use of com.checkmarx.flow.dto.BugTracker in project cx-flow by checkmarx-ltd.
the class BitbucketCloudController method pushRequest.
/**
* Receive Push event submitted from Bitbucket
*/
@PostMapping(value = { "/{product}", "/" }, headers = PUSH)
public ResponseEntity<EventResponse> pushRequest(@RequestBody PushEvent body, @PathVariable(value = "product", required = false) String product, ControllerRequest controllerRequest, @RequestParam(value = "token") String token) {
log.debug("Push Request body contents are {}", body.toString());
String uid = helperService.getShortUid();
MDC.put(FlowConstants.MAIN_MDC_ENTRY, uid);
validateBitBucketRequest(token);
controllerRequest = ensureNotNull(controllerRequest);
try {
Repository repository = body.getRepository();
String app = repository.getName();
if (!ScanUtils.empty(controllerRequest.getApplication())) {
app = controllerRequest.getApplication();
}
// set the default bug tracker as per yml
setBugTracker(flowProperties, controllerRequest);
BugTracker.Type bugType = ScanUtils.getBugTypeEnum(controllerRequest.getBug(), flowProperties.getBugTrackerImpl());
if (controllerRequest.getAppOnly() != null) {
flowProperties.setTrackApplicationOnly(controllerRequest.getAppOnly());
}
if (ScanUtils.empty(product)) {
product = ScanRequest.Product.CX.getProduct();
}
ScanRequest.Product p = ScanRequest.Product.valueOf(product.toUpperCase(Locale.ROOT));
List<Change> changeList = body.getPush().getChanges();
String currentBranch = null;
if (changeList != null) {
currentBranch = changeList.get(0).getNew().getName();
}
List<String> branches = getBranches(controllerRequest, flowProperties);
String hash = null;
if (changeList != null) {
hash = changeList.get(0).getNew().getTarget().getHash();
}
BugTracker bt = ScanUtils.getBugTracker(controllerRequest.getAssignee(), bugType, jiraProperties, controllerRequest.getBug());
FilterConfiguration filter = filterFactory.getFilter(controllerRequest, flowProperties);
/*Determine emails*/
List<String> emails = new ArrayList<>();
if (changeList != null) {
for (Change ch : changeList) {
for (Commit c : ch.getCommits()) {
String author = c.getAuthor().getRaw();
if (!ScanUtils.empty(author)) {
emails.add(author);
}
}
}
}
String gitUrl = repository.getLinks().getHtml().getHref().concat(".git");
String configToken = scmConfigOverrider.determineConfigToken(properties, controllerRequest.getScmInstance());
String gitAuthUrl = gitAuthUrlGenerator.addCredToUrl(ScanRequest.Repository.BITBUCKET, gitUrl, configToken);
ScanRequest request = ScanRequest.builder().application(app).product(p).project(controllerRequest.getProject()).team(controllerRequest.getTeam()).namespace(getProjectNamespace(repository)).repoName(repository.getName()).repoUrl(gitUrl).repoUrlWithAuth(gitAuthUrl).repoType(ScanRequest.Repository.BITBUCKET).branch(currentBranch).refs(Constants.CX_BRANCH_PREFIX.concat(currentBranch)).email(emails).scanPreset(controllerRequest.getPreset()).incremental(controllerRequest.getIncremental()).excludeFolders(controllerRequest.getExcludeFolders()).excludeFiles(controllerRequest.getExcludeFiles()).bugTracker(bt).filter(filter).hash(hash).organizationId(getOrganizationid(repository)).gitUrl(gitUrl).build();
setScmInstance(controllerRequest, request);
fillRequestWithAdditionalData(request, repository, body.toString());
checkForConfigAsCode(request);
request.setId(uid);
if (helperService.isBranch2Scan(request, branches)) {
flowService.initiateAutomation(request);
}
} catch (IllegalArgumentException e) {
return getBadRequestMessage(e, controllerRequest, product);
}
return getSuccessMessage();
}
use of com.checkmarx.flow.dto.BugTracker in project cx-flow by checkmarx-ltd.
