SCA Support (#116) #117

vishalhcl-5960 · 2023-11-09T13:02:35Z

ASA-6458
Enhance Jenkins Plugin to support SAST-SCA separation.

ASA-6458 Enhance Jenkins Plugin to support SAST-SCA separation.

CLAassistant · 2023-11-09T13:02:42Z

All committers have signed the CLA.

vishalhcl-5960 · 2023-11-09T13:07:46Z

src/main/java/com/hcl/appscan/sdk/http/HttpClient.java

Can we create a new class of HttpClient to accomodate the changes required for the support of SCA?

There shouldn't be any need for that.

mattmurp · 2023-11-09T14:19:31Z

src/main/java/com/hcl/appscan/sdk/messages.properties

@@ -51,6 +51,7 @@ error.http=Response Code: {0}\nReason: {1}
 error.login.type.deprectated=The specified login type is deprecated. Please use API key and secret.
 error.getting.info=An error occurred getting information for {0} with id {1}.
 error.url.validation = An error occurred while validating the URL.
+warning.sca = Note: To scan open-source files, use the Software Composition Analysis (SCA) scan type. AppScan on Cloud is phasing out open source-only scanning with static analysis scans.


I would like to get this message reworded. The phrase "phasing out" makes it sound like we're removing SCA scanning altogether, which is not the case. Perhaps something like:
"Note: AppScan on Cloud (ASoC) now performs SAST and SCA analysis as separate scans. To execute an open-source only scan, use the Software Composition Analysis (SCA) scan type. The open-source only option will be removed from SAST scans in a future release."

Sure, Matt.

mattmurp · 2023-11-09T14:26:28Z

src/main/java/com/hcl/appscan/sdk/scanners/sca/SCAScan.java

@@ -0,0 +1,101 @@
+package com.hcl.appscan.sdk.scanners.sca;


This class is almost identical to the existing SASTScan class. It would be better to extend SASTScan and adjust as needed than to copy the code into a new class.

Okay, will do accordingly.

mattmurp · 2023-11-09T14:27:28Z

src/main/java/com/hcl/appscan/sdk/scanners/sca/SCAScanFactory.java

+
+    @Override
+    public String getType() {
+        return "Sca";


This should be a constant that returns "Software Composition Analysis".

I am modifying it as "Software Composition Analyzer".

mattmurp · 2023-11-09T14:30:14Z

src/main/java/com/hcl/appscan/sdk/scanners/sast/SASTScan.java

@@ -47,6 +48,10 @@ public void run() throws ScannerException, InvalidTargetException {
 		if(target == null || !(new File(target).exists()))
 			throw new InvalidTargetException(Messages.getMessage(TARGET_INVALID, target));

+        if (getProperties().containsKey(OPEN_SOURCE_ONLY)){


This check should not be here. Running an open-source only scan via the SDK is still a valid way to run a scan. This warning appears to be specific to the Jenkins plugin, so it should be in the Jenkins plugin code, not here where it will effect all clients that use the sdk.

Okay sure, Matt.

mattmurp · 2023-11-09T14:31:41Z

src/main/java/com/hcl/appscan/sdk/scanners/sast/SAClient.java

@@ -326,7 +326,7 @@ private List<String> getClientArgs(Map<String, String> properties) {
 			args.add(OPT_VERBOSE);
 		if(properties.containsKey(THIRD_PARTY) || System.getProperty(THIRD_PARTY) != null)
 			args.add(OPT_THIRD_PARTY);
-		if (properties.containsKey(OPEN_SOURCE_ONLY) || System.getProperty(OPEN_SOURCE_ONLY) != null)
+		if (properties.containsKey(OPEN_SOURCE_ONLY) || System.getProperty(OPEN_SOURCE_ONLY) != null || properties.get(CoreConstants.SCANNER_TYPE).equals("Sca"))


This should be checking a constant rather than the hardcoded string "Sca".

Yeah Matt, declared a common constant in the Core Constant class.

mattmurp · 2023-11-09T14:36:18Z

src/main/java/com/hcl/appscan/sdk/scan/CloudScanServiceProvider.java

-		String request_url =  m_authProvider.getServer() + String.format(API_SCANNER, type);
-		Map<String, String> request_headers = m_authProvider.getAuthorizationHeader(true);
-
+        	Map<String, String> request_headers = m_authProvider.getAuthorizationHeader(true);


Eventually all scans will be using the v4 api, so we shouldn't be modifying this method to account for SCA explicitly. We should create 2 instances of this method. One for v2 and one for v4. The existing method should then make a determination as to which of those 2 methods it should execute. That would ideally be done through a private method that returns a boolean (e.g. shouldUseV4Api()). Today that method would just return if the scan type is SCA, but it could be modified easily later.

