From 3847e3ea438efaa4c71e2aa13f4620f93f7d43e1 Mon Sep 17 00:00:00 2001 From: Sahiba Mittal Date: Mon, 17 Oct 2022 17:12:51 +0100 Subject: [PATCH 1/6] snyk integration Signed-off-by: Sahiba Mittal --- src/assets/scss/_custom.scss | 4 + src/i18n/locales/en.json | 7 ++ src/shared/common.js | 4 + src/views/administration/AdminMenu.vue | 5 + src/views/administration/Administration.vue | 3 +- .../administration/analyzers/SnykAnalyzer.vue | 115 ++++++++++++++++++ .../vulnerabilities/Vulnerability.vue | 2 + 7 files changed, 139 insertions(+), 1 deletion(-) create mode 100644 src/views/administration/analyzers/SnykAnalyzer.vue diff --git a/src/assets/scss/_custom.scss b/src/assets/scss/_custom.scss index e0e29c837..5ea3b8536 100644 --- a/src/assets/scss/_custom.scss +++ b/src/assets/scss/_custom.scss @@ -92,6 +92,10 @@ background-color: #AFE4BF; border: 1px solid #73D08F; } +.label-source-snyk { + background-color: #afd2e4; + border: 1px solid #73c1d0; +} .label-source-vulndb { background-color: #FFC78B; border: 1px solid #FE9536; diff --git a/src/i18n/locales/en.json b/src/i18n/locales/en.json index 5d002fc68..544532c1d 100644 --- a/src/i18n/locales/en.json +++ b/src/i18n/locales/en.json @@ -151,6 +151,7 @@ "cvss_attack_vector": "Attack Vector", "cvss_access_complexity": "Access Complexity", "cvss_attack_complexity": "Attack Complexity", + "cvss_source": "Select source priority for CVSS", "cvss_privileges_required": "Privileges Required", "cvss_user_interaction": "User Interaction", "cvss_required": "Required", @@ -395,6 +396,7 @@ "internal_analyzer": "Internal", "oss_index": "Sonatype OSS Index", "vulndb": "VulnDB", + "snyk": "Snyk", "vuln_sources": "Vulnerability Sources", "nvd": "NVD", "national_vulnerability_database": "National Vulnerability Database", @@ -459,6 +461,9 @@ "analyzer_ossindex_desc": "OSS Index is a service provided by Sonatype which identifies vulnerabilities in third-party components. Dependency-Track integrates natively with the OSS Index service to provide highly accurate results. Use of this analyzer requires a valid PackageURL for the components being analyzed.", "analyzer_vulndb_enable": "Enable VulnDB analyzer", "analyzer_vulndb_desc": "VulnDB is a commercial service from Risk Based Security which identifies vulnerabilities in third-party components. Dependency-Track integrates natively with the VulnDB service to provide highly accurate results. Use of this analyzer requires a valid CPE for the components being analyzed.", + "analyzer_snyk_enable": "Enable Snyk analyzer", + "analyzer_snyk_desc": "New Snyk API allows users to query vulnerabilities for specific packages using purl.", + "analyzer_snyk_why_multiple_cvss": "Why are there multiple CVSS Scores for the same vulnerability?", "vulnsource_nvd_enable": "Enable National Vulnerability Database mirroring", "vulnsource_nvd_desc": "The National Vulnerability Database (NVD) is the largest publicly available source of vulnerability intelligence. It is maintained by a group within the National Institute of Standards and Technology (NIST) and builds upon the work of MITRE and others. Vulnerabilities in the NVD are called Common Vulnerabilities and Exposures (CVE). There are over 100,000 CVEs documented in the NVD spanning from the 1990’s to the present.", "vulnsource_nvd_feeds_url": "NVD Feeds URL", @@ -467,8 +472,10 @@ "vulnsource_osv_advisories_enable": "Select ecosystem