checkmarx-ltd / cli Goto Github PK

The link in the README.md goes to an internal Confluence page.

<a href="https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1339424904/CLI+Plugin">Checkmarx Knowledge Center</a>

The external page seems to be this one: https://checkmarx.com/resource/documents/en/34965-8149-cli-plugin.html

Hi,

I've tested latest CLI version 2020.2.18 and found that in that inside the JAR file (CxConsolePlugin-CLI-2020.2.18.jar) there are 2 files that shouldn't be there, because they are outside of the JAR already:

• RunCxConsole.cmd
• RunCxConsole.sh
• log4j.xml

To see this please try to Unzip the JAR and you will be able to see those files there.

Is that possible to fix it ?
Thanks !
Miguel

Description

I have created a checkmarx project where GIT is used as source control to scan the code, All the connection is successfull and I am able to run the scan without any issue using checkmarx web UI.

I have downloaded CLI plugin from https://checkmarx.com/plugins/. And now I want to run the scan of that same project using cli as :

java -Xmx1024m -jar CxConsolePlugin-CLI-1.1.10.jar Scan -v -ProjectName "CxServer/<team-name>/<project-name>" -CxServer "https://<company>.checkmarx.net" -cxuser "username" -cxpassword "password" -LocationType "GIT" -locationbranch "master" -locationurl https://<git-username>:<git-password>@repo-url.git  

Expected Behavior

Start the project scan if present or create new project if not then start scan.

Actual Behavior

I am getting following error as:

[2022-02-25T14:44:14,450 INFO ] --------------------


[2022-02-25T14:44:14,452 INFO ] Default configuration file location: /mnt/c/Users/<username>/Documents/checkmarx_test/config/cx_console.properties
[2022-02-25T14:44:14,662 INFO ] Initializing Cx client [2021.4.9]
[2022-02-25T14:44:15,202 INFO ] Checkmarx server version [9.3.0.1139]. Hotfix [17].
[2022-02-25T14:44:15,203 INFO ] Logging into the Checkmarx service.
[2022-02-25T14:44:15,945 INFO ] full team path: /CxServer/<team-name>
[2022-02-25T14:44:16,145 INFO ] preset name: Checkmarx Default
[2022-02-25T14:44:16,341 INFO ] Project already exists with ID 301
[2022-02-25T14:44:16,348 INFO ] Locale used in CxSAST is  en-US
[2022-02-25T14:44:16,349 INFO ] -----------------------------------Create CxSAST Scan:------------------------------------
[2022-02-25T14:44:16,360 INFO ] Exclude folders pattern: _cvs,.svn,.hg,.git,.bzr,bin,obj,backup,node_modules
[2022-02-25T14:44:16,360 INFO ] Exclude files pattern: *.DS_Store,*.ipr,*.iws,*.bak,*.tmp,*.aac,*.aif,*.iff,*.m3u,*.mid,*.mp3,*.mpa,*.ra,*.wav,*.wma,*.3g2,*.3gp,*.asf,*.asx,*.avi,*.flv,*.mov,*.mp4,*.mpg,*.rm,*.swf,*.vob,*.wmv,*.bmp,*.gif,*.jpg,*.png,*.psd,*.tif,*.jar,*.zip,*.rar,*.exe,*.dll,*.pdb,*.7z,*.gz,*.tar.gz,*.tar,*.ahtm,*.ahtml,*.fhtml,*.hdm,*.hdml,*.hsql,*.ht,*.hta,*.htc,*.htd,*.htmls,*.ihtml,*.mht,*.mhtm,*.mhtml,*.ssi,*.stm,*.stml,*.ttml,*.txn,*.class,*.iml,Checkmarx/Reports/*.*
[2022-02-25T14:44:17,221 ERROR] Status code: 400, message: 'Failed to create git remote source scan setting', response b "messageDetails": "Failure occurred during GIT Browsing"

Any help or direction to debug this issue would be appreciated. Thank you.

I am not sure if it's a bug but am not able to change the labels of the issue so it is marked as bug at the moment.

Reproduction

Detail the steps taken to reproduce the issue

Where applicable, please include (exclude sensitive information):

• Code of Files to reproduce the issue
• Log files
• Application settings
• Screenshots

Environment Details

• Checkmarx Plugin Version: 1.1.10 | Checkmarx SAST Min Version: 8.9.0
• using Linux to run the CLI command

Describe the problem

Currently many Checkmarx customers set and use custom fields to pass additional environmental information to a Checkmarx project. The current CLI tool does not support setting custom fields when a new project is created, or when a scan is submitted to that project.

Proposed solution

The CLI tool should allow for custom fields to be set by name when a project is created, and when a scan is run (if new information is pertinent).

Additional details

None

CVE-2019-17571, CVE-2020-5421, and CVE-2020-9488 were all found in the current client. These are:

CVE-2019-17571 - critical - log4j_log4 1.2.17
CVE-2020-5421 - medium - spring-core_spring-core 5.2.4
CVE-2020-9488 - low - log4j_log4j 1.2.17

What are the features/actions I can execute with this CLI plugin? Can I do everything which I can do with REST API?