Skip to content
Merged
Show file tree
Hide file tree
Changes from 10 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 4 additions & 5 deletions build.gradle
Original file line number Diff line number Diff line change
Expand Up @@ -72,10 +72,9 @@ repositories {
}
}

def buildInfoVersion = '2.43.6'
def idePluginsCommonVersion = '2.4.4'
// Updated to 2.17.3 for security fixes - compatible with Java 8+
def jacksonVersion = '2.17.3'
def buildInfoVersion = '2.43.9'
def idePluginsCommonVersion = '2.4.5'
def jacksonVersion = '2.18.6'

dependencies {
implementation group: 'com.fasterxml.jackson.dataformat', name: 'jackson-dataformat-yaml', version: jacksonVersion
Expand All @@ -87,7 +86,7 @@ dependencies {
implementation group: 'com.jfrog.xray.client', name: 'xray-client-java', version: '0.14.1'
implementation group: 'org.apache.commons', name: 'commons-collections4', version: '4.4'
implementation group: 'org.jfrog.filespecs', name: 'file-specs-java', version: '1.1.2'
implementation group: 'org.apache.commons', name: 'commons-lang3', version: '3.11'
implementation group: 'org.apache.commons', name: 'commons-lang3', version: '3.18.0'
implementation group: 'com.google.guava', name: 'guava', version: '32.0.1-jre'
implementation group: 'org.codehaus.plexus', name: 'plexus-utils', version: '3.4.1'
implementation group: 'net.lingala.zip4j', name: 'zip4j', version: '2.11.4'
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@
import com.jfrog.ide.idea.inspections.upgradeversion.UpgradeVersion;
import com.jfrog.ide.idea.navigation.NavigationService;
import com.jfrog.ide.idea.scan.ScannerBase;
import com.jfrog.ide.idea.utils.DescriptorPathUtils;
import com.jfrog.ide.idea.ui.ComponentsTree;
import com.jfrog.ide.idea.ui.LocalComponentsTree;
import com.jfrog.ide.idea.utils.Descriptor;
Expand Down Expand Up @@ -142,7 +143,7 @@ Set<DescriptorFileTreeNode> getFileDescriptors(PsiElement element) {
Enumeration<TreeNode> roots = ((SortableChildrenTreeNode) componentsTree.getModel().getRoot()).children();
for (TreeNode root : Collections.list(roots)) {
if (root instanceof DescriptorFileTreeNode fileNode) {
if (fileNode.getFilePath().equals(element.getContainingFile().getVirtualFile().getPath())) {
if (DescriptorPathUtils.areDescriptorPathsEqual(fileNode.getFilePath(), element.getContainingFile().getVirtualFile().getPath())) {
fileDescriptors.add(fileNode);
}
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,11 @@
import com.intellij.psi.PsiElementVisitor;
import com.jfrog.ide.idea.inspections.upgradeversion.GoUpgradeVersion;
import com.jfrog.ide.idea.inspections.upgradeversion.UpgradeVersion;
import com.jfrog.ide.idea.scan.GoScanner;
import com.jfrog.ide.idea.scan.ScanManager;
import com.jfrog.ide.idea.scan.ScannerBase;
import com.jfrog.ide.idea.utils.Descriptor;
import com.jfrog.ide.idea.utils.DescriptorPathUtils;
import org.apache.commons.lang3.StringUtils;
import org.jetbrains.annotations.NotNull;

Expand Down Expand Up @@ -56,7 +58,8 @@ boolean isDependency(PsiElement element) {
@Override
ScannerBase getScanner(Project project, String path) {
return ScanManager.getScanners(project).stream()
.filter(manager -> StringUtils.equals(manager.getProjectPath(), path))
.filter(GoScanner.class::isInstance)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks like a behavior change beyond WSL (?) - needs a comment explaining why subclasses should be excluded

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it was missing there.
all the other inspections has this.
we want only the inspections that are generated from the GoScanner....