to enable Google OSV Advisory mirroring", "vulnsource_osv_advisories_desc": "Google OSV is a distributed vulnerability and triage infrastructure for open source projects aimed at helping both open source maintainers and consumers of open source. It serves as an aggregator of vulnerability databases that have adopted the OpenSSF Vulnerability format.", "vulnsource_osv_base_url": "OSV Base URL", + "select_ecosystem": "Select Ecosystems", "registered_email_address": "Registered email address", "api_token": "API token", + "org_id": "Organization ID", "consumer_key": "Consumer key", "consumer_secret": "Consumer secret", "personal_access_token": "Personal Access Token", diff --git a/src/shared/common.js b/src/shared/common.js index 1f688f2a9..b1bcecc5e 100644 --- a/src/shared/common.js +++ b/src/shared/common.js @@ -118,6 +118,10 @@ $common.formatAnalyzerLabel = function formatAnalyzerLabel(analyzer, vulnSource, analyzerLabel = "VulnDB"; analyzerUrl = "https://vulndb.cyberriskanalytics.com/vulnerabilities/" + vulnId; break; + case 'SNYK_ANALYZER': + analyzerLabel = "Snyk"; + analyzerUrl = "https://security.snyk.io/vuln/" + vulnId; + break; } if (analyzerUrl) { analyzerLabel = `${analyzerLabel} `; diff --git a/src/views/administration/AdminMenu.vue b/src/views/administration/AdminMenu.vue index 12ea0a14c..6b32e89c2 100644 --- a/src/views/administration/AdminMenu.vue +++ b/src/views/administration/AdminMenu.vue @@ -85,6 +85,11 @@ component: "VulnDbAnalyzer", name: this.$t('admin.vulndb'), href: "#scannerVulnDbTab" + }, + { + component: "SnykAnalyzer", + name: this.$t('admin.snyk'), + href: "#scannerSnykTab" } ] }, diff --git a/src/views/administration/Administration.vue b/src/views/administration/Administration.vue index ce4c240ff..b62672b50 100644 --- a/src/views/administration/Administration.vue +++ b/src/views/administration/Administration.vue @@ -28,6 +28,7 @@ import InternalAnalyzer from "./analyzers/InternalAnalyzer"; import OssIndexAnalyzer from "./analyzers/OssIndexAnalyzer"; import VulnDbAnalyzer from "./analyzers/VulnDbAnalyzer"; + import SnykAnalyzer from "./analyzers/SnykAnalyzer"; // Vulnerability sources import VulnSourceNvd from "./vuln-sources/VulnSourceNvd"; import VulnSourceGitHubAdvisories from "./vuln-sources/VulnSourceGitHubAdvisories"; @@ -63,7 +64,7 @@ EventBus, AdminMenu, General, BomFormats, Email, InternalComponents, TaskScheduler, - InternalAnalyzer, OssIndexAnalyzer, VulnDbAnalyzer, + InternalAnalyzer, OssIndexAnalyzer, VulnDbAnalyzer, SnykAnalyzer, VulnSourceNvd, VulnSourceGitHubAdvisories, VulnSourceOSVAdvisories, Cargo, Composer, Gem, GoModules, Hex, Maven, Npm, Nuget, Python, Alerts, Templates, diff --git a/src/views/administration/analyzers/SnykAnalyzer.vue b/src/views/administration/analyzers/SnykAnalyzer.vue new file mode 100644 index 000000000..3995c9ef5 --- /dev/null +++ b/src/views/administration/analyzers/SnykAnalyzer.vue @@ -0,0 +1,115 @@ + + + \ No newline at end of file diff --git a/src/views/portfolio/vulnerabilities/Vulnerability.vue b/src/views/portfolio/vulnerabilities/Vulnerability.vue index da6cc32de..cae02218b 100644 --- a/src/views/portfolio/vulnerabilities/Vulnerability.vue +++ b/src/views/portfolio/vulnerabilities/Vulnerability.vue @@ -174,6 +174,8 @@ return "Sonatype OSS Index"; case 'VULNDB': return "VulnDB (Risk Based Security)"; + case 'SNYK': + return "Snyk Vulnerability"; default: return ""; } From 383e83ae238bb55fafcd85de04a5bbea93f503f7 Mon Sep 17 00:00:00 2001 From: Sahiba Mittal Date: Mon, 17 Oct 2022 17:18:25 +0100 Subject: [PATCH 2/6] snyk under Beta Signed-off-by: Sahiba Mittal --- src/i18n/locales/en.