Examples with FilterConfiguration com.checkmarx.sdk.dto.filtering.FilterConfiguration used on opensource projects

Example 6 with FilterConfiguration

use of com.checkmarx.sdk.dto.filtering.FilterConfiguration in project cx-flow by checkmarx-ltd.

the class GitHubController method pullRequest.

/**
 * Pull Request event submitted (JSON)
 */
@PostMapping(value = { "/{product}", "/" }, headers = PULL)
public ResponseEntity<EventResponse> pullRequest(@RequestBody String body, @RequestHeader(value = SIGNATURE) String signature, @PathVariable(value = "product", required = false) String product, ControllerRequest controllerRequest) {
    String uid = helperService.getShortUid();
    MDC.put(FlowConstants.MAIN_MDC_ENTRY, uid);
    log.info("Processing GitHub PULL request");
    PullEvent event;
    ObjectMapper mapper = new ObjectMapper();
    Integer installationId = null;
    controllerRequest = ensureNotNull(controllerRequest);
    try {
        event = mapper.readValue(body, PullEvent.class);
    } catch (IOException e) {
        throw new MachinaRuntimeException(e);
    }
    gitHubService.initConfigProviderOnPullEvent(uid, event);
    // verify message signature
    verifyHmacSignature(body, signature, controllerRequest);
    try {
        String action = event.getAction();
        // synchronize - happens when user pushes code into a branch for which a pull request exists
        if (!action.equalsIgnoreCase("opened") && !action.equalsIgnoreCase("reopened") && !action.equalsIgnoreCase("synchronize")) {
            log.info("Pull requested not processed.  Status was not opened ({})", action);
            return ResponseEntity.status(HttpStatus.OK).body(EventResponse.builder().message("No processing occurred for updates to Pull Request").success(true).build());
        }
        Repository repository = event.getRepository();
        String app = repository.getName();
        if (!ScanUtils.empty(controllerRequest.getApplication())) {
            app = controllerRequest.getApplication();
        }
        // By default, when a pull request is opened, use the current source control provider as a bug tracker
        // (GitHub in this case). Bug tracker from the config is not used, because we only want to notify the user
        // that their code has some issues. I.e. we don't want to open real issues in the "official" bug tracker yet.
        BugTracker.Type bugType = BugTracker.Type.GITHUBPULL;
        // However, if the bug tracker is overridden in the query string, use the override value.
        if (!ScanUtils.empty(controllerRequest.getBug())) {
            bugType = ScanUtils.getBugTypeEnum(controllerRequest.getBug(), flowProperties.getBugTrackerImpl());
        }
        if (controllerRequest.getAppOnly() != null) {
            flowProperties.setTrackApplicationOnly(controllerRequest.getAppOnly());
        }
        if (ScanUtils.empty(product)) {
            product = ScanRequest.Product.CX.getProduct();
        }
        ScanRequest.Product p = ScanRequest.Product.valueOf(product.toUpperCase(Locale.ROOT));
        PullRequest pullRequest = event.getPullRequest();
        String currentBranch = pullRequest.getHead().getRef();
        String targetBranch = pullRequest.getBase().getRef();
