Skip to content

Commit cd9572b

Browse files
cx-ben-alvocheckmarx-kobi-hagmicx-elchanan-arbivBenAlvo1
authored
Support scan ASCA command (AST-42348, AST-69533) (#373)
* Support new scan vorpal command * renamed lightweight to vorpal * Removed comment * rename * small CR fixes * CR comments changes * CR comment fixes * Removed inheritance! * updated fields according to new proto * Added agent to arguments * adding agent to tests * update vorpal to asca * fix tests * revert change in kicsRealtimeScan * revert revert change in kicsRealtimeScan * resolve conversation --------- Co-authored-by: checkmarx-kobi-hagmi <[email protected]> Co-authored-by: elchananarb <[email protected]> Co-authored-by: AlvoBen <[email protected]>
1 parent 79ce114 commit cd9572b

File tree

15 files changed

+922
-31
lines changed

15 files changed

+922
-31
lines changed

‎src/main/java/com/checkmarx/ast/asca/Error.java

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
package com.checkmarx.ast.asca;
2+
import com.fasterxml.jackson.annotation.JsonCreator;
3+
import com.fasterxml.jackson.annotation.JsonProperty;
4+
import lombok.Value;
5+
6+
@Value
7+
public class Error {
8+
public int code;
9+
public String description;
10+
11+
@JsonCreator
12+
public Error(
13+
@JsonProperty("code") int code,
14+
@JsonProperty("description") String description)
15+
{
16+
this.code = code;
17+
this.description = description;
18+
}
19+
}

‎src/main/java/com/checkmarx/ast/asca/ScanDetail.java

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
package com.checkmarx.ast.asca;
2+
3+
import com.fasterxml.jackson.annotation.JsonCreator;
4+
import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
5+
import com.fasterxml.jackson.annotation.JsonInclude;
6+
import com.fasterxml.jackson.annotation.JsonProperty;
7+
import com.fasterxml.jackson.databind.annotation.JsonDeserialize;
8+
import lombok.ToString;
9+
import lombok.Value;
10+
11+
@Value
12+
@ToString(callSuper = true)
13+
@JsonDeserialize()
14+
@JsonInclude(JsonInclude.Include.NON_NULL)
15+
@JsonIgnoreProperties(ignoreUnknown = true)
16+
public class ScanDetail {
17+
18+
int ruleID;
19+
String language;
20+
String ruleName;
21+
String severity;
22+
String fileName;
23+
int line;
24+
String problematicLine;
25+
int length;
26+
String remediationAdvise;
27+
String description;
28+
29+
@JsonCreator
30+
public ScanDetail(
31+
@JsonProperty("rule_id") int ruleID,
32+
@JsonProperty("language") String language,
33+
@JsonProperty("rule_name") String ruleName,
34+
@JsonProperty("severity") String severity,
35+
@JsonProperty("file_name") String fileName,
36+
@JsonProperty("line") int line,
37+
@JsonProperty("problematicLine") String problematicLine,
38+
@JsonProperty("length") int length,
39+
@JsonProperty("remediationAdvise") String remediationAdvise,
40+
@JsonProperty("description") String description
41+
) {
42+
this.ruleID = ruleID;
43+
this.language = language;
44+
this.ruleName = ruleName;
45+
this.severity = severity;
46+
this.fileName = fileName;
47+
this.line = line;
48+
this.problematicLine = problematicLine;
49+
this.length = length;
50+
this.remediationAdvise = remediationAdvise;
51+
this.description = description;
52+
}
53+
}

‎src/main/java/com/checkmarx/ast/asca/ScanResult.java

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
package com.checkmarx.ast.asca;
2+
3+
import com.checkmarx.ast.utils.JsonParser;
4+
import com.fasterxml.jackson.annotation.JsonCreator;
5+
import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
6+
import com.fasterxml.jackson.annotation.JsonInclude;
7+
import com.fasterxml.jackson.annotation.JsonProperty;
8+
import com.fasterxml.jackson.databind.annotation.JsonDeserialize;
9+
import com.fasterxml.jackson.databind.type.TypeFactory;
10+
import lombok.ToString;
11+
import lombok.Value;
12+
13+
import java.util.List;
14+
15+
@Value
16+
@ToString(callSuper = true)
17+
@JsonDeserialize()
18+
@JsonInclude(JsonInclude.Include.NON_NULL)
19+
@JsonIgnoreProperties(ignoreUnknown = true)
20+
public class ScanResult {
21+
22+
String requestId;
23+
boolean status;
24+
String message;
25+
List<ScanDetail> scanDetails;
26+
Error error;
27+
28+
@JsonCreator
29+
public ScanResult(
30+
@JsonProperty("request_id") String requestId,
31+
@JsonProperty("status") boolean status,
32+
@JsonProperty("message") String message,
33+
@JsonProperty("scan_details") List<ScanDetail> scanDetails,
34+
@JsonProperty("error") Error error
35+
) {
36+
this.requestId = requestId;
37+
this.status = status;
38+
this.message = message;
39+
this.scanDetails = scanDetails;
40+
this.error = error;
41+
}
42+
43+
public static <T> T fromLine(String line) {
44+
return JsonParser.parse(line, TypeFactory.defaultInstance().constructType(ScanResult.class));
45+
}
46+
}

‎src/main/java/com/checkmarx/ast/project/Project.java

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
package com.checkmarx.ast.project;
22

3+
import com.checkmarx.ast.utils.JsonParser;
34
import com.checkmarx.ast.wrapper.CxBaseObject;
45
import com.fasterxml.jackson.annotation.JsonCreator;
56
import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
@@ -36,10 +37,10 @@ public Project(@JsonProperty("ID") String id,
3637
}
3738

3839
public static <T> T fromLine(String line) {
39-
return parse(line, TypeFactory.defaultInstance().constructType(Project.class));
40+
return JsonParser.parse(line, TypeFactory.defaultInstance().constructType(Project.class));
4041
}
4142

4243
public static <T> List<T> listFromLine(String line) {
43-
return parse(line, TypeFactory.defaultInstance().constructCollectionType(List.class, Project.class));
44+
return JsonParser.parse(line, TypeFactory.defaultInstance().constructCollectionType(List.class, Project.class));
4445
}
4546
}

‎src/main/java/com/checkmarx/ast/scan/Scan.java

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
package com.checkmarx.ast.scan;
22

3+
import com.checkmarx.ast.utils.JsonParser;
34
import com.checkmarx.ast.wrapper.CxBaseObject;
45
import com.fasterxml.jackson.annotation.JsonCreator;
56
import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
@@ -43,10 +44,10 @@ public Scan(@JsonProperty("ID") String id, @JsonProperty("ProjectID") String pro
4344
}
4445

4546
public static <T> T fromLine(String line) {
46-
return parse(line, TypeFactory.defaultInstance().constructType(Scan.class));
47+
return JsonParser.parse(line, TypeFactory.defaultInstance().constructType(Scan.class));
4748
}
4849

4950
public static <T> List<T> listFromLine(String line) {
50-
return parse(line, TypeFactory.defaultInstance().constructCollectionType(List.class, Scan.class));
51+
return JsonParser.parse(line, TypeFactory.defaultInstance().constructCollectionType(List.class, Scan.class));
5152
}
5253
}

‎src/main/java/com/checkmarx/ast/tenant/TenantSetting.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
package com.checkmarx.ast.tenant;
22

3+
import com.checkmarx.ast.utils.JsonParser;
34
import com.checkmarx.ast.wrapper.CxBaseObject;
45
import com.fasterxml.jackson.annotation.JsonCreator;
56
import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
@@ -31,7 +32,7 @@ public TenantSetting(@JsonProperty("key") String key, @JsonProperty("value") Str
3132
}
3233

3334
public static <T> List<T> listFromLine(String line) {
34-
return CxBaseObject.parse(line,
35+
return JsonParser.parse(line,
3536
TypeFactory.defaultInstance()
3637
.constructCollectionType(List.class, TenantSetting.class));
3738
}