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/i18n/locales/en.json b/src/i18n/locales/en.json index 544532c1d..ebce57852 100644 --- a/src/i18n/locales/en.json +++ b/src/i18n/locales/en.json @@ -396,7 +396,7 @@ "internal_analyzer": "Internal", "oss_index": "Sonatype OSS Index", "vulndb": "VulnDB", - "snyk": "Snyk", + "snyk": "Snyk (Beta)", "vuln_sources": "Vulnerability Sources", "nvd": "NVD", "national_vulnerability_database": "National Vulnerability Database", From abd9c7110b35e03dc2ffb6863485f2e5acbc1169 Mon Sep 17 00:00:00 2001 From: Sahiba Mittal Date: Wed, 19 Oct 2022 11:59:07 +0100 Subject: [PATCH 3/6] Squashed commit of the following: commit c5c5ab33294669937de1fc25def624898c1bd620 Merge: 0bf649a 622f275 Author: Niklas Date: Tue Oct 18 18:57:26 2022 +0200 Merge pull request #290 from nscuro/revert-272 commit 622f2753f691f3d122526d892056c55941235017 Author: nscuro Date: Tue Oct 18 18:12:27 2022 +0200 Revert "Merge pull request #272 from rbt-mm/master-show-hierarchical-view-in-project-list" This reverts commit 58b8940bc123dad78ef2aafe04094948a6479fbc, reversing changes made to 3a64bbc7603a2a3745c4f332ce1011911171efc1. Signed-off-by: nscuro commit 0bf649ab2d37dd86ac5bff031562d4ad00af0aab Merge: 58b8940 b03b122 Author: Niklas Date: Tue Oct 18 17:51:34 2022 +0200 Merge pull request #274 from rbt-mm/master-limit-alert-rules-to-project-including-all-existing-or-future-versions Include a projects children in an alert rules limitations commit 58b8940bc123dad78ef2aafe04094948a6479fbc Merge: 3a64bbc abfe53c Author: Niklas Date: Tue Oct 18 17:46:59 2022 +0200 Merge pull request #272 from rbt-mm/master-show-hierarchical-view-in-project-list Show hierarchical view in project list commit abfe53c66eb338e75a0857dddda685a3ffdc49b4 Author: rbt-mm <113189967+rbt-mm@users.noreply.github.com> Date: Tue Oct 18 17:05:21 2022 +0200 Hide detail view button when no active child Signed-off-by: RBickert Co-authored-by: Niklas Signed-off-by: RBickert commit dbb34d3d59047e02c1a0fbf72c737c37120e01a6 Author: RBickert Date: Tue Oct 4 17:56:55 2022 +0200 Change prototype method in project list Do not access Object.prototype method 'hasOwnProperty' from target object. Only show project name in create project modal, if a project does not have a version Signed-off-by: RBickert commit a79d5351362d5520136c62ee91640ffebd12dd56 Author: RBickert Date: Tue Oct 4 17:03:10 2022 +0200 Revert "Update ci-build.yaml" This reverts commit aeccadc6debf131ee6d266ed1caac60730dc6536. Signed-off-by: RBickert commit d7b8d69b9a50ea8d52c0bd5a2ea92839b3c91b40 Author: RBickert Date: Fri Sep 30 16:27:18 2022 +0200 Filter detail view parents in backend Available parents in a project detail view are now filtered in the backend instead of the UI Signed-off-by: RBickert commit 87a9d8c268c1acbe5f328213e7b40e52806a2048 Author: RBickert Date: Thu Sep 29 16:37:23 2022 +0200 Fix switching parent to inactive A parent project cannot be set to inactive if any of his children are set to active Signed-off-by: RBickert commit 11c7eab4afad0283780139fedcf70994e0dc9867 Author: RBickert Date: Fri Sep 23 16:28:37 2022 +0200 Add hierarchical view in project list Added CSwitch in project