Skip to content

Commit d637137

Browse files
cx-anjali-deorecx-atish-jadhavcx-anand-nandeshwarcx-hitesh-madgulkar
authored
Changes related to ignore/revive functionality (AST-109612) (#457)
* aimcp server changes * oss-realtime scanner changes * Create OssRealtimeVulnerability.java * Unify realtime scan wrappers; consolidate Secrets/IaC models; deprecate and stub obsolete result classes * Add ContainersRealtimeVulnerability model for containers realtime scan parsing * Add @JsonCreator constructor to OssRealtimeVulnerability for reliable Jackson deserialization * Refactoring package name and adding test for oss and mcp flag * Add integration tests for OSS, Container, and Secrets realtime scanners * Replaced Id to CVE in oss vulnerability * Changed variable from id to CVE as per OSS response * aimcp server changes * oss-realtime scanner changes * Create OssRealtimeVulnerability.java * Unify realtime scan wrappers; consolidate Secrets/IaC models; deprecate and stub obsolete result classes * Add ContainersRealtimeVulnerability model for containers realtime scan parsing * Add @JsonCreator constructor to OssRealtimeVulnerability for reliable Jackson deserialization * Refactoring package name and adding test for oss and mcp flag * Add integration tests for OSS, Container, and Secrets realtime scanners * Changed variable from id to CVE as per OSS response * Add maskedResult for secret remediation and change log level from INFO to DEBUG * Remove masked secrets functionality from codebase * Implemented mask cmd in java wrapper * Added fix for containerTool for IAC * Add telemetry AI command with full parameter support and tests * Add ignoredFilePath parameter to ScanAsca method * Removing ASCA ignore file path changes * Add ignoredFilePath parameter to ScanAsca realtime * - Changed ast cli version * added-isdev-isoneassist-function * - Adding engine check * - Added check for engine verification in path * - Added checks message for exception * - Added checks message for exception * passing-agent-name-jb-in-all-cmd * merge-fix * placed-cli-exe * Revert "Merge branch 'main' into feature/ASCA_IgnoreFile" This reverts commit 7a6d229, reversing changes made to 8b47577. * Update checkmarx-ast-cli.version * - Added fallback for macOS engine detection * - Refactored code as per review comments --------- Co-authored-by: atishj99 <141334503+cx-atish-jadhav@users.noreply.github.com> Co-authored-by: cx-anand-nandeshwar <73646287+cx-anand-nandeshwar@users.noreply.github.com> Co-authored-by: Hitesh Madgulkar <212497904+cx-hitesh-madgulkar@users.noreply.github.com>
1 parent c92869b commit d637137

File tree

10 files changed

+158
-38
lines changed

10 files changed

+158
-38
lines changed

‎src/main/java/com/checkmarx/ast/wrapper/CxConfig.java‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
public class CxConfig {
1717

1818
private static final Pattern pattern = Pattern.compile("([^\"]\\S*|\".+?\")\\s*");
19-
19+
private String agentName; //JETBRAINS
2020
private String baseUri;
2121
private String baseAuthUri;
2222
private String tenant;
@@ -66,6 +66,10 @@ List<String> toArguments() {
6666
commands.add(CxConstants.BASE_AUTH_URI);
6767
commands.add(getBaseAuthUri());
6868
}
69+
if (getAgentName() != null && !getAgentName().isEmpty()) {
70+
commands.add("--agent");
71+
commands.add(getAgentName());
72+
}
6973
if (getAdditionalParameters() != null)
7074
commands.addAll(getAdditionalParameters());
7175

‎src/main/java/com/checkmarx/ast/wrapper/CxConstants.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,8 @@ public final class CxConstants {
7575
static final String SUB_CMD_TENANT = "tenant";
7676
static final String IDE_SCANS_KEY = "scan.config.plugins.ideScans";
7777
static final String AI_MCP_SERVER_KEY = "scan.config.plugins.aiMcpServer";
78+
static final String DEV_ASSIST_LICENSE_KEY = "scan.config.plugins.cxdevassist";
79+
static final String ONE_ASSIST_LICENSE_KEY = "scan.config.plugins.cxoneassist";
7880
static final String IGNORED_FILE_PATH = "--ignored-file-path";
7981
static final String SUB_CMD_OSS_REALTIME = "oss-realtime";
8082
static final String SUB_CMD_IAC_REALTIME = "iac-realtime";
@@ -91,4 +93,8 @@ public final class CxConstants {
9193
static final String SCAN_TYPE_FLAG = "--scan-type";
9294
static final String STATUS = "--status";
9395
static final String TOTAL_COUNT = "--total-count";
96+
static final String DOCKER = "docker";
97+
static final String PODMAN = "podman";
98+
static final String PODMAN_FALLBACK_PATH = "/usr/local/bin/podman";
99+
static final String DOCKER_FALLBACK_PATH = "/usr/local/bin/docker";
94100
}

