VulnerabilityTrendStep.java

package com.aspectsecurity.contrast.contrastjenkins;

import com.contrastsecurity.http.TraceFilterForm;
import com.contrastsecurity.models.Traces;
import com.contrastsecurity.sdk.ContrastSDK;
import com.google.inject.Inject;
import hudson.AbortException;
import hudson.Extension;
import hudson.model.Result;
import hudson.model.Run;
import hudson.model.TaskListener;
import hudson.util.ListBoxModel;
import jenkins.model.Jenkins;
import lombok.Getter;
import org.jenkinsci.plugins.workflow.steps.*;
import org.kohsuke.stapler.DataBoundConstructor;
import org.kohsuke.stapler.DataBoundSetter;
import org.kohsuke.stapler.QueryParameter;

import java.io.IOException;
import java.util.Collections;
import java.util.Map;

@Getter
public class VulnerabilityTrendStep extends AbstractStepImpl {

    private String profile;

    @DataBoundSetter
    public void setProfile(String profile) {
        this.profile = profile;
    }

    private int count;

    @DataBoundSetter
    public void setCount(int count) {
        this.count = count;
    }

    private String rule;

    @DataBoundSetter
    public void setRule(String rule) {
        this.rule = rule;
    }

    private String severity;

    @DataBoundSetter
    public void setSeverity(String severity) {
        this.severity = severity;
    }

    private String applicationId;

    @DataBoundSetter
    public void setApplicationId(String applicationId) {
        this.applicationId = applicationId;
    }

    private String applicationName;

    @DataBoundSetter
    public void setApplicationName(String applicationName) {
        this.applicationName = applicationName;
    }

    private int queryBy;

    @DataBoundSetter
    public void setQueryBy(int queryBy) {
        this.queryBy = queryBy;
    }

    @DataBoundConstructor
    public VulnerabilityTrendStep(String profile, int count, String rule, String severity, String applicationId, int queryBy) {
        this.profile = profile;
        this.count = count;
        this.rule = rule;
        this.severity = severity;
        this.applicationId = applicationId;
        this.queryBy = queryBy;
    }

    // Used to build the new instance
    public VulnerabilityTrendStep() {

    }

    @Override
    public VulnerabilityTrendStepDescriptorImpl getDescriptor() {
        Jenkins instance = Jenkins.getInstance();

        if (instance != null) {
            return (VulnerabilityTrendStepDescriptorImpl) instance.getDescriptor(getClass());
        } else {
            return null;
        }
    }

    @Extension
    public static class VulnerabilityTrendStepDescriptorImpl extends AbstractStepDescriptorImpl {

        public VulnerabilityTrendStepDescriptorImpl() {
            super(Execution.class);
        }

        @Override
        public String getFunctionName() {
            return "contrastVerification";
        }

        @Override
        public String getDisplayName() {
            return "Verify vulnerabilities in a build";
        }

        @Override
        public Step newInstance(Map<String, Object> arguments) {
            VulnerabilityTrendStep step = new VulnerabilityTrendStep();

            if (arguments.containsKey("profile")) {
                Object profile = arguments.get("profile");

                if (profile != null) {
                    step.setProfile((String) profile);
                } else {
                    throw new IllegalArgumentException("Profile must be set.");
                }
            }

            if (arguments.containsKey("count")) {
                Object count = arguments.get("count");

                if (count != null) {
                    step.setCount((int) count);
                } else {
                    throw new IllegalArgumentException("Count must be set.");
                }
            }

            if (arguments.containsKey("rule")) {
                Object rule = arguments.get("rule");

                step.setRule((String) rule);
            }

            if (arguments.containsKey("severity")) {
                Object severity = arguments.get("severity");

                step.setSeverity((String) severity);
            }

            if (arguments.containsKey("applicationId")) {
                Object applicationId = arguments.get("applicationId");

                if (applicationId != null) {
                    step.setApplicationId((String) applicationId);
                } else {
                    throw new IllegalArgumentException("Application ID must be set.");
                }

            }

            if (arguments.containsKey("applicationName")) {
                Object applicationName = arguments.get("applicationName");

                if (applicationName != null) {
                    step.setApplicationName((String) applicationName);
                } else {
                    throw new IllegalArgumentException("Application name must be set.");
                }
            }

            if (arguments.containsKey("queryBy")) {
                Object queryBy = arguments.get("queryBy");

                step.setQueryBy((int) queryBy);
            }

            return step;
        }

        @SuppressWarnings("unused")
        public ListBoxModel doFillProfileItems() {
            return VulnerabilityTrendHelper.getProfileNames();
        }

        /**
         * Fills the Threshold Category select drop down with application ids.
         *
         * @return ListBoxModel filled with application ids.
         */
        public ListBoxModel doFillApplicationIdItems(@QueryParameter("profile") final String teamServerProfileName) throws IOException {
            return VulnerabilityTrendHelper.getApplicationIds(teamServerProfileName);
        }

