Sonarqube filter params sdk 13.x #54

Bharatkk-metron · 2024-07-24T13:53:16Z

filter params added
JIra Ticket: IA-153

socket-security · 2024-07-24T13:53:35Z

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

suraj-metron · 2024-07-30T09:38:52Z

.env.example

+ENABLE_FINDINGS_INGESTION=true/false 
+
+# JUST FOR INFO: 


No need to mention just for info

suraj-metron · 2024-07-30T09:39:32Z

package-lock.json

This is a new file got committed. Is it required?

Same as a yarn lock. Since we updated the package versions, we can have this.

suraj-metron · 2024-07-30T09:40:13Z

src/ingestionConfig.ts

+    description: 'SonarQube Accounts',
+    defaultsToDisabled: false,
+  },
+


Please remove extra line

suraj-metron · 2024-07-30T11:15:43Z

yarn.lock

is this file required to be modified?

yes. I think since we have updated the version.

suraj-metron · 2024-07-30T11:15:51Z

tsconfig.json

@@ -1,7 +1,8 @@
 {
  "extends": "./node_modules/@jupiterone/integration-sdk-dev-tools/config/typescript",
  "compilerOptions": {
-    "outDir": "dist"
+    "outDir": "dist",
+    "lib": ["dom"]


Why this change?

Without this change yarn test:ci was failing. Was not able to find some global variables. Which was basically coming from Dom Library.

boostsecurity-io · 2024-07-30T11:28:48Z

⚠️ 1 New Security Finding

The latest commit contains 1 new security finding.

Findings

Dependency: npm / fast-xml-parser@ 4.2.5

Vulnerability Information

Vulnerability	Severity	CVSS	EPSS	Affected Versions	Fixed Versions	Contains Malware	Description
CVE-2024-41818	Critical	7.5			4.4.1	no	fast-xml-parser vulnerable to ReDOS at currency parsing

Dependency Location
https://github.com/JupiterOne/graph-sonarqube/blob/3f17bce98971aa6a7a0c795b354fa7f058b8c67b/yarn.lock

Not a finding? Ignore it by adding a comment on the line with just the word noboost.

Scanner: boostsecurity - BoostSecurity osv-scanner

RonaldEAM · 2024-07-31T21:53:43Z

src/ingestionConfig.ts

+  [INGESTION_SOURCE_IDS.ACCOUNT]: {
+    title: 'Account',
+    description: 'SonarQube Accounts',
+    defaultsToDisabled: false,
+  },


This ingestion source is not required, in general without account the rest of the steps wouldn't run, and we don't fetch anything so it's ok to always have it

RonaldEAM · 2024-07-31T22:06:43Z

src/instanceConfigFields.ts

+  severities: {
+    type: 'string',
+    mask: false,
+    optional: true,
+  },
+  status: {
+    type: 'string',
+    mask: false,
+    optional: true,
+  },
+  createdInLast: {
+    type: 'string',
+    mask: false,
+    optional: true,
+  },
+  types: {
+    type: 'string',
+    mask: false,
+    optional: true,
+  },


Suggested change

severities: {

type: 'string',

mask: false,

optional: true,

},

status: {

type: 'string',

mask: false,

optional: true,

},

createdInLast: {

type: 'string',

mask: false,

optional: true,

},

types: {

type: 'string',

mask: false,

optional: true,

},

findingSeverities: {

type: 'string',

mask: false,

optional: true,

},

findingStatus: {

type: 'string',

mask: false,

optional: true,

},

findingsIngestSinceDays: {

type: 'string',

mask: false,

optional: true,

},

findingTypes: {

type: 'string',

mask: false,

optional: true,

},

RonaldEAM · 2024-07-31T22:12:53Z

.env.example

+#To retrieve issues created during a time span before the current time (exclusive). Accepted units are 'y' for year, 'm' for month, 'w' for week and 'd' for day. If this parameter is set, createdAfter must not be set
+# Example value: 1m2w (1 month 2 weeks)
+CREATED_IN_LAST=10d # default value is 10 days 


Please change this name to FINDINGS_INGEST_SINCE_DAYS and make it a number where options are 90, 180, 275, 365 (days). Then you can convert those to the format sonarqube expects when you send the request. This way we are not attached to using their format in our config.
Github example:

RonaldEAM · 2024-07-31T22:17:11Z

src/steps/finding/index.ts

+function getSeverities(instanceConfig: SonarqubeIntegrationConfig) {
+  const { severities, apiVersion } = instanceConfig;
+  const severitiesSet = new Set(
+    severities?.split(',').map((severity) => FINDINGS_SEVERITIES[severity]),
+  );
+
+  // V2 -> 10.4 or above version
+  if (apiVersion == APIVersion.V1) {
+    return severities ? severities.split(',') : V1_SEVERITIES_VALUES;
+  }
+  return severitiesSet.size === 0
+    ? V2_SEVERITIES_VALUES
+    : Array.from(severitiesSet);
+}


Can you validate the config for this in validateInvocation and parse it there instead? So when this step starts the config value is ready to use
Example: https://github.com/JupiterOne/integrations/blob/main/graph/graph-gitlab/src/config.ts#L70

RonaldEAM · 2024-07-31T22:21:16Z

src/steps/finding/index.ts

@@ -34,24 +95,38 @@ export async function fetchFindings({
      // We need to further filter our API calls in order to minimize the chances
      // we'll hit the 10,000 limit impose by the API.  We're currently filtering
      // by project and severity.
-      for (const severity of severityList) {
+      for (const severity of severities) {


RonaldEAM · 2024-07-31T22:22:15Z

src/steps/finding/index.ts

+function getFilterParams(
+  instanceConfig: SonarqubeIntegrationConfig,
+): NodeJS.Dict<string | string[]> {
+  const { apiVersion, status, createdInLast, types } = instanceConfig;
+
+  let filterParams: NodeJS.Dict<string | string[]>;
+
+  if (apiVersion === APIVersion.V1) {
+    // V1 -> below 10.4 version
+    filterParams = {
+      status,
+      types,
+    };
+  } else {
+    const statusesSet = new Set(
+      status?.split(',').map((status) => FINDING_STATUSES[status]),
+    );
+    const typesSet = new Set(
+      types?.split(',').map((type) => FINDING_TYPES[type]),
+    );
+    filterParams = {
+      issueStatuses: Array.from(statusesSet).join(','),
+      impactSoftwareQualities: Array.from(typesSet).join(','),
+    };
+  }
+  filterParams['createdInLast'] = createdInLast || DEFAULT_CREATED_IN_LAST;
+  return filterParams;
+}


Same as with severities, it should be validated and parsed in validateInvocation

RonaldEAM · 2024-07-31T22:24:12Z

src/types.ts

+  severities?: string;
+  status?: string;
+  createdInLast?: string;
+  types?: string;


Suggested change

severities?: string;

status?: string;

createdInLast?: string;

types?: string;

findingSeverities?: string[];

findingStatus?: string[];

findingsIngestSinceDays?: number;

findingTypes?: string[];

RonaldEAM · 2024-07-31T22:50:14Z

src/steps/finding/index.ts

@@ -21,6 +79,9 @@ export async function fetchFindings({
 }: IntegrationStepExecutionContext<SonarqubeIntegrationConfig>) {
  const client = createSonarqubeClient(instance.config, logger);

+  const severities = getSeverities(instance.config);
+  const filterParams = getFilterParams(instance.config);


can you make sure we don't send any of these if they come undefined in instanceConfig instead of using defaults? so only new instances use those filters

I have removed the function getSeverities. For getFilterParams, we will use the values only if they are present; otherwise, we will not include anything in filterParams.

RonaldEAM · 2024-08-05T16:31:57Z

src/steps/account/index.ts

@@ -19,6 +24,7 @@ export const accountSteps: IntegrationStep<SonarqubeIntegrationConfig>[] = [
  {
    id: Steps.ACCOUNT,
    name: 'Fetch Account',
+    ingestionSourceId: INGESTION_SOURCE_IDS.ACCOUNT,


remove this

RonaldEAM · 2024-08-05T19:39:13Z

src/steps/constants.ts

+};
+
+export const INGESTION_SOURCE_IDS = {
+  ACCOUNT: 'accounts',


remove this one

RonaldEAM · 2024-08-05T21:16:07Z

src/steps/finding/index.ts

+  filterParams['createdInLast'] =
+    `${findingsIngestSinceDays || DEFAULT_FINDING_INGEST_SINCE_DAYS}d`;