‎src/main/java/com/checkmarx/ast/wrapper/CxWrapper.java‎

Lines changed: 109 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -29,17 +29,22 @@
2929
import org.slf4j.Logger;
3030
import org.slf4j.LoggerFactory;
3131

32+
import java.io.File;
3233
import java.io.IOException;
3334
import java.nio.file.Files;
34-
import java.util.ArrayList;
35-
import java.util.List;
36-
import java.util.Map;
37-
import java.util.UUID;
35+
import java.nio.file.Path;
36+
import java.nio.file.Paths;
37+
import java.util.*;
38+
39+
import static com.checkmarx.ast.wrapper.Execution.*;
3840

3941
public class CxWrapper {
4042

4143
private static final CollectionType BRANCHES_TYPE = TypeFactory.defaultInstance()
4244
.constructCollectionType(List.class, String.class);
45+
private static final String OS_LINUX = "linux";
46+
private static final String OS_WINDOWS = "windows";
47+
private static final String OS_MAC = "mac";
4348

4449
@NonNull
4550
private final CxConfig cxConfig;
@@ -248,7 +253,7 @@ public List<Project> projectList(String filter) throws IOException, InterruptedE
248253
return Execution.executeCommand(withConfigArguments(arguments), logger, Project::listFromLine);
249254
}
250255

251-
public ScanResult ScanAsca(String fileSource, boolean ascaLatestVersion, String agent) throws IOException, InterruptedException, CxException {
256+
public ScanResult ScanAsca(String fileSource, boolean ascaLatestVersion, String agent, String ignoredFilePath) throws IOException, InterruptedException, CxException {
252257
this.logger.info("Fetching ASCA scanResult");
253258

254259
List<String> arguments = new ArrayList<>();
@@ -259,23 +264,27 @@ public ScanResult ScanAsca(String fileSource, boolean ascaLatestVersion, String
259264
if (ascaLatestVersion) {
260265
arguments.add(CxConstants.ASCA_LATEST_VERSION);
261266
}
267+
if (StringUtils.isNotBlank(ignoredFilePath)) {
268+
arguments.add(CxConstants.IGNORED_FILE_PATH);
269+
arguments.add(ignoredFilePath);
270+
}
271+
262272

263-
appendAgentToArguments(agent, arguments);
264273

265274
return Execution.executeCommand(withConfigArguments(arguments), logger, ScanResult::fromLine,
266275
(args, ignored) ->
267276
(args.size() >= 3 && args.get(1).equals(CxConstants.CMD_SCAN) && args.get(2).equals(CxConstants.SUB_CMD_ASCA)));
268277
}
269278

270-
private static void appendAgentToArguments(String agent, List<String> arguments) {
271-
arguments.add(CxConstants.AGENT);
272-
if (agent != null && !agent.isEmpty()){
273-
arguments.add(agent);
274-
}
275-
else{
276-
arguments.add("CLI-Java-Wrapper");
277-
}
278-
}
279+
// private static void appendAgentToArguments(String agent, List<String> arguments) {
280+
// arguments.add(CxConstants.AGENT);
281+
// if (agent != null && !agent.isEmpty()){
282+
// arguments.add(agent);
283+
// }
284+
// else{
285+
// arguments.add("CLI-Java-Wrapper");
286+
// }
287+
// }
279288

