Skip to content

Commit

Permalink
fix: add api_version with token
Browse files Browse the repository at this point in the history
  • Loading branch information
thyldrm committed Dec 19, 2024
1 parent bb4c2d4 commit 334ac34
Show file tree
Hide file tree
Showing 2 changed files with 45 additions and 5 deletions.
4 changes: 3 additions & 1 deletion index.js
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,8 @@ const {
start,
status,
result,
saveSarif
saveSarif,
getOrg
} = require("./utils");

let token = process.env.ACCESS_TOKEN;
Expand Down Expand Up @@ -71,6 +72,7 @@ console.log("------------------------------")
const loginIn = async () => {
if (token && (!username || !password)) {
authToken = token;
await getOrg(ctServer, authToken, orgname)
} else if (username && password) {
authToken = await login(ctServer, username, password);
} else {
Expand Down
46 changes: 42 additions & 4 deletions utils.js
Original file line number Diff line number Diff line change
Expand Up @@ -73,14 +73,43 @@ const login = async (ctServer, username, password) => {
client_secret: password,
});
} catch (error) {
throw new Error(error.response.data.message);
if (error.response && error.response.data) {
throw new Error(JSON.stringify(error.response.data));
} else {
throw new Error(error);
}
}
console.log("[CodeThreat]: Login successful");
if (responseToken.headers["x-api-version"])
if (responseToken.headers["x-api-version"]) {
apiVersion = responseToken.headers["x-api-version"];
console.log(`[CodeThreat]: Api Version: ${apiVersion}`);
}

return responseToken.data.access_token;
};

const getOrg = async (ctServer, token, orgname) => {
let response;
try {
response = await axios.get(`${ctServer}/api/organization?key=${orgname}`, {
headers: {
Authorization: token,
"x-ct-organization": orgname,
},
});
} catch (error) {
if (error.response && error.response.data) {
throw new Error(JSON.stringify(error.response.data));
} else {
throw new Error(error);
}
}
if (response.headers["x-api-version"]) {
apiVersion = response.headers["x-api-version"];
console.log(`[CodeThreat]: Api Version: ${apiVersion}`);
}
};

const check = async (ctServer, repoName, authToken, orgname) => {
let checkProject;
const compareVersion = compareVersions("1.7.8", apiVersion);
Expand Down Expand Up @@ -135,7 +164,11 @@ const create = async (
}
);
} catch (error) {
throw new Error(error.response.data.message);
if (error.response && error.response.data) {
throw new Error(JSON.stringify(error.response.data));
} else {
throw new Error(error);
}
}
console.log("Project Created.");
return createProject;
Expand Down Expand Up @@ -213,7 +246,11 @@ const status = async (ctServer, sid, authToken, orgname) => {
},
});
} catch (error) {
throw new Error(error.response.data.message);
if (error.response && error.response.data) {
throw new Error(JSON.stringify(error.response.data));
} else {
throw new Error(error);
}
}
severityLevels.forEach((level) => {
severities[level] = scanProcess.data.sast_severities?.[level] || 0;
Expand Down Expand Up @@ -304,4 +341,5 @@ module.exports = {
status,
result,
saveSarif,
getOrg
};

1 comment on commit 334ac34

@github-actions
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚀 CodeThreat Security Scan Completed for codethreat-github-action

Hello Team,

Great news! We've just completed a thorough security scan for codethreat-github-action, and here's what we found:


Quick Overview

  • Duration: 00:01:19
  • Risk Score: B (This reflects the overall security posture based on the identified issues.)
  • Issues Fixed: 0 (The number of vulnerabilities resolved during this scan.)

🛠 Detailed Vulnerability Analysis

We've identified vulnerabilities across the codebase. Here's a detailed look:

Weakness Name Severity Count
Insecure Random Number Generator High 3
Unsafe Dynamic Method Call Critical 29
Prevent Prototype Pollution Critical 8
Shell Execution Risks High 1

🔗 Software Composition Analysis (SCA) Insights

package-lock.json

Severity Summary: Critical: 0 High: 1 Medium: 3 Low: 0

📈 Next Steps & Full Report

To dive deeper, click here to view the full report. It's essential to review these findings and plan the necessary fixes. If any of the critical/high issues need more discussion, let's set up a quick meeting to strategize our next steps.


🔒 Security isn't just a feature; it's a responsibility. Let's keep our codebase rock solid!

Please sign in to comment.