Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ASA 8404 (#218) #220

Merged
merged 24 commits into from
Jul 30, 2024
Merged

ASA 8404 (#218) #220

Show file tree
Hide file tree
Changes from 13 commits
Commits
Show all changes
24 commits
Select commit Hold shift + click to select a range
5a957ff
ASA 8404 (#218)
vishalhcl-5960 Jun 25, 2024
a610cb5
Merge branch 'master' into ASA-8404
vishalhcl-5960 Jun 25, 2024
300cac0
Merge branch 'master' into ASA-8404
vishalhcl-5960 Jun 27, 2024
c60f1c4
modified the checker method
vishalhcl-5960 Jun 27, 2024
408cf84
Update AppScanBuildStep.java
vishalhcl-5960 Jun 27, 2024
0bf9eac
suggested changes
vishalhcl-5960 Jun 28, 2024
c5883be
Update AppScanBuildStep.java
vishalhcl-5960 Jun 28, 2024
a61f127
suggested changes
vishalhcl-5960 Jul 5, 2024
96e802a
Update AppScanBuildStep.java
vishalhcl-5960 Jul 5, 2024
41ad20c
handled the SCO & OSO upgradation use-cases
vishalhcl-5960 Jul 5, 2024
bd2616b
include SCA
vishalhcl-5960 Jul 8, 2024
236f7f2
bug fixes
vishalhcl-5960 Jul 10, 2024
dc400a0
indentation changes
vishalhcl-5960 Jul 10, 2024
a2d52b1
suggested changes
vishalhcl-5960 Jul 15, 2024
b1bcb55
migrated the changes for the include SCA to SDK
vishalhcl-5960 Jul 18, 2024
10fa048
removed the unwanted void spaces
vishalhcl-5960 Jul 19, 2024
57ce2b8
required changes
vishalhcl-5960 Jul 22, 2024
14859aa
copyright years update
vishalhcl-5960 Jul 22, 2024
bb5900b
suggested changes
vishalhcl-5960 Jul 24, 2024
2a17e9f
ASA-8724
vishalhcl-5960 Jul 26, 2024
1d9332f
Addessing PR comments
vishalhcl-5960 Jul 29, 2024
ed7fc17
Update StaticAnalyzer.java
vishalhcl-5960 Jul 29, 2024
8d33f1d
Update pom.xml
vishalhcl-5960 Jul 29, 2024
db9021c
Delete .idea/libraries/Maven__com_hcl_appscan_sdk_1_1_3_SNAPSHOT.xml
vishalhcl-5960 Jul 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
257 changes: 156 additions & 101 deletions src/main/java/com/hcl/appscan/jenkins/plugin/builders/AppScanBuildStep.java
View file
Open in desktop

Large diffs are not rendered by default.

80 changes: 80 additions & 0 deletions src/main/java/com/hcl/appscan/jenkins/plugin/results/CombinedResultsInspector.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,80 @@
package com.hcl.appscan.jenkins.plugin.results;

import com.hcl.appscan.jenkins.plugin.scanners.Scanner;
import com.hcl.appscan.sdk.CoreConstants;
import com.hcl.appscan.sdk.results.IResultsProvider;

import java.util.List;
import java.util.Map;

public class CombinedResultsInspector {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The results inspector should not require knowledge of the scan type or issue types (there are mentions of totalCountSAST for example).

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removed the CombinedResultsInspector class as we are now handling the results in the SDK.


private List<FailureCondition> m_conditions;
private IResultsProvider m_resultsProvider;

public CombinedResultsInspector(List<FailureCondition> conditions, IResultsProvider resultsProvider) {
m_conditions = conditions;
m_resultsProvider = resultsProvider;
}

public boolean shouldFail(Map<String,String> properties) {
for(FailureCondition condition : m_conditions) {
String type = condition.getFailureType();
int threshold = condition.getThreshold();
if(exceedsThresholdCombined(type, threshold, properties))
return true;
}
return false;
}

private void issuesCountSAST(Map<String,String> properties) {
properties.put("totalCountSAST", String.valueOf(m_resultsProvider.getFindingsCount()));
properties.put("criticalCountSAST", String.valueOf(m_resultsProvider.getCriticalCount()));
properties.put("highCountSAST", String.valueOf(m_resultsProvider.getHighCount()));
properties.put("mediumCountSAST", String.valueOf(m_resultsProvider.getMediumCount()));
properties.put("lowCountSAST", String.valueOf(m_resultsProvider.getLowCount()));
}