the class BitbucketCloudController method handleMergeEvent.
public ResponseEntity<EventResponse> handleMergeEvent(MergeEvent body, String product, ControllerRequest controllerRequest, String token) {
log.debug("Merge Request body contents are {}", body.toString());
String uid = helperService.getShortUid();
MDC.put(FlowConstants.MAIN_MDC_ENTRY, uid);
validateBitBucketRequest(token);
log.info("Processing BitBucket MERGE request");
controllerRequest = ensureNotNull(controllerRequest);
try {
Repository repository = body.getRepository();
String app = repository.getName();
if (!ScanUtils.empty(controllerRequest.getApplication())) {
app = controllerRequest.getApplication();
}
BugTracker.Type bugType = BugTracker.Type.BITBUCKETPULL;
if (!ScanUtils.empty(controllerRequest.getBug())) {
bugType = ScanUtils.getBugTypeEnum(controllerRequest.getBug(), flowProperties.getBugTrackerImpl());
}
if (controllerRequest.getAppOnly() != null) {
flowProperties.setTrackApplicationOnly(controllerRequest.getAppOnly());
}
if (ScanUtils.empty(product)) {
product = ScanRequest.Product.CX.getProduct();
}
ScanRequest.Product p = ScanRequest.Product.valueOf(product.toUpperCase(Locale.ROOT));
Pullrequest pullRequest = body.getPullrequest();
String currentBranch = pullRequest.getSource().getBranch().getName();
String targetBranch = pullRequest.getDestination().getBranch().getName();
List<String> branches = getBranches(controllerRequest, flowProperties);
String hash = pullRequest.getSource().getCommit().getHash();
BugTracker bt = ScanUtils.getBugTracker(controllerRequest.getAssignee(), bugType, jiraProperties, controllerRequest.getBug());
FilterConfiguration filter = filterFactory.getFilter(controllerRequest, flowProperties);
String gitUrl = repository.getLinks().getHtml().getHref().concat(".git");
String configToken = scmConfigOverrider.determineConfigToken(properties, controllerRequest.getScmInstance());
String gitAuthUrl = gitAuthUrlGenerator.addCredToUrl(ScanRequest.Repository.BITBUCKET, gitUrl, configToken);
String mergeEndpoint = pullRequest.getLinks().getComments().getHref();
ScanRequest request = ScanRequest.builder().application(app).product(p).project(controllerRequest.getProject()).team(controllerRequest.getTeam()).namespace(getProjectNamespace(repository)).repoName(repository.getName()).repoUrl(gitUrl).repoUrlWithAuth(gitAuthUrl).repoType(ScanRequest.Repository.BITBUCKET).branch(currentBranch).mergeTargetBranch(targetBranch).mergeNoteUri(mergeEndpoint).refs(Constants.CX_BRANCH_PREFIX.concat(currentBranch)).email(null).scanPreset(controllerRequest.getPreset()).incremental(controllerRequest.getIncremental()).excludeFolders(controllerRequest.getExcludeFolders()).excludeFiles(controllerRequest.getExcludeFiles()).bugTracker(bt).filter(filter).hash(hash).organizationId(getOrganizationid(repository)).gitUrl(gitUrl).build();
setScmInstance(controllerRequest, request);
fillRequestWithAdditionalData(request, repository, body.toString());
checkForConfigAsCode(request);
request.setId(uid);
if (helperService.isBranch2Scan(request, branches)) {
flowService.initiateAutomation(request);
}
} catch (IllegalArgumentException e) {
return getBadRequestMessage(e, controllerRequest, product);
}
return getSuccessMessage();
}
use of com.checkmarx.flow.dto.BugTracker in project cx-flow by checkmarx-ltd.
the class GitHubController method pullRequest.
/**
* Pull Request event submitted (JSON)
*/
@PostMapping(value = { "/{product}", "/" }, headers = PULL)
public ResponseEntity<EventResponse> pullRequest(@RequestBody String body, @RequestHeader(value = SIGNATURE) String signature, @PathVariable(value = "product", required = false) String product, ControllerRequest controllerRequest) {
String uid = helperService.getShortUid();
MDC.put(FlowConstants.MAIN_MDC_ENTRY, uid);
log.info("Processing GitHub PULL request");
PullEvent event;
ObjectMapper mapper = new ObjectMapper();
Integer installationId = null;
controllerRequest = ensureNotNull(controllerRequest);
try {
event = mapper.readValue(body, PullEvent.class);
} catch (IOException e) {
throw new MachinaRuntimeException(e);
}
gitHubService.initConfigProviderOnPullEvent(uid, event);
// verify message signature
verifyHmacSignature(body, signature, controllerRequest);
try {
String action = event.getAction();
// synchronize - happens when user pushes code into a branch for which a pull request exists
if (!action.equalsIgnoreCase("opened") && !action.equalsIgnoreCase("reopened") && !action.equalsIgnoreCase("synchronize")) {
log.info("Pull requested not processed. Status was not opened ({})", action);
return ResponseEntity.status(HttpStatus.OK).body(EventResponse.builder().message("No processing occurred for updates to Pull Request").success(true).build());
}
Repository repository = event.getRepository();
String app = repository.getName();
if (!ScanUtils.empty(controllerRequest.getApplication())) {
app = controllerRequest.getApplication();
}
// By default, when a pull request is opened, use the current source control provider as a bug tracker
// (GitHub in this case). Bug tracker from the config is not used, because we only want to notify the user
// that their code has some issues. I.e. we don't want to open real issues in the "official" bug tracker yet.
BugTracker.Type bugType = BugTracker.Type.GITHUBPULL;
// However, if the bug tracker is overridden in the query string, use the override value.
if (!ScanUtils.empty(controllerRequest.getBug())) {
bugType = ScanUtils.getBugTypeEnum(controllerRequest.getBug(), flowProperties.getBugTrackerImpl());
}
if (controllerRequest.getAppOnly() != null) {
flowProperties.setTrackApplicationOnly(controllerRequest.getAppOnly());
}
if (ScanUtils.empty(product)) {
product = ScanRequest.Product.CX.getProduct();
}
ScanRequest.Product p = ScanRequest.Product.valueOf(product.toUpperCase(Locale.ROOT));
PullRequest pullRequest = event.getPullRequest();
String currentBranch = pullRequest.getHead().getRef();
String targetBranch = pullRequest.getBase().getRef();
List<String> branches = getBranches(controllerRequest, flowProperties);
BugTracker bt = ScanUtils.getBugTracker(controllerRequest.getAssignee(), bugType, jiraProperties, controllerRequest.getBug());
FilterConfiguration filter = filterFactory.getFilter(controllerRequest, flowProperties);
Map<FindingSeverity, Integer> thresholdMap = getThresholds(controllerRequest);
// build request object
String gitUrl = Optional.ofNullable(pullRequest.getHead().getRepo()).map(Repo::getCloneUrl).orElse(repository.getCloneUrl());
String token;
String gitAuthUrl;
log.info("Using url: {}", gitUrl);
if (event.getInstallation() != null && event.getInstallation().getId() != null) {
installationId = event.getInstallation().getId();
token = gitHubAppAuthService.getInstallationToken(installationId);
token = FlowConstants.GITHUB_APP_CLONE_USER.concat(":").concat(token);
} else {
token = scmConfigOverrider.determineConfigToken(properties, controllerRequest.getScmInstance());
}
gitAuthUrl = gitAuthUrlGenerator.addCredToUrl(ScanRequest.Repository.GITHUB, gitUrl, token);
ScanRequest request = ScanRequest.builder().application(app).product(p).project(controllerRequest.getProject()).team(controllerRequest.getTeam()).namespace(pullRequest.getHead().getRepo().getOwner().getLogin().replace(" ", "_")).repoName(repository.getName()).repoUrl(repository.getCloneUrl()).repoUrlWithAuth(gitAuthUrl).repoType(ScanRequest.Repository.GITHUB).branch(currentBranch).defaultBranch(repository.getDefaultBranch()).refs(Constants.CX_BRANCH_PREFIX.concat(currentBranch)).mergeNoteUri(pullRequest.getIssueUrl().concat("/comments")).mergeTargetBranch(targetBranch).email(null).scanPreset(controllerRequest.getPreset()).incremental(controllerRequest.getIncremental()).excludeFolders(controllerRequest.getExcludeFolders()).excludeFiles(controllerRequest.getExcludeFiles()).bugTracker(bt).filter(filter).thresholds(thresholdMap).organizationId(getOrganizationid(repository)).gitUrl(gitUrl).hash(pullRequest.getHead().getSha()).build();
setScmInstance(controllerRequest, request);
// Check if an installation Id is provided and store it for later use
if (installationId != null) {
request.putAdditionalMetadata(FlowConstants.GITHUB_APP_INSTALLATION_ID, installationId.toString());
}
/*Check for Config as code (cx.config) and override*/
CxConfig cxConfig = gitHubService.getCxConfigOverride(request);
request = configOverrider.overrideScanRequestProperties(cxConfig, request);
request.putAdditionalMetadata(HTMLHelper.WEB_HOOK_PAYLOAD, body);
request.putAdditionalMetadata("statuses_url", pullRequest.getStatusesUrl());
request.setId(uid);
// only initiate scan/automation if target branch is applicable
if (helperService.isBranch2Scan(request, branches)) {
flowService.initiateAutomation(request);
}
} catch (IllegalArgumentException e) {
return getBadRequestMessage(e, controllerRequest, product);
}
return getSuccessMessage();
}
use of com.checkmarx.flow.dto.BugTracker in project cx-flow by checkmarx-ltd.
the class GitHubController method pushRequest.
/**
* Push Request event submitted (JSON), along with the Product (cx for example)
*/
@PostMapping(value = { "/{product}", "/" }, headers = PUSH)
public ResponseEntity<EventResponse> pushRequest(@RequestBody String body, @RequestHeader(value = SIGNATURE) String signature, @PathVariable(value = "product", required = false) String product, ControllerRequest controllerRequest) {
String uid = helperService.getShortUid();
MDC.put(FlowConstants.MAIN_MDC_ENTRY, uid);
log.info("Processing GitHub PUSH request");
PushEvent event;
Integer installationId = null;
ObjectMapper mapper = new ObjectMapper();
controllerRequest = ensureNotNull(controllerRequest);
try {
event = mapper.readValue(body, PushEvent.class);
} catch (NullPointerException | IOException | IllegalArgumentException e) {
throw new MachinaRuntimeException(e);
}
// Delete event is triggering a push event that needs to be ignored
if (event.getDeleted() != null && event.getDeleted()) {
log.info("Push event is associated with a Delete branch event...ignoring request");
return getSuccessMessage();
}
gitHubService.initConfigProviderOnPushEvent(uid, event);
if (flowProperties == null) {
log.error("Properties have null values");
throw new MachinaRuntimeException();
}
// verify message signature
verifyHmacSignature(body, signature, controllerRequest);
try {
String app = event.getRepository().getName();
if (!ScanUtils.empty(controllerRequest.getApplication())) {
app = controllerRequest.getApplication();
}
// If user has pushed their changes into an important branch (e.g. master) and the code has some issues,
// use the bug tracker from the config. As a result, "real" issues will be opened in the bug tracker and
// not just notifications for the user. The "push" case also includes merging a pull request.
// See the comment for the pullRequest method for further details.
