Skip to content

Conversation

@cx-prathmesh-borle
Copy link
Contributor

Enhanced source vulnerability links

  • Added direct vulnerability links for SAST findings using resultHash parameter
  • Added direct vulnerability links for SCA findings using CVE ID and package identifier
  • Added direct vulnerability links for IaC/KICS findings using alternateId parameter
  • Added image-specific vulnerability links (does not point to exact vulnerability due to missing layerId information) for Container Security findings using encoded file path and image name
  • Added HTML field mapping source_vulnerability_summary to display clickable vulnerability links in ServiceNow
  • Added source_vulnerability_summary HTML field mapping in processor script
  • Fixed bug for 2ms (Secret Detection) and Scorecard scan types to have correct source link

var sastResultsUrl = apibaseurl + '/sast-results/' + appId + '/' + scanId;
var sastVulnerabilityLink = '';
var resultHash = jsonLastScanReportResp.results[item].data.resultHash;
if (resultHash && resultHash != '') {

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Replace if (resultHash && resultHash != '') with if (resultHash)
being falsy already covers empty strings.

var kicsResultsUrl = apibaseurl + '/results/' + scanId + '/' + appId + '/kics';
var kicsVulnerabilityLink = '';
var kicsAlternateId = jsonLastScanReportResp.results[item].alternateId;
if (kicsAlternateId && kicsAlternateId != '') {

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This can be simplified to just: if (kicsAlternateId)

var imageName = jsonLastScanReportResp.results[item].data.imageName;
var imageTag = jsonLastScanReportResp.results[item].data.imageTag;

var encodedFilePath = encodeURIComponent(gs.base64Encode(imageFilePath));

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Optional : If any of the key fields are undefined or null (imageFilePath, imageName), the encoding functions may throw or produce "undefined" strings.

We may need to consider validations.

if (imageFilePath && imageName) {
// operations
}

resultObj['source_link'] = node.getAttribute('sourcefile');

var vulnerabilityLink = node.getAttribute('vulnerability_link');
if (vulnerabilityLink && vulnerabilityLink != '') {

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

just use if (vulnerabilityLink) instead of if (vulnerabilityLink && vulnerabilityLink != '')

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants