Sastchat #634

ittaigilat-cx · 2024-01-04T14:01:14Z

By submitting a PR to this repository, you agree to the terms within the Checkmarx Code of Conduct. Please see the contributing guidelines for how to create and submit a high-quality PR for this repo.

Description

Add AI-assisted SAST results remediation capabilities.
Command line changes: chat command now has two subcommands: kics and sast.

Testing

Unit tests cover command line flags and execution cases using mock.

Checklist

I have added documentation for new/changed functionality in this PR (if applicable).
I have updated the CLI help for new/changed functionality in this PR (if applicable).
All active GitHub checks for tests, formatting, and security are passing
The correct base branch is being used

* modified scan output log with additional params

* handle async call html and json messages

* New KICS real-time scanner

Improve PR handling

* first version for release notes * new automation * Update release.yml Co-authored-by: Pedro Lopes <[email protected]>

* create universal * adding new changes Co-authored-by: Pedro Lopes <[email protected]>

…416) * added auto release notes and teams notification with release details

adding teams notifications

Bumps [github.com/spf13/viper](https://github.com/spf13/viper) from 1.11.0 to 1.12.0. - [Release notes](https://github.com/spf13/viper/releases) - [Commits](spf13/viper@v1.11.0...v1.12.0) --- updated-dependencies: - dependency-name: github.com/spf13/viper dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps alpine from 3.15.4 to 3.16.0. --- updated-dependencies: - dependency-name: alpine dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [github.com/gookit/color](https://github.com/gookit/color) from 1.5.0 to 1.5.1. - [Release notes](https://github.com/gookit/color/releases) - [Commits](gookit/color@v1.5.0...v1.5.1) --- updated-dependencies: - dependency-name: github.com/gookit/color dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* change timeout flag Co-authored-by: Pedro Lopes <[email protected]> Co-authored-by: Diogo Pimenta <[email protected]>

Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra) from 1.4.0 to 1.5.0. - [Release notes](https://github.com/spf13/cobra/releases) - [Commits](spf13/cobra@v1.4.0...v1.5.0) --- updated-dependencies: - dependency-name: github.com/spf13/cobra dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* correct link for results * fixing linter * correct build of constant * fix urls * updating links and identifiers --------- Co-authored-by: Pedro Lopes <[email protected]>

…command (#623) * fixing for incremental scan appearing as Full scan when using scan list command

Bumps alpine from 3.18.4 to 3.19.0. --- updated-dependencies: - dependency-name: alpine dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [github.com/spf13/viper](https://github.com/spf13/viper) from 1.17.0 to 1.18.2. - [Release notes](https://github.com/spf13/viper/releases) - [Commits](spf13/viper@v1.17.0...v1.18.2) --- updated-dependencies: - dependency-name: github.com/spf13/viper dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [github.com/google/uuid](https://github.com/google/uuid) from 1.4.0 to 1.5.0. - [Release notes](https://github.com/google/uuid/releases) - [Changelog](https://github.com/google/uuid/blob/master/CHANGELOG.md) - [Commits](google/uuid@v1.4.0...v1.5.0) --- updated-dependencies: - dependency-name: github.com/google/uuid dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.15.0 to 0.17.0. - [Commits](golang/crypto@v0.15.0...v0.17.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

This reverts commit 9b8c0b0.

This reverts commit 31313ed.

gitguardian · 2024-01-04T14:01:56Z

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
Once a secret has been leaked into a git repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.

Our GitHub checks need improvements? Share your feedbacks!}}

github-actions · 2024-01-04T14:05:33Z

Checkmarx One – Scan Summary & Details – 78a9db9b-141d-4a27-95d7-ce19b7c879f6

New Issues

Issue	Source File / Package	Checkmarx Insight
Client_DOM_Stored_XSS	/internal/commands/data/challenge8.js: 46	Attack Vector
Client_DOM_Stored_XSS	/internal/commands/data/GoatUtils.js: 56	Attack Vector
Client_DOM_Stored_XSS	/internal/commands/data/challenge8.js: 7	Attack Vector

pedrompflopes and others added 30 commits May 4, 2022 18:25

Update release.yml

23217b6

Update release.yml

14ff7f5

Update release.yml

64d2f83

Update release.yml

6d513a8

AST-12510 support Azure API version 5.0 (#402)