we should also not filter by this if there's no config set for it

socket-security · 2024-08-07T20:53:19Z

Report too large to display inline

View full report↗︎

Bharatkk-metron added 7 commits July 24, 2024 12:33

filter params added

7ed5a16

severity mapping modified

b171394

updated version

3bf10c5

updated version 14 to 18

8181942

remove unwanted

3f6d11c

convertes string to array

a88b6e6

updated to version 13

aeda40d

Bharatkk-metron requested a review from a team as a code owner July 24, 2024 13:53

Bharatkk-metron added 5 commits July 24, 2024 19:27

re recorded har file

f299417

recording updated

60d3ed3

vendor name changed

14cd308

.env-example file updated

021914c

.env-example file updated

5132247

suraj-metron suggested changes Jul 30, 2024

View reviewed changes

empty lines removed

3f17bce

env.example file modified

afcacfd

suraj-metron approved these changes Jul 30, 2024

View reviewed changes

RonaldEAM suggested changes Jul 31, 2024

View reviewed changes

fix tsconfig

0f04ed1

RonaldEAM reviewed Jul 31, 2024

View reviewed changes

Bharatkk-metron added 4 commits August 2, 2024 13:00

review changes

9c2d878

updated the variables name

1444c1e

removed console log

e02d0fb

string corrected

4601362

RonaldEAM suggested changes Aug 5, 2024

View reviewed changes

Bharatkk-metron and others added 3 commits August 6, 2024 11:28

review comments

bcde8d8

updated example file

6a03238

refactor files

12cbe7e

v2.1.0

69938aa

RonaldEAM approved these changes Aug 7, 2024

View reviewed changes

RonaldEAM merged commit 192c035 into main Aug 7, 2024
8 checks passed

RonaldEAM deleted the sonarqube-filter-params-sdk-13.x branch August 7, 2024 20:55

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Sonarqube filter params sdk 13.x #54

Sonarqube filter params sdk 13.x #54

Bharatkk-metron commented Jul 24, 2024 •

edited by jira bot

Loading

socket-security bot commented Jul 24, 2024 •

edited

Loading

suraj-metron Jul 30, 2024

Bharatkk-metron Jul 30, 2024

suraj-metron Jul 30, 2024

suraj-metron Jul 30, 2024

Bharatkk-metron Jul 30, 2024

suraj-metron Jul 30, 2024

suraj-metron Jul 30, 2024

suraj-metron Jul 30, 2024

Bharatkk-metron Jul 30, 2024

suraj-metron Jul 30, 2024

suraj-metron Jul 30, 2024

Bharatkk-metron Jul 30, 2024

suraj-metron Jul 30, 2024

boostsecurity-io bot commented Jul 30, 2024

RonaldEAM Jul 31, 2024

RonaldEAM Jul 31, 2024

RonaldEAM Jul 31, 2024

RonaldEAM Jul 31, 2024

RonaldEAM Jul 31, 2024

RonaldEAM Jul 31, 2024

RonaldEAM Jul 31, 2024

RonaldEAM Jul 31, 2024

Bharatkk-metron Aug 5, 2024

RonaldEAM Aug 5, 2024

RonaldEAM Aug 5, 2024

RonaldEAM Aug 5, 2024

socket-security bot commented Aug 7, 2024

		filterParams['createdInLast'] =
		`${findingsIngestSinceDays \|\| DEFAULT_FINDING_INGEST_SINCE_DAYS}d`;

Sonarqube filter params sdk 13.x #54

Sonarqube filter params sdk 13.x #54

Conversation

Bharatkk-metron commented Jul 24, 2024 • edited by jira bot Loading

socket-security bot commented Jul 24, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

boostsecurity-io bot commented Jul 30, 2024

⚠️ 1 New Security Finding

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

socket-security bot commented Aug 7, 2024

Bharatkk-metron commented Jul 24, 2024 •

edited by jira bot

Loading

socket-security bot commented Jul 24, 2024 •

edited

Loading