        List<String> branches = getBranches(controllerRequest, flowProperties);
        BugTracker bt = ScanUtils.getBugTracker(controllerRequest.getAssignee(), bugType, jiraProperties, controllerRequest.getBug());
        FilterConfiguration filter = filterFactory.getFilter(controllerRequest, flowProperties);
        Map<FindingSeverity, Integer> thresholdMap = getThresholds(controllerRequest);
        // build request object
        String gitUrl = Optional.ofNullable(pullRequest.getHead().getRepo()).map(Repo::getCloneUrl).orElse(repository.getCloneUrl());
        String token;
        String gitAuthUrl;
        log.info("Using url: {}", gitUrl);
        if (event.getInstallation() != null && event.getInstallation().getId() != null) {
            installationId = event.getInstallation().getId();
            token = gitHubAppAuthService.getInstallationToken(installationId);
            token = FlowConstants.GITHUB_APP_CLONE_USER.concat(":").concat(token);
        } else {
            token = scmConfigOverrider.determineConfigToken(properties, controllerRequest.getScmInstance());
        }
        gitAuthUrl = gitAuthUrlGenerator.addCredToUrl(ScanRequest.Repository.GITHUB, gitUrl, token);
        ScanRequest request = ScanRequest.builder().application(app).product(p).project(controllerRequest.getProject()).team(controllerRequest.getTeam()).namespace(pullRequest.getHead().getRepo().getOwner().getLogin().replace(" ", "_")).repoName(repository.getName()).repoUrl(repository.getCloneUrl()).repoUrlWithAuth(gitAuthUrl).repoType(ScanRequest.Repository.GITHUB).branch(currentBranch).defaultBranch(repository.getDefaultBranch()).refs(Constants.CX_BRANCH_PREFIX.concat(currentBranch)).mergeNoteUri(pullRequest.getIssueUrl().concat("/comments")).mergeTargetBranch(targetBranch).email(null).scanPreset(controllerRequest.getPreset()).incremental(controllerRequest.getIncremental()).excludeFolders(controllerRequest.getExcludeFolders()).excludeFiles(controllerRequest.getExcludeFiles()).bugTracker(bt).filter(filter).thresholds(thresholdMap).organizationId(getOrganizationid(repository)).gitUrl(gitUrl).hash(pullRequest.getHead().getSha()).build();
        setScmInstance(controllerRequest, request);
        // Check if an installation Id is provided and store it for later use
        if (installationId != null) {
            request.putAdditionalMetadata(FlowConstants.GITHUB_APP_INSTALLATION_ID, installationId.toString());
        }
        /*Check for Config as code (cx.config) and override*/
        CxConfig cxConfig = gitHubService.getCxConfigOverride(request);
        request = configOverrider.overrideScanRequestProperties(cxConfig, request);
        request.putAdditionalMetadata(HTMLHelper.WEB_HOOK_PAYLOAD, body);
        request.putAdditionalMetadata("statuses_url", pullRequest.getStatusesUrl());
        request.setId(uid);
        // only initiate scan/automation if target branch is applicable
        if (helperService.isBranch2Scan(request, branches)) {
            flowService.initiateAutomation(request);
        }
    } catch (IllegalArgumentException e) {
        return getBadRequestMessage(e, controllerRequest, product);
    }
    return getSuccessMessage();
}

Example 7 with FilterConfiguration

use of com.checkmarx.sdk.dto.filtering.FilterConfiguration in project cx-flow by checkmarx-ltd.

the class GitHubController method pushRequest.

/**
 * Push Request event submitted (JSON), along with the Product (cx for example)
 */
@PostMapping(value = { "/{product}", "/" }, headers = PUSH)
public ResponseEntity<EventResponse> pushRequest(@RequestBody String body, @RequestHeader(value = SIGNATURE) String signature, @PathVariable(value = "product", required = false) String product, ControllerRequest controllerRequest) {
    String uid = helperService.getShortUid();
    MDC.put(FlowConstants.MAIN_MDC_ENTRY, uid);
    log.info("Processing GitHub PUSH request");
    PushEvent event;
    Integer installationId = null;
    ObjectMapper mapper = new ObjectMapper();
    controllerRequest = ensureNotNull(controllerRequest);
    try {
        event = mapper.readValue(body, PushEvent.class);
    } catch (NullPointerException | IOException | IllegalArgumentException e) {
        throw new MachinaRuntimeException(e);
    }
    // Delete event is triggering a push event that needs to be ignored
    if (event.getDeleted() != null && event.getDeleted()) {
        log.info("Push event is associated with a Delete branch event...ignoring request");
        return getSuccessMessage();
    }
    gitHubService.initConfigProviderOnPushEvent(uid, event);
    if (flowProperties == null) {
        log.error("Properties have null values");
        throw new MachinaRuntimeException();
    }
    // verify message signature
    verifyHmacSignature(body, signature, controllerRequest);
    try {
        String app = event.getRepository().getName();
        if (!ScanUtils.empty(controllerRequest.getApplication())) {
            app = controllerRequest.getApplication();
        }
        // If user has pushed their changes into an important branch (e.g. master) and the code has some issues,
        // use the bug tracker from the config. As a result, "real" issues will be opened in the bug tracker and
        // not just notifications for the user. The "push" case also includes merging a pull request.
        // See the comment for the pullRequest method for further details.
        // However, if the bug tracker is overridden in the query string, use the override value.
        setBugTracker(flowProperties, controllerRequest);
        BugTracker.Type bugType = ScanUtils.getBugTypeEnum(controllerRequest.getBug(), flowProperties.getBugTrackerImpl());
        if (controllerRequest.getAppOnly() != null) {
            flowProperties.setTrackApplicationOnly(controllerRequest.getAppOnly());
        }
        if (ScanUtils.empty(product)) {
            product = ScanRequest.Product.CX.getProduct();
        }
        ScanRequest.Product p = ScanRequest.Product.valueOf(product.toUpperCase(Locale.ROOT));
        // determine branch (without refs)
        String currentBranch = ScanUtils.getBranchFromRef(event.getRef());
        List<String> branches = getBranches(controllerRequest, flowProperties);
        BugTracker bt = ScanUtils.getBugTracker(controllerRequest.getAssignee(), bugType, jiraProperties, controllerRequest.getBug());
        FilterConfiguration filter = filterFactory.getFilter(controllerRequest, flowProperties);
        Map<FindingSeverity, Integer> thresholdMap = getThresholds(controllerRequest);
        // build request object
        Repository repository = event.getRepository();
        String gitUrl = repository.getCloneUrl();
        String token;
        String gitAuthUrl;
        log.info("Using url: {}", gitUrl);
        if (event.getInstallation() != null && event.getInstallation().getId() != null) {
            installationId = event.getInstallation().getId();
            token = gitHubAppAuthService.getInstallationToken(installationId);
            token = FlowConstants.GITHUB_APP_CLONE_USER.concat(":").concat(token);
        } else {
            token = scmConfigOverrider.determineConfigToken(properties, controllerRequest.getScmInstance());
            if (ScanUtils.empty(token)) {
                log.error("No token was provided for Github");
                throw new MachinaRuntimeException();
            }
        }
        gitAuthUrl = gitAuthUrlGenerator.addCredToUrl(ScanRequest.Repository.GITHUB, gitUrl, token);
        ScanRequest request = ScanRequest.builder().application(app).product(p).project(controllerRequest.getProject()).team(controllerRequest.getTeam()).namespace(repository.getOwner().getName().replace(" ", "_")).repoName(repository.getName()).repoUrl(repository.getCloneUrl()).repoUrlWithAuth(gitAuthUrl).repoType(ScanRequest.Repository.GITHUB).branch(currentBranch).defaultBranch(repository.getDefaultBranch()).refs(event.getRef()).email(determineEmails(event)).scanPreset(controllerRequest.getPreset()).incremental(controllerRequest.getIncremental()).excludeFolders(controllerRequest.getExcludeFolders()).excludeFiles(controllerRequest.getExcludeFiles()).bugTracker(bt).filter(filter).thresholds(thresholdMap).organizationId(getOrganizationid(repository)).gitUrl(gitUrl).hash(event.getAfter()).build();
        setScmInstance(controllerRequest, request);
        // Check if an installation Id is provided and store it for later use
        if (installationId != null) {
            request.putAdditionalMetadata(FlowConstants.GITHUB_APP_INSTALLATION_ID, installationId.toString());
        }
        /*Check for Config as code (cx.config) and override*/
        CxConfig cxConfig = gitHubService.getCxConfigOverride(request);
        request = configOverrider.overrideScanRequestProperties(cxConfig, request);
        request.putAdditionalMetadata(HTMLHelper.WEB_HOOK_PAYLOAD, body);
        request.setId(uid);
        // only initiate scan/automation if branch is applicable
        if (helperService.isBranch2Scan(request, branches)) {
            flowService.initiateAutomation(request);
        }
    } catch (IllegalArgumentException e) {
        return getBadRequestMessage(e, controllerRequest, product);
    }
    return getSuccessMessage();
}

Example 8 with FilterConfiguration

use of com.checkmarx.sdk.dto.filtering.FilterConfiguration in project cx-flow by checkmarx-ltd.

the class PostRequestData method initiateScan.

@PostMapping("/scan")
public ResponseEntity<EventResponse> initiateScan(@RequestBody CxScanRequest scanRequest, @RequestHeader(value = TOKEN_HEADER) String token) {
    String uid = helperService.getShortUid();
    String errorMessage = "Error submitting Scan Request.";
    MDC.put(FlowConstants.MAIN_MDC_ENTRY, uid);
    log.info("Processing Scan initiation request");
    validateToken(token);
    try {
        log.trace(scanRequest.toString());
        ScanRequest.Product product = ScanRequest.Product.CX;
        String project = scanRequest.getProject();
        String branch = scanRequest.getBranch();
        String application = scanRequest.getApplication();
        String team = scanRequest.getTeam();
        if (ScanUtils.empty(application)) {
            application = project;
        }
        if (ScanUtils.empty(team)) {
            team = cxScannerService.getProperties().getTeam();
        }
        properties.setTrackApplicationOnly(scanRequest.isApplicationOnly());
        if (ScanUtils.anyEmpty(project, branch, scanRequest.getGitUrl())) {
            log.error("{}  The project | branch | git_url was not provided", errorMessage);
            ResponseEntity.status(HttpStatus.BAD_REQUEST).body(null);
            return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(EventResponse.builder().message(errorMessage).success(false).build());
        }
        String scanPreset = cxScannerService.getProperties().getScanPreset();
        if (!ScanUtils.empty(scanRequest.getPreset())) {
            scanPreset = scanRequest.getPreset();
        }
        boolean inc = cxScannerService.getProperties().getIncremental();
        if (scanRequest.isIncremental()) {
            inc = true;
        }
        BugTracker.Type bugType;
        if (!ScanUtils.empty(scanRequest.getBug())) {
            bugType = ScanUtils.getBugTypeEnum(scanRequest.getBug(), properties.getBugTrackerImpl());
        } else {
            bugType = ScanUtils.getBugTypeEnum(properties.getBugTracker(), properties.getBugTrackerImpl());
        }
        if (!ScanUtils.empty(scanRequest.getProduct())) {
            product = ScanRequest.Product.valueOf(scanRequest.getProduct().toUpperCase(Locale.ROOT));
        }
        FilterConfiguration filter = determineFilter(scanRequest);
        String bug = properties.getBugTracker();
        if (!ScanUtils.empty(scanRequest.getBug())) {
            bug = scanRequest.getBug();
        }
        BugTracker bt = ScanUtils.getBugTracker(scanRequest.getAssignee(), bugType, jiraProperties, bug);
        List<String> excludeFiles = scanRequest.getExcludeFiles();
        List<String> excludeFolders = scanRequest.getExcludeFolders();
        if ((excludeFiles == null) && !ScanUtils.empty(cxScannerService.getProperties().getExcludeFiles())) {
            excludeFiles = Arrays.asList(cxScannerService.getProperties().getExcludeFiles().split(","));
        }
        if (excludeFolders == null && !ScanUtils.empty(cxScannerService.getProperties().getExcludeFolders())) {
            excludeFolders = Arrays.asList(cxScannerService.getProperties().getExcludeFolders().split(","));
        }
        ScanRequest request = ScanRequest.builder().application(application).product(product).project(project).team(team).namespace(scanRequest.getNamespace()).repoName(scanRequest.getRepoName()).repoUrl(scanRequest.getGitUrl()).repoUrlWithAuth(scanRequest.getGitUrl()).repoType(ScanRequest.Repository.NA).branch(branch).refs(Constants.CX_BRANCH_PREFIX.concat(branch)).email(null).incremental(inc).scanPreset(scanPreset).excludeFolders(excludeFolders).excludeFiles(excludeFiles).bugTracker(bt).filter(filter).build();
        request.setId(uid);
        request.putAdditionalMetadata(HTMLHelper.WEB_HOOK_PAYLOAD, scanRequest.toString());
        if (!ScanUtils.empty(scanRequest.getResultUrl())) {
            request.putAdditionalMetadata("result_url", scanRequest.getResultUrl());
        }
        scanService.initiateAutomation(request);
    } catch (Exception e) {
        log.error("Error submitting Scan Request. {}", ExceptionUtils.getMessage(e), e);
        ResponseEntity.status(HttpStatus.BAD_REQUEST).body(null);
        return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(EventResponse.builder().message(errorMessage).success(false).build());
    }
    return ResponseEntity.status(HttpStatus.OK).body(EventResponse.builder().message("Scan Request Successfully Submitted").success(true).build());
}

