Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ASA-9110 #228

Merged
merged 9 commits into from
Sep 24, 2024
Merged

ASA-9110 #228

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
d07a1b8
Active subscription check
vishalhcl-5960 Sep 3, 2024
3841885
subscription check
vishalhcl-5960 Sep 4, 2024
c898198
indentation check
vishalhcl-5960 Sep 4, 2024
90065d3
checks
vishalhcl-5960 Sep 4, 2024
15c6663
updated the validation statements
vishalhcl-5960 Sep 7, 2024
cada51e
Removed the unused arguments
vishalhcl-5960 Sep 11, 2024
b87a7d4
Update Messages.properties
vishalhcl-5960 Sep 12, 2024
91f44f9
As per PR comment
vishalhcl-5960 Sep 12, 2024
255d0bd
Update StaticAnalyzer.java
vishalhcl-5960 Sep 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions src/main/java/com/hcl/appscan/jenkins/plugin/scanners/DynamicAnalyzer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -198,6 +198,9 @@ public String upgradeLoginScenario(){
}

public void validateSettings(JenkinsAuthenticationProvider authProvider, Map<String, String> properties, IProgress progress) throws AbortException {
if(!ServiceUtil.hasDastEntitlement(authProvider)) {
throw new AbortException(Messages.error_dast_subscription_validation());
}
if (authProvider.isAppScan360() && properties.containsKey(Scanner.PRESENCE_ID)) {
throw new AbortException(Messages.error_presence_AppScan360());
}
Expand Down Expand Up @@ -337,6 +340,9 @@ public FormValidation doCheckScanFile(@QueryParameter String scanFile) {

public FormValidation doCheckTarget(@QueryParameter String target,@RelativePath("..") @QueryParameter String credentials, @AncestorInPath ItemGroup<?> context, @QueryParameter String presenceId) {
JenkinsAuthenticationProvider authProvider = new JenkinsAuthenticationProvider(credentials,context);
if(!ServiceUtil.hasDastEntitlement(authProvider)) {
return FormValidation.error(Messages.error_dast_subscription_validation());
}
if(!authProvider.isAppScan360() && presenceId != null && presenceId.equals(EMPTY) && !target.equals(EMPTY) && !ServiceUtil.isValidUrl(target, authProvider, authProvider.getProxy())) {
return FormValidation.error(Messages.error_url_validation_ui());
}
Expand Down
8 changes: 8 additions & 0 deletions src/main/java/com/hcl/appscan/jenkins/plugin/scanners/SoftwareCompositionAnalyzer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
import com.hcl.appscan.jenkins.plugin.Messages;
import com.hcl.appscan.jenkins.plugin.auth.JenkinsAuthenticationProvider;
import com.hcl.appscan.sdk.logging.IProgress;
import com.hcl.appscan.sdk.utils.ServiceUtil;
import hudson.AbortException;
import hudson.Extension;
import hudson.RelativePath;
Expand Down Expand Up @@ -40,6 +41,10 @@ public String getType() {
}

public void validateSettings(JenkinsAuthenticationProvider authProvider, Map<String, String> properties, IProgress progress) throws AbortException {
if(!ServiceUtil.hasScaEntitlement(authProvider)) {
throw new AbortException(Messages.error_sca_subscription_validation());
}

if (authProvider.isAppScan360()) {
throw new AbortException(Messages.error_sca_AppScan360());
}
Expand All @@ -62,6 +67,9 @@ public String getDisplayName() {

public FormValidation doCheckTarget(@QueryParameter String target, @RelativePath("..") @QueryParameter String credentials, @AncestorInPath ItemGroup<?> context) {
JenkinsAuthenticationProvider authProvider = new JenkinsAuthenticationProvider(credentials,context);
if(!ServiceUtil.hasScaEntitlement(authProvider)) {
return FormValidation.error(Messages.error_sca_subscription_validation());
}
if(authProvider.isAppScan360()){
return FormValidation.error(Messages.error_sca_AppScan360_ui());
}
Expand Down
17 changes: 15 additions & 2 deletions src/main/java/com/hcl/appscan/jenkins/plugin/scanners/StaticAnalyzer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -184,6 +184,10 @@
}

