Add Critical Severity - AST 21466 #644

tiagobcx · 2024-01-22T16:26:38Z

By submitting a PR to this repository, you agree to the terms within the Checkmarx Code of Conduct. Please see the contributing guidelines for how to create and submit a high-quality PR for this repo.

Description

Support critical severity from the cxOne engines

References

https://checkmarx.atlassian.net/browse/AST-37694

Testing

Manual and integration tests

Checklist

I have added documentation for new/changed functionality in this PR (if applicable).
I have updated the CLI help for new/changed functionality in this PR (if applicable).
All active GitHub checks for tests, formatting, and security are passing
The correct base branch is being used

…port

github-actions · 2024-01-22T16:43:20Z

Checkmarx One – Scan Summary & Details – e1ec1487-c8f8-4168-9399-2f39430e1137

Policy Management Violations

Policy Name	Rule(s)	Break Build
[SAST-ML0] Not allowed NEW Sast vulnerabilities		true

No New Or Fixed Issues Found

* adding minio feature flag (#646) * Rename gpt fix (#648) * Add "*.cmp" extension (#647) * Bump github.com/google/uuid from 1.5.0 to 1.6.0 (#650) Bumps [github.com/google/uuid](https://github.com/google/uuid) from 1.5.0 to 1.6.0. - [Release notes](https://github.com/google/uuid/releases) - [Changelog](https://github.com/google/uuid/blob/master/CHANGELOG.md) - [Commits](google/uuid@v1.5.0...v1.6.0) --- updated-dependencies: - dependency-name: github.com/google/uuid dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Sast results analysis (#645) * Add result show --prioritize-sast flag & implementation * Fix linter errors * Add tests and fix linter * Change prioritize-sast help text and priority values * Fix line-too-long lint issue * Update result integration test for --prioritize-sast * Change prioritize-sast to sast-prioritization * Change UnknownReference to a more informational value * Chage sast-prioritization to sast-redundancy * Add newlines to response if necessary * Fix lint errors in new code * Refactor for better coverage on chat-sast code * initialize array (#651) * AST-35649 | fix ast-cli vulnerabilities (#655) * fix vulnerabilities * fix vulnerabilities * fix vulnerabilities * fix vulnerabilities * fix vulnerabilities * alpine:3.17.0 * 19 * sha * kics vulnerabilities * kics and lint problems * delete if * ignore 0666 number * fix vulnerabilities * permission const * 666 * AST-34271 | improve result summary table in cli (#656) * AST-34271 | improve result summary table in cli * AST-34271 | fixing pr decoration test * AST-34271 | fixing triage test, removing uneeded project remove * AST-34271 | solve getRoot function test bugs * Update release.yml (#660) * remove sca optin from scan log description (#661) * remove sca option from scan log description * AST-35664 | Enhance AI Guided Remediation answers (#662) * AST-35664 | Enhance AI Guided Remediation answers * AST-35664 | improved test readability * Encode client ID and secret (#654) * Add policy violation to PR/MR decoration (#643) * AST-35640 | Create Groups Assignment (#663) * create groups assignment * lint * lint issues * import order * import order * do not send groups when FF = on * code review * lint issues * load feature flags * Or review fixes * Integration Tests * Integration Tests-update project * groups.go * lint * fix PrintIfVerbose * fix PrintfIfVerbose * findGroupByName fix * fix nul error in find group * fixing linter --------- Co-authored-by: Or Shamir Checkmarx <[email protected]> Co-authored-by: tiagobcx <[email protected]> * CLI | Support the application-name flag and add association to the project (AST-35636 , AST-35637) (#664) * Add application name flag * fixes * AST-35637 | add project association to application functionality * Renamed integration test * AST-35637 | added create project with app-name test * added NoPermissionApp case * Added constants to mock flags and error messages * added test * passing application Id to project * AST-35637 | added unit tests for create scan/project under application * Added integration tests + handling of forbidden status * extracted fail message to const + handled error model * AST-35637 | handle 403 status code in update and create project * AST-35637 | fix github linter applicationId param * AST-35637 | initialize projModel applicationIds in