.filter(manager -> DescriptorPathUtils.areDescriptorPathsEqual(manager.getProjectPath(), path))
.findAny()
.orElse(null);
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@
import com.jfrog.ide.idea.events.AnnotationEvents;
import com.jfrog.ide.idea.ui.ComponentsTree;
import com.jfrog.ide.idea.ui.LocalComponentsTree;
import com.jfrog.ide.idea.utils.DescriptorPathUtils;
import org.jetbrains.annotations.NotNull;
import org.jetbrains.annotations.Nullable;

Expand Down Expand Up @@ -52,7 +53,7 @@ public List<FileIssueNode> doAnnotate(PsiFile file) {
Enumeration<TreeNode> roots = ((SortableChildrenTreeNode) componentsTree.getModel().getRoot()).children();
roots.asIterator().forEachRemaining(root -> {
FileTreeNode fileNode = (FileTreeNode) root;
if (fileNode.getFilePath().equals(file.getContainingFile().getVirtualFile().getPath())) {
if (DescriptorPathUtils.areDescriptorPathsEqual(fileNode.getFilePath(), file.getContainingFile().getVirtualFile().getPath())) {
fileNode.children().asIterator().forEachRemaining(issueNode -> {
if (issueNode instanceof FileIssueNode) {
issues.add((FileIssueNode) issueNode);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,10 @@
import com.jfrog.ide.common.nodes.subentities.Severity;
import com.jfrog.ide.common.nodes.subentities.SourceCodeScanType;
import com.jfrog.ide.idea.scan.data.*;
import com.jfrog.ide.idea.utils.DescriptorPathUtils;
import lombok.Getter;
import org.jetbrains.annotations.Nullable;

import java.net.URI;
import java.nio.file.Paths;
import java.util.List;

@Getter
Expand Down Expand Up @@ -53,30 +53,37 @@ public JFrogSecurityWarning(
}

public JFrogSecurityWarning(SarifResult result, SourceCodeScanType reporter, Rule rule) {
this(result, reporter, rule, null);
}

public JFrogSecurityWarning(SarifResult result, SourceCodeScanType reporter, Rule rule, @Nullable String wslDistro) {
this(getFirstRegion(result).getStartLine() - 1,
getFirstRegion(result).getStartColumn() - 1,
getFirstRegion(result).getEndLine() - 1,
getFirstRegion(result).getEndColumn() - 1,
determineReason(result.getMessage().getText(), rule.getShortDescription().getText(), reporter),
getFilePath(result),
getFilePath(result, wslDistro),
result.getRuleId(),
getFirstRegion(result).getSnippet().getText(),
reporter,
isWarningApplicable(result, rule),
Severity.fromSarif(result.getSeverity()),
convertCodeFlowsToFindingInfo(result.getCodeFlows())
convertCodeFlowsToFindingInfo(result.getCodeFlows(), wslDistro)
);
}

private static boolean isWarningApplicable(SarifResult result, Rule rule) {
return !result.getKind().equals("pass") && (rule.getRuleProperties().map(properties -> properties.getApplicability().equals("applicable")).orElse(true));
}

private static String getFilePath(SarifResult result) {
return !result.getLocations().isEmpty() ? uriToPath(result.getLocations().get(0).getPhysicalLocation().getArtifactLocation().getUri()) : "";
private static String getFilePath(SarifResult result, @Nullable String wslDistro) {
return !result.getLocations().isEmpty()
? DescriptorPathUtils.sarifArtifactUriToLocalPath(
result.getLocations().get(0).getPhysicalLocation().getArtifactLocation().getUri(), wslDistro)
: "";
}

private static FindingInfo[][] convertCodeFlowsToFindingInfo(List<CodeFlow> codeFlows) {
private static FindingInfo[][] convertCodeFlowsToFindingInfo(List<CodeFlow> codeFlows, @Nullable String wslDistro) {
if (codeFlows == null || codeFlows.isEmpty()) {
return null;
}
Expand All @@ -92,7 +99,7 @@ private static FindingInfo[][] convertCodeFlowsToFindingInfo(List<CodeFlow> code
for (int j = 0; j < locations.size(); j++) {
PhysicalLocation location = locations.get(j).getLocation().getPhysicalLocation();
results[i][j] = new FindingInfo(
uriToPath(location.getArtifactLocation().getUri()),
DescriptorPathUtils.sarifArtifactUriToLocalPath(location.getArtifactLocation().getUri(), wslDistro),
location.getRegion().getStartLine(),
location.getRegion().getStartColumn(),
location.getRegion().getEndLine(),
Expand Down Expand Up @@ -122,10 +129,6 @@ public void setScannerSearchTarget(String scannerSearchTarget) {
this.scannerSearchTarget = scannerSearchTarget;
}

private static String uriToPath(String path) {
return Paths.get(URI.create(path)).toString();
}