public void validateSettings(JenkinsAuthenticationProvider authProvider, Map<String, String> properties, IProgress progress) throws AbortException {
if(!ServiceUtil.hasSastEntitlement(authProvider)) {
throw new AbortException(Messages.error_sast_subscription_validation());
}

if (authProvider.isAppScan360()) {
if (properties.containsKey(CoreConstants.OPEN_SOURCE_ONLY)) {
throw new AbortException(Messages.error_sca_AppScan360());
Expand All @@ -192,7 +196,9 @@
progress.setStatus(new Message(Message.WARNING, Messages.warning_include_sca_AppScan360()));
properties.remove(CoreConstants.INCLUDE_SCA);
}
} else if(properties.containsKey(CoreConstants.INCLUDE_SCA) && !ServiceUtil.hasScaEntitlement(authProvider)) {
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a reason this was made an "if" as opposed to the previous "else if"? I think we want it to be "else if" because with this change, an AppScan 360 user will get 2 warning about SCA.

Copy link
Collaborator Author

@vishalhcl-5960 vishalhcl-5960 Sep 12, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, got the scenario, reverting the changes.


if(properties.containsKey(CoreConstants.INCLUDE_SCA) && !ServiceUtil.hasScaEntitlement(authProvider)) {
progress.setStatus(new Message(Message.WARNING, Messages.warning_sca_subscription()));
properties.remove(CoreConstants.INCLUDE_SCA);
}
Expand All @@ -201,7 +207,6 @@
if (properties.containsKey(CoreConstants.INCLUDE_SCA) && properties.containsKey(CoreConstants.UPLOAD_DIRECT) && !properties.get(TARGET).endsWith(".irx")) {
throw new AbortException(Messages.error_invalid_format_include_sca());
}

}

public Map<String,String> getProperties(VariableResolver<String> resolver) {
Expand Down Expand Up @@ -249,5 +254,13 @@
}
return FormValidation.ok();
}

public FormValidation doCheckTarget(@RelativePath("..") @QueryParameter String credentials, @AncestorInPath ItemGroup<?> context, @QueryParameter String presenceId) {

Check warning

Code scanning / Jenkins Security Scan

Stapler: Missing permission check Warning

Potential missing permission check in DescriptorImpl#doCheckTarget

Check warning

Code scanning / Jenkins Security Scan

Stapler: Missing POST/RequirePOST annotation Warning

Potential CSRF vulnerability: If DescriptorImpl#doCheckTarget connects to user-specified URLs, modifies state, or is expensive to run, it should be annotated with @POST or @RequirePOST
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why you need Presence in the check ?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removed the unused arguments.

JenkinsAuthenticationProvider authProvider = new JenkinsAuthenticationProvider(credentials,context);
if(!ServiceUtil.hasSastEntitlement(authProvider)) {
return FormValidation.error(Messages.error_sast_subscription_validation());
}
return FormValidation.ok();
}
}
}
3 changes: 3 additions & 0 deletions src/main/resources/com/hcl/appscan/jenkins/plugin/Messages.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,9 @@ warning.asoc.certificates = Allowing Untrusted Connections is not applied to thi
error.application.empty.ui = Application list is empty. Please check the credentials for service connection.
error.url.validation.ui = Unless this is a private network, please verify your domain.
error.url.validation = An error occurred while validating the Starting URL: {0}.
error.dast.subscription.validation= You don't have a valid DAST subscription.
error.sast.subscription.validation= You don't have a valid SAST subscription.
error.sca.subscription.validation= You don't have a valid SCA subscription.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suggest combining these 3 strings into a single string that takes an input. For example:
error.subscription.invalid=You don't have a valid {0} subscription.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, I will use only 2 statements, one for the backend validation message & other for the UI.

error.sca.AppScan360.ui= Software Composition Analysis is available in AppScan on Cloud only.
warning.sca.ui= To scan open-source files, use the Software Composition Analysis (SCA) scan type.
warning.sca= AppScan on Cloud (ASoC) now performs SAST and SCA analysis as separate scans. To execute an open-source only scan, use the Software Composition Analysis (SCA) scan type.
Expand Down
Loading