updateProject func * AST-35637 | fix github linter problem - change Id to ID * AST-35637 | fix github linter problem - change Id to ID * removed ErroModelUsage + formatting errors * AST-35637 | fix github linter problem - shadowing errors * AST-35637 | fix github linter problem - shadowing errors * AST-35637 | fix github linter problem - change package applicationErrors to applicationerrors * AST-35637 | fix github linter problem - change FakeHttpStatus to FakeHTTPStatus * AST-35637 | fix github linter problem * AST-35637 | fix integration tests * AST-35637 | add checked returned error when deffering * AST-35637 | fix tests * AST-35637 | go linter imports order * AST-35637 | make createApplicationIds func more readable * reduced the limit count * fix * fixes * AST-35637 | change prameter type of applicationId from string to []string * AST-35637 | resolved conflict * AST-35637 | resolved github linter errors --------- Co-authored-by: checkmarx-kobi-hagmi <[email protected]> Co-authored-by: AlvoBen <[email protected]> * AST-36339 | enable Ai Guided Remediation only if the tenant has permission (#666) * enable Ai Guided Remediation only if the tenant has permission * trigger unit test * fix test * hide chat command from help (#668) * Update Get Application by Name with Exact Match and Update Permissions Log Message (AST-36823) (#669) * the application name passed to application-name flag must match application name exactly * Changed ApplicationDoesntExist and ApplicationNoPermission to ApplicationDoesntExistOrNoPermission * Fixed lint error --------- Co-authored-by: Or Shamir Checkmarx <[email protected]> * AST-36690 | cleanup integration test (#671) * fix test * fix test * names * crypto * crypto * adding assert * adding application ids to project creation print --------- Co-authored-by: Or Shamir Checkmarx <[email protected]> * Update Confidence Description (AST-37132) (#676) * Update Confidence Description (AST-37132) * Update Confidence Description (AST-37132) * fix tests * Fix "About this vulnerability" link Fix "About this vulnerability" link * Update result.go * Update result.go * Add Directory.Packages.props for Nuget Central Package Management (#652) * Update filters.go Added Directory.Packages.props file used by Nuget Central Package Management for dependency management in SCA * Fixed linting issue --------- Co-authored-by: Or Shamir Checkmarx <[email protected]> * Update CI.yml to Use GitLab Env Vars (#681) * Update CI.yml to Use GitLab Env Vars * Update CI.yml to Use GitLab Env Vars * Update CI.yml to Use GitLab Env Vars * AST-37225 Shared Containers Constants (#684) * AST-37225 const * containers type --------- Co-authored-by: Or Shamir Checkmarx <[email protected]> * Bump alpine from 3.19.0 to 3.19.1 (#649) Bumps alpine from 3.19.0 to 3.19.1. --- updated-dependencies: - dependency-name: alpine dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Pedro Lopes <[email protected]> Co-authored-by: Or Shamir Checkmarx <[email protected]> * update-gon-test (#686) * Update gonMac.hcl * Update release.yml * Update gonMac.hcl * Update gonMac.hcl * Update gonMac.hcl * Update gonMac.hcl * Update gonMac.hcl * Update gonMac.hcl * Update result_test.go fix test * Update result_test.go * CLI | Add Missing PackageManager Types (AST-38138) (#691) * add package manager types * add unit test * Change createDependencyMapFromDependencyResolution signature to fix linter errors * fix lint errors * Resolve pr review conversation --------- Co-authored-by: AlvoBen <[email protected]> * changes after merge and testcases --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Tiago Baptista <[email protected]> Co-authored-by: Margarita <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ittai Gilat <[email protected]> Co-authored-by: Pedro Lopes <[email protected]> Co-authored-by: tamarleviCm <[email protected]> Co-authored-by: AlvoBen <[email protected]> Co-authored-by: Or Shamir Checkmarx <[email protected]> Co-authored-by: tiagobcx <[email protected]> Co-authored-by: checkmarx-kobi-hagmi <[email protected]> Co-authored-by: AlvoBen <[email protected]> Co-authored-by: checkmarx-kobi-hagmi <[email protected]> Co-authored-by: elchananarb <[email protected]> Co-authored-by: Phillip Dade <[email protected]> Co-authored-by: elchananarb <[email protected]>

This reverts commit 9aab42e.