private boolean exceedsThresholdCombined(String type, int threshold, Map<String,String> properties) {
String scanType = properties.get(CoreConstants.SCANNER_TYPE);
if (scanType.equals(Scanner.STATIC_ANALYZER)) {
issuesCountSAST(properties);
} else {
switch(type.toLowerCase()) {
case "total": //$NON-NLS-1$
if(properties.containsKey("totalCountSAST")) {
int totalCountSAST = Integer.parseInt(properties.remove("totalCountSAST"));
return (totalCountSAST+m_resultsProvider.getFindingsCount()) > threshold;
}
return m_resultsProvider.getFindingsCount() > threshold;
case "critical": //$NON-NLS-1$
if(properties.containsKey("criticalCountSAST")) {
int criticalCountSAST = Integer.parseInt(properties.remove("criticalCountSAST"));
return (criticalCountSAST+m_resultsProvider.getCriticalCount()) > threshold;
}
return m_resultsProvider.getCriticalCount() > threshold;
case "high": //$NON-NLS-1$
if(properties.containsKey("highCountSAST")) {
int highCountSAST = Integer.parseInt(properties.remove("highCountSAST"));
return (highCountSAST+m_resultsProvider.getHighCount()) > threshold;
}
return m_resultsProvider.getHighCount() > threshold;
case "medium": //$NON-NLS-1$
if(properties.containsKey("mediumCountSAST")) {
int mediumCountSAST = Integer.parseInt(properties.remove("mediumCountSAST"));
return (mediumCountSAST+m_resultsProvider.getMediumCount()) > threshold;
}
return m_resultsProvider.getMediumCount() > threshold;
case "low": //$NON-NLS-1$
if(properties.containsKey("lowCountSAST")) {
int lowCountSAST = Integer.parseInt(properties.remove("lowCountSAST"));
return (lowCountSAST+m_resultsProvider.getLowCount()) > threshold;
}
return m_resultsProvider.getLowCount() > threshold;
default:
return false;
}
}
return false;
}
}
5 changes: 2 additions & 3 deletions src/main/java/com/hcl/appscan/jenkins/plugin/results/ResultsInspector.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,14 +10,13 @@

import com.hcl.appscan.sdk.results.IResultsProvider;

public class ResultsInspector {
public class ResultsInspector extends CombinedResultsInspector {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why does the ResultsInspector extend the CombinedResultsInseptor? It seems this should be the other way around, where the CombinedResultsInspector adds to the logic of the ResultsInspector.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removed the CombinedResultsInspector class as we are now handling the results in the SDK.


private List<FailureCondition> m_conditions;
private IResultsProvider m_resultsProvider;

public ResultsInspector(List<FailureCondition> conditions, IResultsProvider resultsProvider) {
m_conditions = conditions;
m_resultsProvider = resultsProvider;
super(conditions, resultsProvider);
}


Expand Down
20 changes: 16 additions & 4 deletions src/main/java/com/hcl/appscan/jenkins/plugin/scanners/DynamicAnalyzer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,8 @@

import com.hcl.appscan.jenkins.plugin.auth.ASoCCredentials;
import com.hcl.appscan.jenkins.plugin.builders.AppScanBuildStep;
import com.hcl.appscan.sdk.CoreConstants;
import com.hcl.appscan.sdk.logging.IProgress;
import org.jenkinsci.Symbol;
import org.kohsuke.stapler.AncestorInPath;
import org.kohsuke.stapler.DataBoundConstructor;
Expand Down Expand Up @@ -196,8 +198,18 @@ public String upgradeLoginScenario(){
}
}

public void validations(IAuthenticationProvider authProvider, Map<String, String> properties, IProgress progress) throws AbortException {
if (((JenkinsAuthenticationProvider) authProvider).isAppScan360()) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The 2 "if" conditions should be "anded" together rather than nesting them.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

okay, sure.

if (properties.containsKey(Scanner.PRESENCE_ID)) {
throw new AbortException(Messages.error_presence_AppScan360());
}
} else if (!properties.containsKey(Scanner.PRESENCE_ID) && !ServiceUtil.isValidUrl(properties.get(TARGET), authProvider, authProvider.getProxy())) {
throw new AbortException(Messages.error_url_validation(properties.get(TARGET)));
}
}