280289
public List<String> projectBranches(@NonNull UUID projectId, String filter)
281290
throws CxException, IOException, InterruptedException {
@@ -345,10 +354,6 @@ public String results(@NonNull UUID scanId, ReportFormat reportFormat, String ag
345354
arguments.add(fileName);
346355
arguments.add(CxConstants.OUTPUT_PATH);
347356
arguments.add(tempDir);
348-
if (agent != null) {
349-
arguments.add(CxConstants.AGENT);
350-
arguments.add(agent);
351-
}
352357
return Execution.executeCommand(arguments,
353358
logger, tempDir,
354359
fileName + reportFormat.getExtension());
@@ -409,6 +414,68 @@ public KicsRealtimeResults kicsRealtimeScan(@NonNull String fileSources, String
409414
return Execution.executeCommand(withConfigArguments(arguments), logger, KicsRealtimeResults::fromLine);
410415
}
411416

417+
public String checkEngineExist(@NonNull String engineName) throws CxException, IOException, InterruptedException {
418+
String osName = System.getProperty("os.name").toLowerCase(Locale.ENGLISH);
419+
String osType=Execution.getOperatingSystemType(osName);
420+
return this.checkEngine(engineName,osType);
421+
}
422+
423+
private String verifyEngineOnMAC(String engineName,List<String>arguments) throws CxException, IOException, InterruptedException {
424+
Exception lastException = null;
425+
String enginePath;
426+
try{
427+
enginePath= Execution.executeCommand((arguments), logger, line->line);
428+
return enginePath;
429+
} catch (CxException | IOException e) {
430+
lastException = e;
431+
}
432+
Path dockerPath = Paths.get(CxConstants.DOCKER_FALLBACK_PATH);
433+
Path podmanPath = Paths.get(CxConstants.PODMAN_FALLBACK_PATH);
434+
if (CxConstants.DOCKER.equalsIgnoreCase(engineName)) {
435+
if (Files.isSymbolicLink(dockerPath)) {
436+
return Files.readSymbolicLink(dockerPath).toAbsolutePath().toString();
437+
}
438+
else { return dockerPath.toAbsolutePath().toString(); }
439+
}
440+
else if (CxConstants.PODMAN.equalsIgnoreCase(engineName)) {
441+
if (Files.exists(podmanPath)) {
442+
if (Files.isSymbolicLink(podmanPath)) {
443+
return Files.readSymbolicLink(podmanPath).toAbsolutePath().toString();
444+
}
445+
else{
446+
return podmanPath.toAbsolutePath().toString();
447+
}
448+
}
449+
}
450+
throw new CxException( 1, "Engine '" + engineName + "' is not installed or not symlinked to /usr/local/bin." );
451+
}
452+
453+
private String checkEngine(String engineName, String osType ) throws CxException, IOException, InterruptedException {
454+
List<String> arguments = new ArrayList<>();
455+
switch (osType){
456+
case OS_MAC:
457+
arguments.add("/bin/sh");
458+
arguments.add("-c");
459+
arguments.add("command -v " + engineName);
460+
return verifyEngineOnMAC(engineName,arguments);
461+
case OS_WINDOWS:
462+
case OS_LINUX:
463+
arguments.add(engineName);
464+
arguments.add("--version");
465+
try {
466+
Execution.executeCommand(arguments, logger, line -> line);
467+
return engineName;
468+
} catch (CxException | IOException e) {
469+
throw new CxException(
470+
1,engineName+" is not installed or is not accessible from the system PATH."
471+
);
472+
}
473+
default:
474+
throw new IllegalArgumentException("Unsupported OS: " + osType);
475+
}
476+
477+
}
478+
412479
public <T> T realtimeScan(@NonNull String subCommand, @NonNull String sourcePath, String containerTool, String ignoredFilePath, java.util.function.Function<String, T> resultParser)
413480
throws IOException, InterruptedException, CxException {
414481
this.logger.info("Executing 'scan {}' command using the CLI.", subCommand);
@@ -495,7 +562,7 @@ public List<LearnMore> learnMore(String queryId) throws CxException, IOException
495562

496563
public boolean ideScansEnabled() throws CxException, IOException, InterruptedException {
497564
List<TenantSetting> tenantSettings = tenantSettings();
498-
if (tenantSettings == null) {
565+
if (tenantSettings == null || tenantSettings.isEmpty()) {
499566
throw new CxException(1, "Unable to parse tenant settings");
500567
}
501568
return tenantSettings.stream()
@@ -526,6 +593,28 @@ public List<TenantSetting> tenantSettings() throws CxException, IOException, Int
526593
return Execution.executeCommand(withConfigArguments(arguments), logger, TenantSetting::listFromLine);
527594
}
528595

