-
Bug
-
Resolution: Unresolved
-
Minor
I get the following message when trying to scan code on our jenkins server using the plugin mentioned above:
Static Analyzer has determined that you are only scanning third party code. To enable the scanning of third party code, regenerate the IRX file using the --thirdParty option.
ERROR: Failed to run the security scan: Problems occurred generating the IRX file. See /home/ibmadmin/rpcatal/Spark-DK/core/SparkyScan_2018-07-27_15-37-04_logs.zip for details.
Finished: FAILURE
Since this --thirdparty command is to be issued on the command line before the IRX file is generated, I have no way of doing this. There should be an option, like a checkbox or something in the build step for this plugin that allows you to specify whether or not the code is third party so the code scan can run.
[JENKINS-52803] IBM Application Security on Cloud plugin does not currently allow for third party code to be scanned
Kevin Fealey
added a comment - Hi Robert,
Are you trying to create the IRX file to scan with Cloud? While it would be nice to update the plugin for that use case, I'm currently the only maintainer (I don't work for IBM), and I do not have the availability to do it at the moment, mostly because I do not have an environment available to test the latest version. If you're interested in contributing to the project, the github repo is here: https://github.com/jenkinsci/ibm-security-appscansource-scanner-plugin
It would probably be a fairly easy update to add the checkbox and --thirdparty option. From a quick check, here's what I think you'd need to do:
- add the checkbox here: https://github.com/jenkinsci/ibm-security-appscansource-scanner-plugin/blob/master/src/main/resources/com/aspectsecurity/automationservices/plugins/jenkins/appscansource/AppScanSourceBuilder/config.jelly
- Set the checkbox value here: https://github.com/jenkinsci/ibm-security-appscansource-scanner-plugin/blob/master/src/main/java/com/aspectsecurity/automationservices/plugins/jenkins/appscansource/AppScanSourceBuilder.java in AppScanSourceBuilder (the DataBoundConstructor)
- then add the --thirdparty option to the cliScriptContent variable within in a conditional block in the perform method.
That's assuming that the rest of the command would remain the same... if you're going to push it to Cloud scan, you may want to execute a different command entirely - I haven't used that part of the CLI, so I don't know.
Anyway, if you want to modify the code, test it, and submit a pull request, I'll merge it in - maybe another branch, since I may not be able to test it myself..
Kevin Fealey
added a comment - Hi Robert,
Are you trying to create the IRX file to scan with Cloud? While it would be nice to update the plugin for that use case, I'm currently the only maintainer (I don't work for IBM), and I do not have the availability to do it at the moment, mostly because I do not have an environment available to test the latest version. If you're interested in contributing to the project, the github repo is here: https://github.com/jenkinsci/ibm-security-appscansource-scanner-plugin
It would probably be a fairly easy update to add the checkbox and --thirdparty option. From a quick check, here's what I think you'd need to do:
add the checkbox here: https://github.com/jenkinsci/ibm-security-appscansource-scanner-plugin/blob/master/src/main/resources/com/aspectsecurity/automationservices/plugins/jenkins/appscansource/AppScanSourceBuilder/config.jelly
Set the checkbox value here: https://github.com/jenkinsci/ibm-security-appscansource-scanner-plugin/blob/master/src/main/java/com/aspectsecurity/automationservices/plugins/jenkins/appscansource/AppScanSourceBuilder.java in AppScanSourceBuilder (the DataBoundConstructor)
then add the --thirdparty option to the cliScriptContent variable within in a conditional block in the perform method.
That's assuming that the rest of the command would remain the same... if you're going to push it to Cloud scan, you may want to execute a different command entirely - I haven't used that part of the CLI, so I don't know.
Anyway, if you want to modify the code, test it, and submit a pull request, I'll merge it in - maybe another branch, since I may not be able to test it myself.. 
Hey, just wondering if any progress has been made on this? I'm happy to assist in solving this issue with the plugin if need be.