This script is used to provide links from within Contrast to relevant training videos and exercises within the Secure Code Warrior platform. The links appear in the "How to Fix" area of a vulnerability within the Contrast TeamServer UI and IDE plugins.
It should not be confused with the SCW Jira plugin which is created and managed by the SCW team.
The script performs the following logic:
Extract a list of rules from the Contrast organisation For each rule Call the SCW API using the CWE code If a video exists Grab the video URL for this CWE Otherwise If we have an reserve set up for this rule Grab the reserve video URL for this CWE For each language Create an integration URL for SCW Next Call the Contrast API to update the references for this rule with the videos and training links Next
This script requires Python3 and organizational admin privileges to run.
- Clone this repository locally.
- Login to the Contrast TeamServer in your browser, click your name in the top right, and select 'User settings'.
- Update the config.json in your local cloned repository with details about your TeamServer and credentials from the 'Your Keys' section. If you have an on premise installation, please ensure the url ends in
Contrast only supports one set of references per rule. Consider modifying the languages map in the
map_contrast_lang_to_scw_lang function within contrast_scw.py function to suit your customer's most popular frameworks in order they receive the most relevant training material. For a list of supported languages run:
curl -X GET "https://integration-api.securecodewarrior.com/api/v1/language-keys" -H "accept: text/plain"
This script will overwrite any manual rule references that you may have added to your Contrast environment in Policy Management > Assess Rules.
python3 contrast_scw.py. It can be run more than once should changes be made to the script, it will overwrite the rule references each time it is run.
Run with an additional parameter
python3 contrast_scw.py reset to reset your Contrast rules. This will remove all the SCW links and any manual rule references that you may have added.
- SaaS and EOP environments with TeamServer version 3.7.11
- Python version 3.7
- The reserve rules (used when a CWE video could not be found using the API) have hardcoded SCW URLs which might change in the future.
- The Contrast IDE plugins do not yet render clickable links.
- The Contrast IDE plugins do not yet render html content so this markup is visible within the IDE plugin.
- Not every rule has a SCW video available.
By installing this integration, you agree to the Contrast Beta Terms and Conditions.