list to switch between current flat view (default) and a new hierarchical view (shows root projects and their children in the detail view of a row). Project detail view only shows viable projects as selectable parent. Hierarchical project list shows inactive projects for children and children are sortable. Signed-off-by: RBickert commit ee966856bc2ce6e32445859c0e811646720228a4 Author: RBickert Date: Tue Sep 20 17:03:51 2022 +0200 Add persistent selection of parent to detail view Send selected parent in project detail view via API call to backend to create a persistent parent-child-relationship. Signed-off-by: RBickert commit b05a11cb7adaa16af73d15c0a86d9a8a66ccf448 Author: RBickert Date: Mon Sep 19 16:53:00 2022 +0200 Add parent in project creation and detail view Display list of every project in `Create Project` and `View Project` to select a parent project for the new or current project. Send selected parent in project creation via API call to backend to create a persistent parent-child-relationship. Signed-off-by: RBickert commit 053f6fa9ce597a39dcfa65c992bb39a45aa63d02 Author: rbt-mm <113189967+rbt-mm@users.noreply.github.com> Date: Wed Sep 28 13:24:38 2022 +0200 Update ci-build.yaml Workflow now starts on every pull request, if the branch name contains 'master' in it. Signed-off-by: RBickert commit b03b122760184fa2f981eb6ae3e0563c144dcb3e Author: RBickert Date: Tue Oct 18 13:11:23 2022 +0200 Make inclusion of children optional Added a switch in the alerts view which optionally includes every active child of the subscribed projects in the notification rule. Signed-off-by: RBickert commit 298c5be7f69ce6f02de04d9b621c3907011d33ae Merge: 54e7c51 3a64bbc Author: rbt-mm <113189967+rbt-mm@users.noreply.github.com> Date: Tue Oct 18 13:01:18 2022 +0200 Merge branch 'DependencyTrack:master' into master-limit-alert-rules-to-project-including-all-existing-or-future-versions commit 3a64bbc7603a2a3745c4f332ce1011911171efc1 Merge: 8a1239c 9d78a3b Author: Niklas Date: Tue Oct 18 10:06:35 2022 +0200 Merge pull request #287 from DependencyTrack/dependabot/docker/docker/nginxinc/nginx-unprivileged-5af0906 build(deps): bump nginxinc/nginx-unprivileged from `31ac9ab` to `5af0906` in /docker commit 8a1239c84d85d0d01916a3fef6392da78d36300c Merge: 21cd1f0 0610ba0 Author: Niklas Date: Tue Oct 18 10:06:26 2022 +0200 Merge pull request #288 from DependencyTrack/dependabot/github_actions/docker/setup-buildx-action-2.2.0 build(deps): bump docker/setup-buildx-action from 2.1.0 to 2.2.0 commit 0610ba09f27e18199ddf2b80007da6e2a88541fb Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Oct 18 01:33:58 2022 +0000 build(deps): bump docker/setup-buildx-action from 2.1.0 to 2.2.0 Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 2.1.0 to 2.2.0. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/v2.1.0...v2.2.0) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] commit 9d78a3b01a0540714f5e32014da3f14aaa32b860 Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Oct 18 01:33:57 2022 +0000 build(deps): bump nginxinc/nginx-unprivileged in /docker Bumps nginxinc/nginx-unprivileged from `31ac9ab` to `5af0906`. --- updated-dependencies: - dependency-name: nginxinc/nginx-unprivileged dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] commit 54e7c51f17600a099b846a05b31ca94d4c16cbcd Merge: 1eaefe5 c80f0ea Author: rbt-mm <113189967+rbt-mm@users.noreply.github.com> Date: Wed Oct 5 14:09:32 2022 +0200 Merge pull request #3 from rbt-mm/rbt-limit-alert-rules-to-project-including-all-existing-or-future-versions Limit alert rules to project including all existing or future versions commit c80f0ea2a9d5ae0738f0c6c9d55d9f662762ddbb Author: RBickert Date: Wed Oct 5 10:53:17 2022 +0200 Add new info in alerts view Change "Limit to projects" to "Limit to projects (including all of their active children)" to indicate that every child of a subscribed project will also be included in the notification rule. Signed-off-by: RBickert Signed-off-by: Sahiba Mittal --- .github/workflows/_meta-build.yaml | 2 +- docker/Dockerfile.alpine | 2 +- src/i18n/locales/en.json | 1 + src/views/administration/notifications/Alerts.vue | 9 +++++++++ 4 files changed, 12 insertions(+), 2 deletions(-) diff --git a/.github/workflows/_meta-build.yaml b/.github/workflows/_meta-build.yaml index 9fbb7c2fc..c6f194fce 100644 --- a/.github/workflows/_meta-build.yaml +++ b/.github/workflows/_meta-build.yaml @@ -79,7 +79,7 @@ jobs: uses: docker/setup-qemu-action@v2.1.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v2.1.0 + uses: docker/setup-buildx-action@v2.2.0 id: buildx with: install: true diff --git a/docker/Dockerfile.alpine b/docker/Dockerfile.alpine index 235fede11..8b28507d0 100644 --- a/docker/Dockerfile.alpine +++ b/docker/Dockerfile.alpine @@ -1,4 +1,4 @@ -FROM nginxinc/nginx-unprivileged:1.23.1-alpine@sha256:31ac9aba911ff980d96ac7de1f12bd1fbf2c2eee0d2052cf2f02c8db59e9238e +FROM nginxinc/nginx-unprivileged:1.23.1-alpine@sha256:5af090628cfa0e66c0320aabd0b1910796d61aa9428bea9e2c2a4bfc9ab47948 # Arguments that can be passed at build time ARG COMMIT_SHA=unknown diff --git a/src/i18n/locales/en.json b/src/i18n/locales/en.json index ebce57852..ac25079c1 100644 --- a/src/i18n/locales/en.json +++ b/src/i18n/locales/en.json @@ -505,6 +505,7 @@ "delete_alert": "Delete Alert", "limit_to": "Limit To", "limit_to_projects": "Limit to projects", + "include_children": "Include active children of projects", "limit_to_tags": "Limit to Tags", "alert_created": "Alert created", "alert_deleted": "Alert deleted", diff --git a/src/views/administration/notifications/Alerts.vue b/src/views/administration/notifications/Alerts.vue index 4efe1ec62..f2fe2af6d 100644 --- a/src/views/administration/notifications/Alerts.vue +++ b/src/views/administration/notifications/Alerts.vue @@ -155,6 +155,10 @@ +
+ + {{ $t('admin.include_children') }} +
@@ -209,6 +213,7 @@ uuid: row.uuid, name: row.name, enabled: row.enabled, + notifyChildren: row.notifyChildren, publisherClass: row.publisher.publisherClass, notificationLevel: row.notificationLevel, destination: this.parseDestination(row), @@ -230,6 +235,9 @@ enabled() { this.updateNotificationRule(); }, + notifyChildren() { + this.updateNotificationRule(); + }, notifyOn() { this.updateNotificationRule(); }, @@ -260,6 +268,7 @@ uuid: this.uuid, name: this.name, enabled: this.enabled, + notifyChildren: this.notifyChildren, notificationLevel: this.notificationLevel, publisherConfig: JSON.stringify({ destination: this.destination }), notifyOn: this.notifyOn From 42bf763f5d4a42bbbe77403cafeccae5da03dae0 Mon Sep 17 00:00:00 2001 From: Sahiba Mittal Date: Wed, 19 Oct 2022 15:09:21 +0100 Subject: [PATCH 4/6] undo commit Signed-off-by: Sahiba Mittal --- .github/workflows/_meta-build.yaml | 2 +- docker/Dockerfile.alpine | 2 +- src/i18n/locales/en.json | 1 - src/views/administration/notifications/Alerts.vue | 9 --------- 4 files changed, 2 insertions(+), 12 deletions(-) diff --git a/.github/workflows/_meta-build.yaml b/.github/workflows/_meta-build.yaml index c6f194fce..9fbb7c2fc 100644 --- a/.github/workflows/_meta-build.yaml +++ b/.github/workflows/_meta-build.yaml @@ -79,7 +79,7 @@ jobs: uses: docker/setup-qemu-action@v2.1.