757860a

removed deprecated result command (#403)

ea7ca32

Feature/ast 9890 format scan log (#404)

e5cf641

* modified scan output log with additional params

Ast 12482 add summary html for async scans (#405)

4bc62e7

* handle async call html and json messages

adding kics realtime scanner support using containers platform (#401)

18d3000

* New KICS real-time scanner

Update manual-integration-test.yml

e444668

Improve PR handling (#413)

7dd9e70

Improve PR handling

GOARCH for windows said am instead of amd64 (#408)

052b0f7

Release notes format improvement (#411)

bc23d31

* first version for release notes * new automation * Update release.yml Co-authored-by: Pedro Lopes <[email protected]>

Change mac build to fat (#414)

93b4289

* create universal * adding new changes Co-authored-by: Pedro Lopes <[email protected]>

Update pr-label.yml

078a201

Update release.yml

219dbdf

Update release.yml

92aea8f

added auto release notes and teams notification with release details (#…

6ae8243

…416) * added auto release notes and teams notification with release details

Update .goreleaser.yml

c370fc6

Update release.yml

3821fba

adding teams notifications (#417)

b36268a

adding teams notifications

Update release.yml

8fe9b33

Update release.yml

7c3c931

Update release.yml

f24555e

Update pr-labeler.yml

96f6f7c

Increase retry timeout flag default value (#423)

0713931

* change timeout flag Co-authored-by: Pedro Lopes <[email protected]> Co-authored-by: Diogo Pimenta <[email protected]>

tiagobcx and others added 19 commits November 28, 2023 14:37

correct link for results (#622)

8f085fa

* correct link for results * fixing linter * correct build of constant * fix urls * updating links and identifiers --------- Co-authored-by: Pedro Lopes <[email protected]>

Add sastchat gpt-based SAST results remediation

df2fd4d

change chat command to chatkics

0f589fe

Fix for incremental scan appearing as Full scan when using scan list …

1e84dc6

…command (#623) * fixing for incremental scan appearing as Full scan when using scan list command

create sast and kics chat sub-commands

0a9bb7f

Fix chat-kics_test and some refactoring

b476559

tidy

31313ed

delete files that were added by mistake in previous commit

9b8c0b0

Revert "delete files that were added by mistake in previous commit"

af669dc

This reverts commit 9b8c0b0.

Revert "tidy"

8251316

This reverts commit 31313ed.

Add chat sast tests

5c327f7

Merge branch 'main' into sastchat

8ff0b5f

github contributor count (#631)

cb69e96

Merge branch 'main' into sastchat

3e74db2

chat sast: add support for user-input

bf4b3ed

ittaigilat-cx had a problem deploying to DEU_GALACTICA January 4, 2024 14:01 — with GitHub Actions Failure

pedrompflopes requested review from a team, hmmachadocx and tiagobcx and removed request for a team January 4, 2024 14:01

ittaigilat-cx closed this Jan 4, 2024

ittaigilat-cx force-pushed the sastchat branch from d832c7f to bf4b3ed Compare January 4, 2024 15:00

ittaigilat-cx mentioned this pull request Jan 4, 2024

Sastchat #637

Merged

4 tasks

ittaigilat-cx had a problem deploying to DEU_GALACTICA January 4, 2024 16:51 — with GitHub Actions Failure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Sastchat #634

Sastchat #634

ittaigilat-cx commented Jan 4, 2024

gitguardian bot commented Jan 4, 2024 •

edited

Loading

github-actions bot commented Jan 4, 2024

Sastchat #634

Sastchat #634

Conversation

ittaigilat-cx commented Jan 4, 2024

Description

Testing

Checklist

gitguardian bot commented Jan 4, 2024 • edited Loading

️✅ There are no secrets present in this pull request anymore.

github-actions bot commented Jan 4, 2024

New Issues

gitguardian bot commented Jan 4, 2024 •

edited

Loading