@Override
public Map<String, String> getProperties(VariableResolver<String> resolver) throws hudson.AbortException {
public Map<String, String> getProperties(VariableResolver<String> resolver) throws AbortException {
Map<String, String> properties = new HashMap<String, String>();
if (resolver == null) {
properties.put(TARGET, getTarget());
Expand Down Expand Up @@ -327,9 +339,9 @@ public FormValidation doCheckScanFile(@QueryParameter String scanFile) {

public FormValidation doCheckTarget(@QueryParameter String target,@RelativePath("..") @QueryParameter String credentials, @AncestorInPath ItemGroup<?> context, @QueryParameter String presenceId) {
JenkinsAuthenticationProvider authProvider = new JenkinsAuthenticationProvider(credentials,context);
if(presenceId != null && presenceId.equals(EMPTY) && !target.equals(EMPTY) && !ServiceUtil.isValidUrl(target, authProvider, authProvider.getProxy())) {
return FormValidation.error(Messages.error_url_validation_ui());
}
if(!authProvider.isAppScan360() && presenceId != null && presenceId.equals(EMPTY) && !target.equals(EMPTY) && !ServiceUtil.isValidUrl(target, authProvider, authProvider.getProxy())) {
return FormValidation.error(Messages.error_url_validation_ui());
}
return FormValidation.validateRequired(target);
}

Expand Down
6 changes: 5 additions & 1 deletion src/main/java/com/hcl/appscan/jenkins/plugin/scanners/Scanner.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,8 @@

package com.hcl.appscan.jenkins.plugin.scanners;

import com.hcl.appscan.sdk.auth.IAuthenticationProvider;
import com.hcl.appscan.sdk.logging.IProgress;
import hudson.AbortException;
import hudson.Util;
import hudson.model.AbstractDescribableImpl;
Expand Down Expand Up @@ -38,7 +40,9 @@ public String getTarget() {
}

public abstract Map<String, String> getProperties(VariableResolver<String> resolver) throws AbortException;


public abstract void validations(IAuthenticationProvider authProvider, Map<String, String> properties, IProgress progress) throws AbortException;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The function name should be a verb, like "validate" or "validateSettings".

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay, Now, Using the "validateSettings()" method name.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In all instances, the IAuthenticationProvider is being passed in and then cast to a JenkinsAuthenticationProvider just to check if this is AppScan 360. Why not just pass a boolean here instead?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In DynamicAnalyzer class we are doing the URL validity check & for that we need to call the getProxy() method from authProvider class. Instead of passing the IAuthenticationProvider, I will pass the JenkinsAuthenaticationProvider itself.


public abstract String getType();

protected String resolvePath(String path, VariableResolver<String> resolver) {
Expand Down
11 changes: 10 additions & 1 deletion src/main/java/com/hcl/appscan/jenkins/plugin/scanners/SoftwareCompositionAnalyzer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,9 @@

import com.hcl.appscan.jenkins.plugin.Messages;
import com.hcl.appscan.jenkins.plugin.auth.JenkinsAuthenticationProvider;
import com.hcl.appscan.sdk.auth.IAuthenticationProvider;
import com.hcl.appscan.sdk.logging.IProgress;
import hudson.AbortException;
import hudson.Extension;
import hudson.RelativePath;
import hudson.model.ItemGroup;
Expand Down Expand Up @@ -37,7 +40,13 @@ public String getType() {
return SOFTWARE_COMPOSITION_ANALYZER;
}

public Map<String, String> getProperties(VariableResolver<String> resolver) {
public void validations(IAuthenticationProvider authProvider, Map<String, String> properties, IProgress progress) throws AbortException {
if (((JenkinsAuthenticationProvider) authProvider).isAppScan360()) {
throw new AbortException(Messages.error_sca_AppScan360());
}
}

public Map<String, String> getProperties(VariableResolver<String> resolver) throws AbortException {
Map<String, String> properties = new HashMap<String, String>();
properties.put(TARGET, resolver == null ? getTarget() : resolvePath(getTarget(), resolver));
return properties;
Expand Down
Loading
Loading