OrShamirCM

Looks clean and good!
Please add critical severity to tests

OrShamirCM

Please make sure to verify the reports too (Visablity not unit test)

gitguardian · 2024-07-12T15:14:49Z

⚠️ GitGuardian has uncovered 16 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
11482443	Triggered	Generic Password	`362f464`	test/integration/data/python-vul-file.py	View secret
11482443	Triggered	Generic Password	`362f464`	internal/commands/data/python-vul-file.py	View secret
11482444	Triggered	Username Password	`362f464`	internal/commands/data/python-vul-file.py	View secret
11482444	Triggered	Username Password	`362f464`	test/integration/data/python-vul-file.py	View secret
11482445	Triggered	Generic Password	`362f464`	test/integration/data/python-vul-file.py	View secret
11482445	Triggered	Generic Password	`362f464`	internal/commands/data/python-vul-file.py	View secret
11482446	Triggered	Generic Password	`362f464`	internal/commands/data/python-vul-file.py	View secret
11482446	Triggered	Generic Password	`362f464`	test/integration/data/python-vul-file.py	View secret
11482448	Triggered	Generic Password	`362f464`	test/integration/data/python-vul-file.py	View secret
11482448	Triggered	Generic Password	`362f464`	internal/commands/data/python-vul-file.py	View secret
11482449	Triggered	Generic Password	`362f464`	test/integration/data/python-vul-file.py	View secret
11482449	Triggered	Generic Password	`362f464`	internal/commands/data/python-vul-file.py	View secret
11482450	Triggered	Generic Password	`362f464`	internal/commands/data/python-vul-file.py	View secret
11482450	Triggered	Generic Password	`362f464`	test/integration/data/python-vul-file.py	View secret
11482451	Triggered	Generic Password	`362f464`	test/integration/data/python-vul-file.py	View secret
11482451	Triggered	Generic Password	`362f464`	internal/commands/data/python-vul-file.py	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secrets safely. Learn here the best practices.
Revoke and rotate these secrets.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

tamarleviCm

you don't cover the critical results with FF
now the cli always shows the critical severity in the console summary and in the reports
is it aligned with the pm?
if yes- did you check if the plugins not break if the results contain unexpected severity

internal/commands/predicates.go

internal/commands/result.go

internal/wrappers/mock/results-mock.go

internal/commands/result_test.go

OrShamirCM · 2024-07-25T13:14:56Z

internal/commands/result.go

@@ -614,7 +625,7 @@ func summaryReport(
 		summary.Policies = filterViolatedRules(*policies)
 	}

-	enhanceWithScanSummary(summary, results)
+	enhanceWithScanSummary(summary, results, featureFlagsWrapper)



do we count api security critical severity? i saw that we found it in line 659, right?

OrShamirCM

?Do we need to support thershold with critical severity too?
@pedrompflopes @tiagobcx

igorlombacx and others added 9 commits October 19, 2023 18:36

support to critical severity in consoleSummary, markdown, and html re…

1272770

…port

updating critical severity usages

7e535a7

Merge branch 'main' into FEATURE/AST-21466-CRITICAL-SEVERITY

4a6b925

critical severity for sarif and sonar

4e6bb39

Merge branch 'main' into FEATURE/AST-21466-CRITICAL-SEVERITY

3aa617e

updating securities map

7b16c63

adding the check for CVSS3 feature flag

a972764

changing critical triage message

609ee49

changing critical triage message

69e7d6c

pedrompflopes requested review from a team, pedrompflopes and hmmachadocx and removed request for a team January 22, 2024 16:26

merge with main

5fc25fa

hmmachadocx approved these changes Jan 23, 2024

View reviewed changes

pedrompflopes marked this pull request as draft February 2, 2024 17:22

tiagobcx added the feature label Feb 8, 2024

PravinGadankush and others added 3 commits April 4, 2024 16:40

Revert "Feature/ast 37694 test critical severity (#696)"

9815a8e

This reverts commit 9aab42e.

merge with main

c7db597

OrShamirCM reviewed May 28, 2024

View reviewed changes

OrShamirCM changed the title ~~Feature/ast 21466 critical severity~~ Add Critical Severity - AST 21466 May 28, 2024