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v2.2.0 + uses: docker/setup-buildx-action@v2.1.0 id: buildx with: install: true diff --git a/docker/Dockerfile.alpine b/docker/Dockerfile.alpine index 8b28507d0..235fede11 100644 --- a/docker/Dockerfile.alpine +++ b/docker/Dockerfile.alpine @@ -1,4 +1,4 @@ -FROM nginxinc/nginx-unprivileged:1.23.1-alpine@sha256:5af090628cfa0e66c0320aabd0b1910796d61aa9428bea9e2c2a4bfc9ab47948 +FROM nginxinc/nginx-unprivileged:1.23.1-alpine@sha256:31ac9aba911ff980d96ac7de1f12bd1fbf2c2eee0d2052cf2f02c8db59e9238e # Arguments that can be passed at build time ARG COMMIT_SHA=unknown diff --git a/src/i18n/locales/en.json b/src/i18n/locales/en.json index ac25079c1..ebce57852 100644 --- a/src/i18n/locales/en.json +++ b/src/i18n/locales/en.json @@ -505,7 +505,6 @@ "delete_alert": "Delete Alert", "limit_to": "Limit To", "limit_to_projects": "Limit to projects", - "include_children": "Include active children of projects", "limit_to_tags": "Limit to Tags", "alert_created": "Alert created", "alert_deleted": "Alert deleted", diff --git a/src/views/administration/notifications/Alerts.vue b/src/views/administration/notifications/Alerts.vue index f2fe2af6d..4efe1ec62 100644 --- a/src/views/administration/notifications/Alerts.vue +++ b/src/views/administration/notifications/Alerts.vue @@ -155,10 +155,6 @@ -
- - {{ $t('admin.include_children') }} -
@@ -213,7 +209,6 @@ uuid: row.uuid, name: row.name, enabled: row.enabled, - notifyChildren: row.notifyChildren, publisherClass: row.publisher.publisherClass, notificationLevel: row.notificationLevel, destination: this.parseDestination(row), @@ -235,9 +230,6 @@ enabled() { this.updateNotificationRule(); }, - notifyChildren() { - this.updateNotificationRule(); - }, notifyOn() { this.updateNotificationRule(); }, @@ -268,7 +260,6 @@ uuid: this.uuid, name: this.name, enabled: this.enabled, - notifyChildren: this.notifyChildren, notificationLevel: this.notificationLevel, publisherConfig: JSON.stringify({ destination: this.destination }), notifyOn: this.notifyOn From 2afcd3b72ad9123b036a193ab1174412d45221b9 Mon Sep 17 00:00:00 2001 From: Sahiba Mittal Date: Thu, 20 Oct 2022 16:23:16 +0100 Subject: [PATCH 5/6] add snyk version config Signed-off-by: Sahiba Mittal --- src/i18n/locales/en.json | 1 + src/shared/common.js | 2 ++ .../administration/analyzers/SnykAnalyzer.vue | 16 ++++++++++++++-- .../portfolio/vulnerabilities/Vulnerability.vue | 2 +- 4 files changed, 18 insertions(+), 3 deletions(-) diff --git a/src/i18n/locales/en.json b/src/i18n/locales/en.json index ebce57852..ff02de423 100644 --- a/src/i18n/locales/en.json +++ b/src/i18n/locales/en.json @@ -476,6 +476,7 @@ "registered_email_address": "Registered email address", "api_token": "API token", "org_id": "Organization ID", + "api_version": "API Version", "consumer_key": "Consumer key", "consumer_secret": "Consumer secret", "personal_access_token": "Personal Access Token", diff --git a/src/shared/common.js b/src/shared/common.js index