Okay. For this, I have created 2 private methods of name "createAndExecuteScanUsingV2Api()" or "createAndExecuteScanUsingV4Api()" which will be using v2 or v4 APIs for the scan execution & the calling of these methods being made using shouldUseV4Api() method.

mattmurp · 2023-11-09T14:41:56Z

src/main/java/com/hcl/appscan/sdk/http/HttpClient.java

There shouldn't be any need for that.

mattmurp · 2023-11-09T14:43:07Z

src/main/java/com/hcl/appscan/sdk/http/HttpClient.java

+     * @return The response as a byte array.
+     * @throws IOException If an error occurs.
+     */
+    public HttpResponse postFormV4(String url, Map<String, String> headerProperties, Map<String, String> params)


This should just be an overload of the post() method, not postFormV4(). I suggest removing all references to v4 from the javadoc, as well, since this is a class for making http requests. It has nothing to do with any specific version of any specific api.

Okay, Understood.

Suggested changes

mattmurp · 2023-11-13T16:01:01Z

src/main/java/com/hcl/appscan/sdk/scan/CloudScanServiceProvider.java

 	}
+
+    private String createAndExecuteScanUsingV2Api(String type, Map<String, String> params) {


These 2 methods are almost identical to one another. The only difference is the specific api being used and the addition of a few headers. If those additional headers are valid when using the v2 api, this could be much simpler by getting the url based on the shouldUseV4Api() check and then everything else is the same.

Matt, Made the changes accordingly.

* SCA support * remove the check for OSO from SDK

mattmurp · 2023-11-16T18:47:06Z

src/main/java/com/hcl/appscan/sdk/scanners/sast/SASTScan.java

-		setScanId(getServiceProvider().createAndExecuteScan(STATIC_ANALYZER, params));
+		params.put(FILE_ID, fileId);
+
+        if(getType().equals(CoreConstants.SOFTWARE_COMPOSITION_ANALYZER)) {


I suggest breaking this if/else case out into a separate method. In the SCAScan, you can override the method to do what we need for SCA.

Sure, made the changes accordingly.

* removed the SCA check from the analyzeIR() method

SCA Support (#116)

d998a8a

ASA-6458 Enhance Jenkins Plugin to support SAST-SCA separation.

vishalhcl-5960 requested a review from mattmurp November 9, 2023 13:02

vishalhcl-5960 commented Nov 9, 2023

View reviewed changes

mattmurp reviewed Nov 9, 2023

View reviewed changes

SAST SCA separation (#118)

a96bb24

Suggested changes

vishalhcl-5960 requested a review from mattmurp November 13, 2023 12:28

mattmurp reviewed Nov 13, 2023

View reviewed changes

vishalhcl-5960 added 3 commits November 13, 2023 23:49

Suggested changes (#119)

328429a

Update CoreConstants.java

8e8c9e3

Remove the OSO check from SDK (#121)

60f90f5

* SCA support * remove the check for OSO from SDK

mattmurp reviewed Nov 16, 2023

View reviewed changes

vishalhcl-5960 added 5 commits November 17, 2023 00:57

removed the SCA check from the analyzeIR() method (#122)

b9bfffa

* removed the SCA check from the analyzeIR() method

Update SASTScan.java

7bfb46b

Update CoreConstants.java

d6a8f46

Update SASTScan.java

7a29b9b

Update SCAScan.java

4a7bc2b

mattmurp approved these changes Nov 17, 2023

View reviewed changes

vishalhcl-5960 merged commit a5820d2 into master Nov 20, 2023
1 check passed

vishalhcl-5960 deleted the SCA-Support branch January 8, 2024 12:04

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SCA Support (#116) #117

SCA Support (#116) #117

vishalhcl-5960 commented Nov 9, 2023

CLAassistant commented Nov 9, 2023 •

edited

Loading

vishalhcl-5960 Nov 9, 2023

mattmurp Nov 9, 2023

mattmurp Nov 9, 2023

vishalhcl-5960 Nov 10, 2023

mattmurp Nov 9, 2023

vishalhcl-5960 Nov 10, 2023

mattmurp Nov 9, 2023

vishalhcl-5960 Nov 10, 2023

mattmurp Nov 9, 2023

vishalhcl-5960 Nov 10, 2023

mattmurp Nov 9, 2023

vishalhcl-5960 Nov 13, 2023

mattmurp Nov 9, 2023

vishalhcl-5960 Nov 13, 2023

mattmurp Nov 9, 2023

mattmurp Nov 9, 2023

vishalhcl-5960 Nov 13, 2023

mattmurp Nov 13, 2023

vishalhcl-5960 Nov 13, 2023

mattmurp Nov 16, 2023 •

edited

Loading

vishalhcl-5960 Nov 16, 2023

		}

		private String createAndExecuteScanUsingV2Api(String type, Map<String, String> params) {

SCA Support (#116) #117

SCA Support (#116) #117

Conversation

vishalhcl-5960 commented Nov 9, 2023

CLAassistant commented Nov 9, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mattmurp Nov 16, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

CLAassistant commented Nov 9, 2023 •

edited

Loading

mattmurp Nov 16, 2023 •

edited

Loading