cli's People
cli's Issues
Knowledge Center Link Directs to Internal Confluence
The link in the README.md goes to an internal Confluence page.
<a href="https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1339424904/CLI+Plugin">Checkmarx Knowledge Center</a>
The external page seems to be this one: https://checkmarx.com/resource/documents/en/34965-8149-cli-plugin.html
[Build] Jar File shouldn't contains RunCxConsole.cmd, RunCxConsole.sh and log4j.xml inside
Hi,
I've tested latest CLI version 2020.2.18 and found that in that inside the JAR file (CxConsolePlugin-CLI-2020.2.18.jar) there are 2 files that shouldn't be there, because they are outside of the JAR already:
- RunCxConsole.cmd
- RunCxConsole.sh
- log4j.xml
To see this please try to Unzip the JAR and you will be able to see those files there.
Is that possible to fix it ?
Thanks !
Miguel
Failed to create git remote source scan setting
Description
I have created a checkmarx project where GIT is used as source control to scan the code, All the connection is successfull and I am able to run the scan without any issue using checkmarx web UI.
I have downloaded CLI plugin from https://checkmarx.com/plugins/. And now I want to run the scan of that same project using cli as :
java -Xmx1024m -jar CxConsolePlugin-CLI-1.1.10.jar Scan -v -ProjectName "CxServer/<team-name>/<project-name>" -CxServer "https://<company>.checkmarx.net" -cxuser "username" -cxpassword "password" -LocationType "GIT" -locationbranch "master" -locationurl https://<git-username>:<git-password>@repo-url.git
Expected Behavior
Start the project scan if present or create new project if not then start scan.
Actual Behavior
I am getting following error as:
[2022-02-25T14:44:14,450 INFO ] --------------------
[2022-02-25T14:44:14,452 INFO ] Default configuration file location: /mnt/c/Users/<username>/Documents/checkmarx_test/config/cx_console.properties
[2022-02-25T14:44:14,662 INFO ] Initializing Cx client [2021.4.9]
[2022-02-25T14:44:15,202 INFO ] Checkmarx server version [9.3.0.1139]. Hotfix [17].
[2022-02-25T14:44:15,203 INFO ] Logging into the Checkmarx service.
[2022-02-25T14:44:15,945 INFO ] full team path: /CxServer/<team-name>
[2022-02-25T14:44:16,145 INFO ] preset name: Checkmarx Default
[2022-02-25T14:44:16,341 INFO ] Project already exists with ID 301
[2022-02-25T14:44:16,348 INFO ] Locale used in CxSAST is en-US
[2022-02-25T14:44:16,349 INFO ] -----------------------------------Create CxSAST Scan:------------------------------------
[2022-02-25T14:44:16,360 INFO ] Exclude folders pattern: _cvs,.svn,.hg,.git,.bzr,bin,obj,backup,node_modules
[2022-02-25T14:44:16,360 INFO ] Exclude files pattern: *.DS_Store,*.ipr,*.iws,*.bak,*.tmp,*.aac,*.aif,*.iff,*.m3u,*.mid,*.mp3,*.mpa,*.ra,*.wav,*.wma,*.3g2,*.3gp,*.asf,*.asx,*.avi,*.flv,*.mov,*.mp4,*.mpg,*.rm,*.swf,*.vob,*.wmv,*.bmp,*.gif,*.jpg,*.png,*.psd,*.tif,*.jar,*.zip,*.rar,*.exe,*.dll,*.pdb,*.7z,*.gz,*.tar.gz,*.tar,*.ahtm,*.ahtml,*.fhtml,*.hdm,*.hdml,*.hsql,*.ht,*.hta,*.htc,*.htd,*.htmls,*.ihtml,*.mht,*.mhtm,*.mhtml,*.ssi,*.stm,*.stml,*.ttml,*.txn,*.class,*.iml,Checkmarx/Reports/*.*
[2022-02-25T14:44:17,221 ERROR] Status code: 400, message: 'Failed to create git remote source scan setting', response b "messageDetails": "Failure occurred during GIT Browsing"
Any help or direction to debug this issue would be appreciated. Thank you.
I am not sure if it's a bug but am not able to change the labels of the issue so it is marked as bug at the moment.
Reproduction
Detail the steps taken to reproduce the issue
Where applicable, please include (exclude sensitive information):
- Code of Files to reproduce the issue
- Log files
- Application settings
- Screenshots
Environment Details
- Checkmarx Plugin Version: 1.1.10 | Checkmarx SAST Min Version: 8.9.0
- using Linux to run the CLI command
Support setting and updating custom fields in Checkmarx projects
Describe the problem
Currently many Checkmarx customers set and use custom fields to pass additional environmental information to a Checkmarx project. The current CLI tool does not support setting custom fields when a new project is created, or when a scan is submitted to that project.
Proposed solution
The CLI tool should allow for custom fields to be set by name when a project is created, and when a scan is run (if new information is pertinent).
Additional details
None
Security issues with CLI
CVE-2019-17571, CVE-2020-5421, and CVE-2020-9488 were all found in the current client. These are:
CVE-2019-17571 - critical - log4j_log4 1.2.17
CVE-2020-5421 - medium - spring-core_spring-core 5.2.4
CVE-2020-9488 - low - log4j_log4j 1.2.17
Feature set of the CLI plugin
What are the features/actions I can execute with this CLI plugin? Can I do everything which I can do with REST API?
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. ๐๐๐
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google โค๏ธ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.