// However, if the bug tracker is overridden in the query string, use the override value.
setBugTracker(flowProperties, controllerRequest);
BugTracker.Type bugType = ScanUtils.getBugTypeEnum(controllerRequest.getBug(), flowProperties.getBugTrackerImpl());
if (controllerRequest.getAppOnly() != null) {
flowProperties.setTrackApplicationOnly(controllerRequest.getAppOnly());
}
if (ScanUtils.empty(product)) {
product = ScanRequest.Product.CX.getProduct();
}
ScanRequest.Product p = ScanRequest.Product.valueOf(product.toUpperCase(Locale.ROOT));
// determine branch (without refs)
String currentBranch = ScanUtils.getBranchFromRef(event.getRef());
List<String> branches = getBranches(controllerRequest, flowProperties);
BugTracker bt = ScanUtils.getBugTracker(controllerRequest.getAssignee(), bugType, jiraProperties, controllerRequest.getBug());
FilterConfiguration filter = filterFactory.getFilter(controllerRequest, flowProperties);
Map<FindingSeverity, Integer> thresholdMap = getThresholds(controllerRequest);
// build request object
Repository repository = event.getRepository();
String gitUrl = repository.getCloneUrl();
String token;
String gitAuthUrl;
log.info("Using url: {}", gitUrl);
if (event.getInstallation() != null && event.getInstallation().getId() != null) {
installationId = event.getInstallation().getId();
token = gitHubAppAuthService.getInstallationToken(installationId);
token = FlowConstants.GITHUB_APP_CLONE_USER.concat(":").concat(token);
} else {
token = scmConfigOverrider.determineConfigToken(properties, controllerRequest.getScmInstance());
if (ScanUtils.empty(token)) {
log.error("No token was provided for Github");
throw new MachinaRuntimeException();
}
}
gitAuthUrl = gitAuthUrlGenerator.addCredToUrl(ScanRequest.Repository.GITHUB, gitUrl, token);
ScanRequest request = ScanRequest.builder().application(app).product(p).project(controllerRequest.getProject()).team(controllerRequest.getTeam()).namespace(repository.getOwner().getName().replace(" ", "_")).repoName(repository.getName()).repoUrl(repository.getCloneUrl()).repoUrlWithAuth(gitAuthUrl).repoType(ScanRequest.Repository.GITHUB).branch(currentBranch).defaultBranch(repository.getDefaultBranch()).refs(event.getRef()).email(determineEmails(event)).scanPreset(controllerRequest.getPreset()).incremental(controllerRequest.getIncremental()).excludeFolders(controllerRequest.getExcludeFolders()).excludeFiles(controllerRequest.getExcludeFiles()).bugTracker(bt).filter(filter).thresholds(thresholdMap).organizationId(getOrganizationid(repository)).gitUrl(gitUrl).hash(event.getAfter()).build();
setScmInstance(controllerRequest, request);
// Check if an installation Id is provided and store it for later use
if (installationId != null) {
request.putAdditionalMetadata(FlowConstants.GITHUB_APP_INSTALLATION_ID, installationId.toString());
}
/*Check for Config as code (cx.config) and override*/
CxConfig cxConfig = gitHubService.getCxConfigOverride(request);
request = configOverrider.overrideScanRequestProperties(cxConfig, request);
request.putAdditionalMetadata(HTMLHelper.WEB_HOOK_PAYLOAD, body);
request.setId(uid);
// only initiate scan/automation if branch is applicable
if (helperService.isBranch2Scan(request, branches)) {
flowService.initiateAutomation(request);
}
} catch (IllegalArgumentException e) {
return getBadRequestMessage(e, controllerRequest, product);
}
return getSuccessMessage();
}
use of com.checkmarx.flow.dto.BugTracker in project cx-flow by checkmarx-ltd.
the class PostRequestData method initiateScan.