OrShamirCM reviewed May 29, 2024

View reviewed changes

OrShamirCM requested a review from hmmachadocx May 29, 2024 12:55

Merge branch 'main' into feature/AST-21466-CRITICAL-SEVERITY

362f464

Checkmarx deleted a comment from gitguardian bot Jun 20, 2024

tiagobcx marked this pull request as ready for review June 20, 2024 15:20

pedrompflopes requested a review from a team June 20, 2024 15:20

adding N/A message

f122d4f

tiagobcx added 7 commits July 15, 2024 16:07

merge with main and new NA behaviour

af85739

merge with main and new NA behaviour

bb10bbf

fixing linter + triage

d5164f4

fixing tests + linter

fe8eb09

fixing unit tests

55c7a72

Merge branch 'main' into feature/AST-21466-CRITICAL-SEVERITY

3f25f94

Merge branch 'main' into feature/AST-21466-CRITICAL-SEVERITY

988da3b

tamarleviCm requested changes Jul 17, 2024

View reviewed changes

internal/commands/predicates.go Show resolved Hide resolved

internal/commands/result.go Show resolved Hide resolved

adding new test for critical

36c129f

tiagobcx requested a review from tamarleviCm July 18, 2024 10:54

tamarleviCm reviewed Jul 18, 2024

View reviewed changes

internal/wrappers/mock/results-mock.go Outdated Show resolved Hide resolved

internal/commands/result_test.go Show resolved Hide resolved

tiagobcx requested a review from tamarleviCm July 18, 2024 16:09

Merge branch 'main' into feature/AST-21466-CRITICAL-SEVERITY

d9a84bd

OrShamirCM reviewed Jul 25, 2024

View reviewed changes

tiagobcx and others added 3 commits July 25, 2024 16:52

Update pr_test.go

34bc8d4

Merge branch 'main' into feature/AST-21466-CRITICAL-SEVERITY

9de3497

Update results-mock.go

f544812

tamarleviCm approved these changes Jul 31, 2024

View reviewed changes

pedrompflopes and others added 6 commits July 31, 2024 09:47

Merge branch 'main' into feature/AST-21466-CRITICAL-SEVERITY

b22006c

adding na to containers and apisec

14ef4d7

adding na to containers and apisec

b0622e2

adding na to containers and apisec

186fd82

changing ssh repo

c7327ac

changing ssh repo

51c946b

tiagobcx merged commit 6b5e08e into main Aug 2, 2024
9 checks passed

tiagobcx deleted the feature/AST-21466-CRITICAL-SEVERITY branch August 2, 2024 13:28

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Critical Severity - AST 21466 #644

Add Critical Severity - AST 21466 #644

tiagobcx commented Jan 22, 2024 •

edited

Loading

github-actions bot commented Jan 22, 2024 •

edited

Loading

OrShamirCM left a comment

OrShamirCM left a comment

gitguardian bot commented Jul 12, 2024 •

edited

Loading

tamarleviCm left a comment

OrShamirCM Jul 25, 2024

OrShamirCM left a comment

Add Critical Severity - AST 21466 #644

Add Critical Severity - AST 21466 #644

Conversation

tiagobcx commented Jan 22, 2024 • edited Loading

Description

References

Testing

Checklist

github-actions bot commented Jan 22, 2024 • edited Loading

Policy Management Violations

No New Or Fixed Issues Found

OrShamirCM left a comment

Choose a reason for hiding this comment

OrShamirCM left a comment

Choose a reason for hiding this comment

gitguardian bot commented Jul 12, 2024 • edited Loading

⚠️ GitGuardian has uncovered 16 secrets following the scan of your pull request.

tamarleviCm left a comment

Choose a reason for hiding this comment

OrShamirCM Jul 25, 2024

Choose a reason for hiding this comment

OrShamirCM left a comment

Choose a reason for hiding this comment

tiagobcx commented Jan 22, 2024 •

edited

Loading

github-actions bot commented Jan 22, 2024 •

edited

Loading

gitguardian bot commented Jul 12, 2024 •

edited

Loading