private static String determineReason(String resultMessage, String ruleMessage, SourceCodeScanType scannerType) {
return scannerType.equals(SourceCodeScanType.SAST) ? ruleMessage : resultMessage;
}
Expand Down
7 changes: 5 additions & 2 deletions src/main/java/com/jfrog/ide/idea/inspections/JumpToCode.java
Original file line number Diff line number Diff line change
Expand Up @@ -9,10 +9,10 @@
import com.intellij.openapi.fileEditor.FileEditorManager;
import com.intellij.openapi.project.Project;
import com.intellij.openapi.util.text.StringUtil;
import com.intellij.openapi.vfs.LocalFileSystem;
import com.intellij.openapi.vfs.VirtualFile;
import com.intellij.psi.PsiFile;
import com.intellij.psi.util.PsiUtilBase;
import com.jfrog.ide.idea.utils.DescriptorPathUtils;
import org.jetbrains.annotations.NotNull;

/**
Expand Down Expand Up @@ -72,7 +72,10 @@ private void highlightCode(int startRow, int endRow, int startColumn, int endCol
}

private VirtualFile getVirtualFile(String path) {
return LocalFileSystem.getInstance().findFileByPath(path);
if (path == null || path.isEmpty()) {
return null;
}
return DescriptorPathUtils.findLocalVirtualFile(path);
}

private Document getDocument(Editor editor) {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
import com.jfrog.ide.idea.scan.ScanManager;
import com.jfrog.ide.idea.scan.ScannerBase;
import com.jfrog.ide.idea.utils.Descriptor;
import com.jfrog.ide.idea.utils.DescriptorPathUtils;
import org.apache.commons.lang3.StringUtils;
import org.jetbrains.annotations.NotNull;

Expand Down Expand Up @@ -55,7 +56,7 @@ boolean isDependency(PsiElement element) {
@Override
ScannerBase getScanner(Project project, String path) {
return ScanManager.getScanners(project).stream()
.filter(manager -> StringUtils.equals(manager.getProjectPath(), path))
.filter(manager -> DescriptorPathUtils.areDescriptorPathsEqual(manager.getProjectPath(), path))
.filter(this::isMatchingScanner)
.findAny()
.orElse(null);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,11 @@ public ApplicabilityScannerExecutor(Log log) {
supportedPackageTypes = SUPPORTED_PACKAGE_TYPES;
}

public ApplicabilityScannerExecutor(Log log, String wslDistro) {
super(SourceCodeScanType.CONTEXTUAL, log, wslDistro);
supportedPackageTypes = SUPPORTED_PACKAGE_TYPES;
}

public List<JFrogSecurityWarning> execute(ScanConfig.Builder inputFileBuilder, Runnable checkCanceled, ProgressIndicator indicator) throws IOException, InterruptedException {
return super.execute(inputFileBuilder, SCANNER_ARGS, checkCanceled, indicator);
}
Expand Down Expand Up @@ -57,7 +62,7 @@ protected List<JFrogSecurityWarning> parseOutputSarif(Path outputFile) throws IO
List<SarifResult> evidence = resultsByRule.getOrDefault(rule.getId(), List.of());
for (SarifResult result : evidence) {
if (!result.getLocations().isEmpty()) {
warnings.add(new JFrogSecurityWarning(result, scanType, rule));
warnings.add(new JFrogSecurityWarning(result, scanType, rule, getWslDistro()));
}
}
} else if ("not_applicable".equals(applicability)) {
Expand Down
4 changes: 2 additions & 2 deletions src/main/java/com/jfrog/ide/idea/scan/GoScanner.java
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,6 @@
import com.google.common.collect.Maps;
import com.intellij.diagnostic.PluginException;
import com.intellij.openapi.project.Project;
import com.intellij.openapi.vfs.LocalFileSystem;
import com.intellij.openapi.vfs.VirtualFile;
import com.intellij.psi.PsiFile;
import com.intellij.psi.PsiManager;
Expand All @@ -17,6 +16,7 @@
import com.jfrog.ide.idea.scan.data.PackageManagerType;
import com.jfrog.ide.idea.ui.ComponentsTree;
import com.jfrog.ide.idea.ui.menus.filtermanager.ConsistentFilterManager;
import com.jfrog.ide.idea.utils.DescriptorPathUtils;
import com.jfrog.ide.idea.utils.GoUtils;

import javax.annotation.Nullable;
Expand Down Expand Up @@ -58,7 +58,7 @@ protected DepTree buildTree() throws IOException {