‎src/main/java/com/checkmarx/ast/utils/JsonParser.java

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
package com.checkmarx.ast.utils;
2+
3+
import com.fasterxml.jackson.core.JsonProcessingException;
4+
import com.fasterxml.jackson.databind.JavaType;
5+
import com.fasterxml.jackson.databind.ObjectMapper;
6+
import org.apache.commons.lang3.StringUtils;
7+
8+
import java.io.BufferedReader;
9+
import java.io.IOException;
10+
11+
public class JsonParser {
12+
public static <T> T parse(String line, JavaType type) {
13+
T result = null;
14+
if (!StringUtils.isBlank(line) && isValidJSON(line)) {
15+
try {
16+
result = new ObjectMapper().readValue(line, type);
17+
} catch (JsonProcessingException e) {
18+
e.printStackTrace();
19+
}
20+
}
21+
return result;
22+
}
23+
24+
private static boolean isValidJSON(final String json) {
25+
try {
26+
final ObjectMapper mapper = new ObjectMapper();
27+
mapper.readTree(json);
28+
return true;
29+
} catch (IOException e) {
30+
return false;
31+
}
32+
}
33+
34+
}

‎src/main/java/com/checkmarx/ast/wrapper/CxBaseObject.java

Lines changed: 0 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -34,26 +34,4 @@ protected CxBaseObject(@JsonProperty("ID") String id,
3434
this.updatedAt = updatedAt;
3535
this.tags = tags;
3636
}
37-
38-
public static <T> T parse(String line, JavaType type) {
39-
T result = null;
40-
if (!StringUtils.isBlank(line) && isValidJSON(line)) {
41-
try {
42-
result = new ObjectMapper().readValue(line, type);
43-
} catch (JsonProcessingException e) {
44-
e.printStackTrace();
45-
}
46-
}
47-
return result;
48-
}
49-
50-
public static boolean isValidJSON(final String json) {
51-
try {
52-
final ObjectMapper mapper = new ObjectMapper();
53-
mapper.readTree(json);
54-
return true;
55-
} catch (IOException e) {
56-
return false;
57-
}
58-
}
5937
}

‎src/main/java/com/checkmarx/ast/wrapper/CxConstants.java

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ public final class CxConstants {
2727
static final String SUB_CMD_SHOW = "show";
2828
static final String RESULTS_BFL_SUB_CMD = "bfl";
2929
static final String SUB_CMD_LIST = "list";
30+
static final String SUB_CMD_ASCA = "asca";
3031
static final String SUB_CMD_CREATE = "create";
3132
static final String SUB_CMD_CANCEL = "cancel";
3233
static final String CMD_TRIAGE = "triage";
@@ -50,7 +51,9 @@ public final class CxConstants {
5051
static final String CWE_ID = "--cwe-id";
5152
static final String LANGUAGE = "--language";
5253
static final String VULNERABILITY_TYPE = "--vulnerability-type";
53-
static final String FILE_SOURCES = "--file";
54+
static final String FILE = "--file";
55+
static final String FILE_SOURCE = "--file-source";
56+
static final String ASCA_LATEST_VERSION = "--asca-latest-version";
5457
static final String ADDITONAL_PARAMS = "--additional-params";
5558
static final String ENGINE = "--engine";
5659
static final String SUB_CMD_KICS_REALTIME = "kics-realtime";

‎src/main/java/com/checkmarx/ast/wrapper/CxWrapper.java

Lines changed: 31 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
package com.checkmarx.ast.wrapper;
22

3+
import com.checkmarx.ast.asca.ScanResult;
34
import com.checkmarx.ast.codebashing.CodeBashing;
45
import com.checkmarx.ast.kicsRealtimeResults.KicsRealtimeResults;
56
import com.checkmarx.ast.learnMore.LearnMore;
@@ -12,6 +13,7 @@
1213
import com.checkmarx.ast.results.result.Node;
1314
import com.checkmarx.ast.scan.Scan;
1415
import com.checkmarx.ast.tenant.TenantSetting;
16+
import com.checkmarx.ast.utils.JsonParser;
1517
import com.fasterxml.jackson.databind.ObjectMapper;
1618
import com.fasterxml.jackson.databind.type.CollectionType;
1719
import com.fasterxml.jackson.databind.type.TypeFactory;
@@ -216,6 +218,33 @@ public List<Project> projectList(String filter) throws IOException, InterruptedE
216218
return Execution.executeCommand(withConfigArguments(arguments), logger, Project::listFromLine);
217219
}
218220

