed");
60+
61+
Scan scaScan = null;
62+
Result scaResult = null;
63+
64+
for (Scan scan : scans) {
65+
Results results = wrapper.results(UUID.fromString(scan.getId()));
66+
scaResult = results.getResults().stream()
67+
.filter(res -> res.getType().equalsIgnoreCase("sca"))
68+
.findFirst()
69+
.orElse(null);
70+
if (scaResult != null) {
71+
scaScan = scan;
72+
break;
73+
}
74+
}
75+
76+
Assumptions.assumeTrue(scaScan != null, "Skipping: no completed scan with SCA results found");
77+
78+
String packageIdentifier = scaResult.getData().getPackageIdentifier();
79+
int firstDash = packageIdentifier.indexOf('-');
80+
int lastDash = packageIdentifier.lastIndexOf('-');
81+
String vulnerabilities = String.format("packagename=%s,packageversion=%s,vulnerabilityId=%s,packagemanager=%s",
82+
packageIdentifier.substring(firstDash + 1, lastDash),
83+
packageIdentifier.substring(lastDash + 1),
84+
scaResult.getVulnerabilityDetails().getCveName(),
85+
packageIdentifier.substring(0, firstDash).toLowerCase());
86+
87+
List<Predicate> predicates = wrapper.triageScaShow(UUID.fromString(scaScan.getProjectId()), vulnerabilities, scaResult.getType());
88+
Assertions.assertNotNull(predicates);
89+
90+
try {
91+
wrapper.triageScaUpdate(UUID.fromString(scaScan.getProjectId()), TO_VERIFY, "Edited via Java Wrapper", vulnerabilities, scaResult.getType());
92+
} catch (Exception e) {
93+
Assertions.fail("SCA triage update failed. Should not throw exception");
94+
}
95+
}
5596
}

0 commit comments

Comments
 (0)