596+
597+
598+
public boolean getTenantSetting(String key) throws CxException, IOException, InterruptedException {
599+
List<TenantSetting> tenantSettings = tenantSettings();
600+
if (tenantSettings == null) {
601+
throw new CxException(1, "Unable to parse tenant settings");
602+
}
603+
return tenantSettings.stream()
604+
.filter(t -> t.getKey().equals(key))
605+
.findFirst()
606+
.map(t -> Boolean.parseBoolean(t.getValue()))
607+
.orElse(false);
608+
}
609+
public boolean devAssistEnabled() throws CxException, IOException, InterruptedException {
610+
return getTenantSetting(CxConstants.DEV_ASSIST_LICENSE_KEY);
611+
612+
}
613+
614+
public boolean oneAssistEnabled() throws CxException, IOException, InterruptedException {
615+
return getTenantSetting(CxConstants.ONE_ASSIST_LICENSE_KEY);
616+
}
617+
529618
public MaskResult maskSecrets(@NonNull String filePath) throws CxException, IOException, InterruptedException {
530619
List<String> arguments = new ArrayList<>();
531620

@@ -565,8 +654,6 @@ public String telemetryAIEvent(String aiProvider, String agent, String eventType
565654
arguments.add(CxConstants.SUB_CMD_TELEMETRY_AI);
566655
arguments.add(CxConstants.AI_PROVIDER);
567656
arguments.add(aiProvider);
568-
arguments.add(CxConstants.AGENT);
569-
arguments.add(agent);
570657
arguments.add(CxConstants.TYPE);
571658
arguments.add(eventType);
572659
arguments.add(CxConstants.SUB_TYPE);

‎src/main/java/com/checkmarx/ast/wrapper/Execution.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
package com.checkmarx.ast.wrapper;
22

3+
import com.checkmarx.ast.kicsRealtimeResults.KicsRealtimeResults;
34
import lombok.NonNull;
45
import org.slf4j.Logger;
56

@@ -12,10 +13,7 @@
1213
import java.nio.file.Paths;
1314
import java.security.MessageDigest;
1415
import java.security.NoSuchAlgorithmException;
15-
import java.util.Arrays;
16-
import java.util.List;
17-
import java.util.Locale;
18-
import java.util.Objects;
16+
import java.util.*;
1917
import java.util.function.BiFunction;
2018
import java.util.function.Function;
2119

@@ -171,7 +169,7 @@ private static String detectBinaryName(@NonNull Logger logger) {
171169
return fileName;
172170
}
173171

174-
private static String getOperatingSystemType(String osName) {
172+
public static String getOperatingSystemType(String osName) {
175173
if (osName.contains(OS_LINUX)) {
176174
return OS_LINUX;
177175
} else if (osName.contains(OS_WINDOWS)) {
@@ -217,4 +215,6 @@ private static String md5(InputStream a) {
217215
}
218216
return md5;
219217
}
218+
219+
220220
}

‎src/main/resources/cx-linux‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
version https://git-lfs.github.com/spec/v1
2-
oid sha256:a2ec1fcc76f04596c976b5039ff8d755f3e6534f06ecf442cb8d22c4f3e8f9c8
3-
size 81055928
2+
oid sha256:2972512d55630f04f494fdf3543a3edf37906b970f5e29f58127ad27c40b652c
3+
size 81023160

‎src/main/resources/cx-linux-arm‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
version https://git-lfs.github.com/spec/v1
2-
oid sha256:23dbe8b789c4c358023a98c15fdc57a468fff934804bbbfbb3ec5fa90d803c11
2+
oid sha256:ba3e45134be18e2093521df1f5e337c749e231fc926d5928815be4bbc68c4dd0
33
size 77332664

‎src/main/resources/cx-mac‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
version https://git-lfs.github.com/spec/v1
2-
oid sha256:a0a89e14ad8516e093625d3eff5713c83696d12494664c338839731f8dd8a79e
3-
size 163042800
2+
oid sha256:7da05ed86e02142c414ebfa2ed335b71357f7d407291b9952bf5860c7bf78dab
3+
size 162975392