b1bcecc5e..323bfa9fa 100644 --- a/src/shared/common.js +++ b/src/shared/common.js @@ -108,6 +108,8 @@ $common.formatAnalyzerLabel = function formatAnalyzerLabel(analyzer, vulnSource, analyzerUrl = "https://github.com/advisories/" + vulnId; } else if(vulnSource === "OSV") { analyzerUrl = "https://osv.dev/vulnerability/" + vulnId; + } else if(vulnSource === "SNYK") { + analyzerUrl = "https://security.snyk.io/vuln/" + vulnId; } break; case 'OSSINDEX_ANALYZER': diff --git a/src/views/administration/analyzers/SnykAnalyzer.vue b/src/views/administration/analyzers/SnykAnalyzer.vue index 3995c9ef5..6353420e8 100644 --- a/src/views/administration/analyzers/SnykAnalyzer.vue +++ b/src/views/administration/analyzers/SnykAnalyzer.vue @@ -28,6 +28,14 @@ v-model="apitoken" lazy="true" /> + @@ -66,6 +74,7 @@ return { scannerEnabled: false, apitoken: '', + apiVersion: '', baseUrl: '', orgId: '', cvssOptions: [ @@ -87,7 +96,8 @@ {groupName: 'scanner', propertyName: 'snyk.api.token', propertyValue: this.apitoken}, {groupName: 'scanner', propertyName: 'snyk.org.id', propertyValue: this.orgId}, {groupName: 'scanner', propertyName: 'snyk.base.url', propertyValue: this.baseUrl}, - {groupName: 'scanner', propertyName: 'snyk.cvss.source', propertyValue: this.cvssSourceSelected} + {groupName: 'scanner', propertyName: 'snyk.cvss.source', propertyValue: this.cvssSourceSelected}, + {groupName: 'scanner', propertyName: 'snyk.api.version', propertyValue: this.apiVersion} ]); } }, @@ -106,7 +116,9 @@ case "snyk.base.url": this.baseUrl = item.propertyValue; break; case "snyk.cvss.source": - this.cvssSourceSelected = item.propertyValue; break; + this.cvssSourceSelected = item.propertyValue; break; + case "snyk.api.version": + this.apiVersion = item.propertyValue; break; } } }); diff --git a/src/views/portfolio/vulnerabilities/Vulnerability.vue b/src/views/portfolio/vulnerabilities/Vulnerability.vue index cae02218b..c6b89127c 100644 --- a/src/views/portfolio/vulnerabilities/Vulnerability.vue +++ b/src/views/portfolio/vulnerabilities/Vulnerability.vue @@ -175,7 +175,7 @@ case 'VULNDB': return "VulnDB (Risk Based Security)"; case 'SNYK': - return "Snyk Vulnerability"; + return "Snyk"; default: return ""; } From 839f7de2bd2bae05d652ced6cd1851f716586da3 Mon Sep 17 00:00:00 2001 From: Sahiba Mittal Date: Thu, 20 Oct 2022 17:03:08 +0100 Subject: [PATCH 6/6] add snyk api version warning Signed-off-by: Sahiba Mittal --- src/i18n/locales/en.json | 1 + src/views/administration/analyzers/SnykAnalyzer.vue | 1 + 2 files changed, 2 insertions(+) diff --git a/src/i18n/locales/en.json b/src/i18n/locales/en.json index ff02de423..30bc94292 100644 --- a/src/i18n/locales/en.json +++ b/src/i18n/locales/en.json @@ -477,6 +477,7 @@ "api_token": "API token", "org_id": "Organization ID", "api_version": "API Version", + "api_version_warning": "Warning: Changing default version may break the integration. Refer the documentation.", "consumer_key": "Consumer key", "consumer_secret": "Consumer secret", "personal_access_token": "Personal Access Token", diff --git a/src/views/administration/analyzers/SnykAnalyzer.vue b/src/views/administration/analyzers/SnykAnalyzer.vue index 6353420e8..6c450b5d2 100644 --- a/src/views/administration/analyzers/SnykAnalyzer.vue +++ b/src/views/administration/analyzers/SnykAnalyzer.vue @@ -36,6 +36,7 @@ v-model="apiVersion" lazy="true" /> + {{ $t('admin.api_version_warning') }}