221+
public ScanResult ScanAsca(String fileSource, boolean ascaLatestVersion, String agent) throws IOException, InterruptedException, CxException {
222+
this.logger.info("Fetching ASCA scanResult");
223+
224+
List<String> arguments = new ArrayList<>();
225+
arguments.add(CxConstants.CMD_SCAN);
226+
arguments.add(CxConstants.SUB_CMD_ASCA);
227+
arguments.add(CxConstants.FILE_SOURCE);
228+
arguments.add(fileSource);
229+
if (ascaLatestVersion) {
230+
arguments.add(CxConstants.ASCA_LATEST_VERSION);
231+
}
232+
233+
appendAgentToArguments(agent, arguments);
234+
235+
return Execution.executeCommand(withConfigArguments(arguments), logger, ScanResult::fromLine);
236+
}
237+
238+
private static void appendAgentToArguments(String agent, List<String> arguments) {
239+
arguments.add(CxConstants.AGENT);
240+
if (agent != null && !agent.isEmpty()){
241+
arguments.add(agent);
242+
}
243+
else{
244+
arguments.add("CLI-Java-Wrapper");
245+
}
246+
}
247+
219248
public List<String> projectBranches(@NonNull UUID projectId, String filter)
220249
throws CxException, IOException, InterruptedException {
221250
this.logger.info("Fetching the branches for project id {} using the filter: {}", projectId, filter);
@@ -229,7 +258,7 @@ public List<String> projectBranches(@NonNull UUID projectId, String filter)
229258

230259
return Execution.executeCommand(withConfigArguments(arguments),
231260
logger,
232-
line -> CxBaseObject.parse(line, BRANCHES_TYPE));
261+
line -> JsonParser.parse(line, BRANCHES_TYPE));
233262
}
234263

235264
public List<CodeBashing> codeBashingList(@NonNull String cweId, @NonNull String language, @NonNull String queryName) throws IOException, InterruptedException, CxException {
@@ -336,7 +365,7 @@ public KicsRealtimeResults kicsRealtimeScan(@NonNull String fileSources, String
336365
List<String> arguments = new ArrayList<>();
337366
arguments.add(CxConstants.CMD_SCAN);
338367
arguments.add(CxConstants.SUB_CMD_KICS_REALTIME);
339-
arguments.add(CxConstants.FILE_SOURCES);
368+
arguments.add(CxConstants.FILE);
340369
arguments.add(fileSources);
341370
arguments.add(CxConstants.ADDITONAL_PARAMS);
342371
arguments.add(additionalParams);

‎src/main/java/com/checkmarx/ast/wrapper/Execution.java

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package com.checkmarx.ast.wrapper;
22

33
import org.slf4j.Logger;
4+
45
import java.io.*;
56
import java.lang.reflect.Field;
67
import java.net.URL;
@@ -49,7 +50,7 @@ static <T> T executeCommand(List<String> arguments,
4950
stringBuilder.append(line).append(LINE_SEPARATOR);
5051
T parsedLine = lineParser.apply(line);
5152
if (parsedLine != null) {
52-
if (areAllFieldsNotNull(parsedLine)) {
53+
if (areAllFieldsNotNull(parsedLine) || isAscaRequest(arguments)) {
5354
executionResult = parsedLine;
5455
}
5556
}
@@ -62,6 +63,10 @@ static <T> T executeCommand(List<String> arguments,
6263
}
6364
}
6465

66+
public static boolean isAscaRequest(List<String> arguments) {
67+
return (arguments.size() >= 3 && arguments.get(1).equals("scan") && arguments.get(2).equals("asca"));
68+
}
69+
6570
private static boolean areAllFieldsNotNull(Object obj) {
6671
for (Field field : obj.getClass().getDeclaredFields()) {
6772
field.setAccessible(true);
@@ -75,6 +80,7 @@ private static boolean areAllFieldsNotNull(Object obj) {
7580
}
7681
return true;
7782
}
83+
7884
static String executeCommand(List<String> arguments,
7985
Logger logger,
8086
String directory,

0 commit comments

Comments
 (0)