Example 9 with FilterConfiguration

use of com.checkmarx.sdk.dto.filtering.FilterConfiguration in project cx-flow by checkmarx-ltd.

the class BatchComponentSteps method sastClientIsMocked.

@Given("SAST client is mocked - to allow tests to pass without active SAST environment")
public void sastClientIsMocked() throws CheckmarxException {
    when(cxClient.getTeamId(anyString())).thenReturn(ScanFixture.TEAM_ID);
    when(cxClient.getProjects(anyString())).thenReturn(ScanFixture.getProjects());
    FilterConfiguration filter = FilterConfiguration.fromSimpleFilters(ScanFixture.getScanFilters());
    when(cxClient.getReportContentByScanId(ScanFixture.SCAN_ID, filter)).thenReturn(ScanFixture.getScanResults());
    CxScannerService cxScannerService = new CxScannerService(cxProperties, null, null, null, null);
    cxFlowRunner = new CxFlowRunner(flowProperties, cxScannerService, jiraProperties, gitHubProperties, gitLabProperties, iastService, adoProperties, helperService, executors, resultsService, osaScannerService, filterFactory, configOverrider, buildProperties, scanners, thresholdValidator);
}

Example 10 with FilterConfiguration

use of com.checkmarx.sdk.dto.filtering.FilterConfiguration in project checkmarx-spring-boot-java-sdk by checkmarx-ltd.

the class CxGoServiceIT method completeScanFlow.

@Test
// works only on Windows
@Ignore
public void completeScanFlow() throws CheckmarxException {
    login();
    if (StringUtils.isNotEmpty(properties.getClientSecret())) {
        String teamId = service.getTeamId(properties.getTeam());
        Integer projectId = service.getProjectId(teamId, GO_PROJECT_NAME);
        CxScanParams params = new CxScanParams();
        params.setProjectName(GO_PROJECT_NAME);
        params.setTeamId(teamId);
        params.setProjectId(projectId);
        params.setGitUrl("https://github.com/Custodela/Riches.git");
        params.setBranch("refs/heads/master");
        params.setSourceType(CxScanParams.Type.GIT);
        // run the scan and wait for it to finish
        Integer x = service.createScan(params, "CxFlow Scan");
        service.waitForScanCompletion(x);
        FilterConfiguration filterConfiguration = FilterConfiguration.fromSimpleFilters(Collections.singletonList(new Filter(Filter.Type.SEVERITY, "High")));
        // generate the results
        ScanResults results = service.getReportContentByScanId(x, filterConfiguration);
        assertNotNull(results);
    }
}