‎src/main/resources/cx.exe‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
version https://git-lfs.github.com/spec/v1
2-
oid sha256:3f73d920a720bd8c3a6f4f234a77589e51611f07645c53baf1650396f77ed4f3
3-
size 83032512
2+
oid sha256:5fb41bc7c8d5b3db18f4626d9523fc626fd19c6f88e1bb078184e7b6e2532fed
3+
size 82995136

‎src/test/java/com/checkmarx/ast/ScanTest.java‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ void testScanShow() throws Exception {
2525

2626
@Test
2727
void testScanAsca_WhenFileWithVulnerabilitiesIsSentWithAgent_ReturnSuccessfulResponseWithCorrectValues() throws Exception {
28-
ScanResult scanResult = wrapper.ScanAsca("src/test/resources/python-vul-file.py", true, "vscode");
28+
ScanResult scanResult = wrapper.ScanAsca("src/test/resources/python-vul-file.py", true, "vscode", null);
2929

3030
// Assertions for the scan result
3131
Assertions.assertNotNull(scanResult.getRequestId(), "Request ID should not be null");
@@ -46,7 +46,7 @@ void testScanAsca_WhenFileWithVulnerabilitiesIsSentWithAgent_ReturnSuccessfulRes
4646

4747
@Test
4848
void testScanAsca_WhenFileWithoutVulnerabilitiesIsSent_ReturnSuccessfulResponseWithCorrectValues() throws Exception {
49-
ScanResult scanResult = wrapper.ScanAsca("src/test/resources/csharp-no-vul.cs", true, null);
49+
ScanResult scanResult = wrapper.ScanAsca("src/test/resources/csharp-no-vul.cs", true, null, null);
5050
Assertions.assertNotNull(scanResult.getRequestId());
5151
Assertions.assertTrue(scanResult.isStatus());
5252
Assertions.assertNull(scanResult.getError());
@@ -55,12 +55,25 @@ void testScanAsca_WhenFileWithoutVulnerabilitiesIsSent_ReturnSuccessfulResponseW
5555

5656
@Test
5757
void testScanAsca_WhenMissingFileExtension_ReturnFileExtensionIsRequiredFailure() throws Exception {
58-
ScanResult scanResult = wrapper.ScanAsca("CODEOWNERS", true, null);
58+
ScanResult scanResult = wrapper.ScanAsca("CODEOWNERS", true, null, null);
5959
Assertions.assertNotNull(scanResult.getRequestId());
6060
Assertions.assertNotNull(scanResult.getError());
6161
Assertions.assertEquals("The file name must have an extension.", scanResult.getError().getDescription());
6262
}
6363

64+
@Test
65+
void testScanAsca_WithIgnoreFilePath_ShouldWorkCorrectly() throws Exception {
66+
String ignoreFile = "src/test/resources/ignored-packages.json";
67+
68+
// Test with ignore file - should not break the scanning process
69+
ScanResult scanResult = wrapper.ScanAsca("src/test/resources/python-vul-file.py", true, "test-agent", ignoreFile);
70+
71+
// Verify the scan completes successfully
72+
Assertions.assertNotNull(scanResult.getRequestId(), "Request ID should not be null");
73+
Assertions.assertTrue(scanResult.isStatus(), "Status should be true");
74+
Assertions.assertNull(scanResult.getError(), "Error should be null when scan is successful");
75+
}
76+
6477
@Test
6578
void testScanList() throws Exception {
6679
List<Scan> cxOutput = wrapper.scanList("limit=10");

‎src/test/java/com/checkmarx/ast/TenantTest.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,4 +24,14 @@ void testAiMcpServerEnabled() throws Exception {
2424
boolean enabled = Assertions.assertDoesNotThrow(() -> wrapper.aiMcpServerEnabled());
2525
Assertions.assertTrue(enabled, "AI MCP Server flag expected to be true");
2626
}
27+
28+
@Test
29+
void testDevAssistEnabled() {
30+
Assertions.assertDoesNotThrow(() -> wrapper.devAssistEnabled());
31+
}
32+
33+
@Test
34+
void testOneAssistEnabled() {
35+
Assertions.assertDoesNotThrow(() -> wrapper.oneAssistEnabled());
36+
}
2737
}

0 commit comments

Comments
 (0)