@PostMapping("/scan")
public ResponseEntity<EventResponse> initiateScan(@RequestBody CxScanRequest scanRequest, @RequestHeader(value = TOKEN_HEADER) String token) {
String uid = helperService.getShortUid();
String errorMessage = "Error submitting Scan Request.";
MDC.put(FlowConstants.MAIN_MDC_ENTRY, uid);
log.info("Processing Scan initiation request");
validateToken(token);
try {
log.trace(scanRequest.toString());
ScanRequest.Product product = ScanRequest.Product.CX;
String project = scanRequest.getProject();
String branch = scanRequest.getBranch();
String application = scanRequest.getApplication();
String team = scanRequest.getTeam();
if (ScanUtils.empty(application)) {
application = project;
}
if (ScanUtils.empty(team)) {
team = cxScannerService.getProperties().getTeam();
}
properties.setTrackApplicationOnly(scanRequest.isApplicationOnly());
if (ScanUtils.anyEmpty(project, branch, scanRequest.getGitUrl())) {
log.error("{} The project | branch | git_url was not provided", errorMessage);
ResponseEntity.status(HttpStatus.BAD_REQUEST).body(null);
return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(EventResponse.builder().message(errorMessage).success(false).build());
}
String scanPreset = cxScannerService.getProperties().getScanPreset();
if (!ScanUtils.empty(scanRequest.getPreset())) {
scanPreset = scanRequest.getPreset();
}
boolean inc = cxScannerService.getProperties().getIncremental();
if (scanRequest.isIncremental()) {
inc = true;
}
BugTracker.Type bugType;
if (!ScanUtils.empty(scanRequest.getBug())) {
bugType = ScanUtils.getBugTypeEnum(scanRequest.getBug(), properties.getBugTrackerImpl());
} else {
bugType = ScanUtils.getBugTypeEnum(properties.getBugTracker(), properties.getBugTrackerImpl());
}
if (!ScanUtils.empty(scanRequest.getProduct())) {
product = ScanRequest.Product.valueOf(scanRequest.getProduct().toUpperCase(Locale.ROOT));
}
FilterConfiguration filter = determineFilter(scanRequest);
String bug = properties.getBugTracker();
if (!ScanUtils.empty(scanRequest.getBug())) {
bug = scanRequest.getBug();
}
BugTracker bt = ScanUtils.getBugTracker(scanRequest.getAssignee(), bugType, jiraProperties, bug);
List<String> excludeFiles = scanRequest.getExcludeFiles();
List<String> excludeFolders = scanRequest.getExcludeFolders();
if ((excludeFiles == null) && !ScanUtils.empty(cxScannerService.getProperties().getExcludeFiles())) {
excludeFiles = Arrays.asList(cxScannerService.getProperties().getExcludeFiles().split(","));
}
if (excludeFolders == null && !ScanUtils.empty(cxScannerService.getProperties().getExcludeFolders())) {
excludeFolders = Arrays.asList(cxScannerService.getProperties().getExcludeFolders().split(","));
}
ScanRequest request = ScanRequest.builder().application(application).product(product).project(project).team(team).namespace(scanRequest.getNamespace()).repoName(scanRequest.getRepoName()).repoUrl(scanRequest.getGitUrl()).repoUrlWithAuth(scanRequest.getGitUrl()).repoType(ScanRequest.Repository.NA).branch(branch).refs(Constants.CX_BRANCH_PREFIX.concat(branch)).email(null).incremental(inc).scanPreset(scanPreset).excludeFolders(excludeFolders).excludeFiles(excludeFiles).bugTracker(bt).filter(filter).build();
request.setId(uid);
request.putAdditionalMetadata(HTMLHelper.WEB_HOOK_PAYLOAD, scanRequest.toString());
if (!ScanUtils.empty(scanRequest.getResultUrl())) {
request.putAdditionalMetadata("result_url", scanRequest.getResultUrl());
}
scanService.initiateAutomation(request);
} catch (Exception e) {
log.error("Error submitting Scan Request. {}", ExceptionUtils.getMessage(e), e);
ResponseEntity.status(HttpStatus.BAD_REQUEST).body(null);
return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(EventResponse.builder().message(errorMessage).success(false).build());
}
return ResponseEntity.status(HttpStatus.OK).body(EventResponse.builder().message("Scan Request Successfully Submitted").success(true).build());
}
Aggregations