@Override
protected PsiFile[] getProjectDescriptors() {
VirtualFile file = LocalFileSystem.getInstance().findFileByPath(descriptorFilePath);
VirtualFile file = DescriptorPathUtils.findLocalVirtualFile(descriptorFilePath);
if (file == null) {
return null;
}
Expand Down
7 changes: 3 additions & 4 deletions src/main/java/com/jfrog/ide/idea/scan/GradleScanner.java
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@
import com.intellij.openapi.application.ApplicationManager;
import com.intellij.openapi.extensions.PluginId;
import com.intellij.openapi.project.Project;
import com.intellij.openapi.vfs.LocalFileSystem;
import com.intellij.openapi.vfs.VirtualFile;
import com.intellij.psi.PsiFile;
import com.intellij.psi.PsiManager;
Expand All @@ -19,6 +18,7 @@
import com.jfrog.ide.idea.inspections.GradleKotlinInspection;
import com.jfrog.ide.idea.log.Logger;
import com.jfrog.ide.idea.scan.data.PackageManagerType;
import com.jfrog.ide.idea.utils.DescriptorPathUtils;
import com.jfrog.ide.idea.ui.ComponentsTree;
import com.jfrog.ide.idea.ui.menus.filtermanager.ConsistentFilterManager;
import org.apache.commons.lang3.StringUtils;
Expand Down Expand Up @@ -71,11 +71,10 @@ public class GradleScanner extends SingleDescriptorScanner {

@Override
protected PsiFile[] getProjectDescriptors() {
LocalFileSystem localFileSystem = LocalFileSystem.getInstance();
Path basePath = Paths.get(this.basePath);
VirtualFile file = localFileSystem.findFileByPath(basePath.resolve("build.gradle").toString());
VirtualFile file = DescriptorPathUtils.findLocalVirtualFile(basePath.resolve("build.gradle").toString());
if (file == null) {
file = localFileSystem.findFileByPath(basePath.resolve("build.gradle.kts").toString());
file = DescriptorPathUtils.findLocalVirtualFile(basePath.resolve("build.gradle.kts").toString());
if (file == null) {
return null;
}
Expand Down
4 changes: 4 additions & 0 deletions src/main/java/com/jfrog/ide/idea/scan/IACScannerExecutor.java
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,10 @@ public IACScannerExecutor(Log log) {
super(SourceCodeScanType.IAC, log);
}

public IACScannerExecutor(Log log, String wslDistro) {
super(SourceCodeScanType.IAC, log, wslDistro);
}

public List<JFrogSecurityWarning> execute(ScanConfig.Builder inputFileBuilder, Runnable checkCanceled, ProgressIndicator indicator) throws IOException, InterruptedException {
return super.execute(inputFileBuilder, SCANNER_ARGS, checkCanceled, indicator);
}
Expand Down
4 changes: 2 additions & 2 deletions src/main/java/com/jfrog/ide/idea/scan/NpmScanner.java
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
package com.jfrog.ide.idea.scan;

import com.intellij.openapi.project.Project;
import com.intellij.openapi.vfs.LocalFileSystem;
import com.intellij.openapi.vfs.VirtualFile;
import com.intellij.psi.PsiFile;
import com.intellij.psi.PsiManager;
Expand All @@ -15,6 +14,7 @@
import com.jfrog.ide.idea.scan.data.PackageManagerType;
import com.jfrog.ide.idea.ui.ComponentsTree;
import com.jfrog.ide.idea.ui.menus.filtermanager.ConsistentFilterManager;
import com.jfrog.ide.idea.utils.DescriptorPathUtils;

import java.io.IOException;
import java.nio.file.Paths;
Expand Down Expand Up @@ -46,7 +46,7 @@ protected DepTree buildTree() throws IOException {

@Override
protected PsiFile[] getProjectDescriptors() {
VirtualFile file = LocalFileSystem.getInstance().findFileByPath(descriptorFilePath);
VirtualFile file = DescriptorPathUtils.findLocalVirtualFile(descriptorFilePath);
if (file == null) {
return null;
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,10 @@ public SastScannerExecutor(Log log) {
super(SourceCodeScanType.SAST, log);
}

public SastScannerExecutor(Log log, String wslDistro) {
super(SourceCodeScanType.SAST, log, wslDistro);
}

public List<JFrogSecurityWarning> execute(ScanConfig.Builder inputFileBuilder, Runnable checkCanceled, ProgressIndicator indicator) throws IOException, InterruptedException {
return super.execute(inputFileBuilder, SCANNER_ARGS, checkCanceled, RUN_WITH_NEW_CONFIG_FILE, indicator);
}
Expand Down
Loading
Loading