        @SuppressWarnings("unused")
        public ListBoxModel doFillRuleItems(@QueryParameter("profile") final String teamServerProfileName) {
            return VulnerabilityTrendHelper.getVulnerabilityTypes(teamServerProfileName);
        }

        @SuppressWarnings("unused")
        public ListBoxModel doFillSeverityItems() {
            return VulnerabilityTrendHelper.getSeverityListBoxModel();
        }
    }

    public static class Execution extends AbstractSynchronousStepExecution<Void> {
        private static final long serialVersionUID = 1L;

        @StepContextParameter
        transient Run<?, ?> build;

        @StepContextParameter
        transient TaskListener taskListener;

        @Inject
        transient VulnerabilityTrendStep step;

        @Override
        public Void run() throws AbortException {

            TeamServerProfile teamServerProfile = VulnerabilityTrendHelper.getProfile(step.getProfile());

            if (teamServerProfile == null) {
                VulnerabilityTrendHelper.logMessage(taskListener, "Unable to find TeamServer profile.");
                throw new AbortException("Unable to find TeamServer profile.");
            }

            //// Compatibility fix for plugin versions <=2.6
            if (step.getApplicationId() == null && step.getApplicationName() != null) {
                for (App app : teamServerProfile.getApps()) {
                    String subStr = app.getTitle().substring(0, app.getTitle().lastIndexOf(" ("));
                    if (subStr.equals(step.getApplicationName())) {
                        step.setApplicationId(app.getName());
                        break;
                    }
                }
            }

            VulnerabilityTrendHelper.logMessage(taskListener, "Checking the number of vulnerabilities for " + step.getApplicationId());
            ContrastSDK contrastSDK = VulnerabilityTrendHelper.createSDK(teamServerProfile.getUsername(), teamServerProfile.getServiceKey(),
                    teamServerProfile.getApiKey(), teamServerProfile.getTeamServerUrl());

            boolean applicationIdExists = VulnerabilityTrendHelper.applicationIdExists(contrastSDK, teamServerProfile.getOrgUuid(), step.getApplicationId());
            if (!applicationIdExists) {
                VulnerabilityTrendHelper.logMessage(taskListener, "Application with ID '" + step.getApplicationId() + "' not found.");
                if (teamServerProfile.isFailOnWrongApplicationId()) {
                    throw new AbortException("Application with ID '" + step.getApplicationId() + "' not found.");
                }
            }

            Traces traces;

            String stepString = step.buildStepString();

            VulnerabilityTrendHelper.logMessage(taskListener, "Checking the step condition where " + stepString);

            try {
                TraceFilterForm filterForm = new TraceFilterForm();

                if (step.getQueryBy() == Constants.QUERY_BY_APP_VERSION_TAG_HIERARCHICAL_FORMAT) {
                    filterForm.setAppVersionTags(Collections.singletonList(VulnerabilityTrendHelper.buildAppVersionTagHierarchical(build, step.getApplicationId())));
                } else if (step.getQueryBy() == Constants.QUERY_BY_START_DATE) {
                    filterForm.setStartDate(build.getTime());
                } else {
                    filterForm.setAppVersionTags(Collections.singletonList(VulnerabilityTrendHelper.buildAppVersionTag(build, step.getApplicationId())));
                }

                if (step.getSeverity() != null) {
                    filterForm.setSeverities(VulnerabilityTrendHelper.getSeverityList(step.getSeverity()));
                }

                if (step.getRule() != null) {
                    filterForm.setVulnTypes(Collections.singletonList(step.getRule()));
                }
                if (step.getQueryBy() == Constants.QUERY_BY_START_DATE) {
                    traces = contrastSDK.getTraces(teamServerProfile.getOrgUuid(), step.getApplicationId(), filterForm);
                } else {
                    traces = contrastSDK.getTracesInOrg(teamServerProfile.getOrgUuid(), filterForm);
                }
            } catch (Exception e) {
                VulnerabilityTrendHelper.logMessage(taskListener, e.getMessage());
                throw new AbortException("Unable to retrieve vulnerability information from TeamServer.");
            }

            if (traces.getCount() > step.getCount()) {
                Result buildResult = Result.fromString(teamServerProfile.getVulnerableBuildResult());
                VulnerabilityTrendHelper.logMessage(taskListener, "Failed on the condition where " + stepString);
                VulnerabilityTrendHelper.logMessage(taskListener, VulnerabilityTrendHelper.getVulnerabilityInfoString(traces));
                if (buildResult.toString().equals(Result.FAILURE.toString())) {
                    throw new AbortException("Failed on the condition where " + stepString);
                } else {
                    build.setResult(buildResult);
                    return null;
                }

            }

            VulnerabilityTrendHelper.logMessage(taskListener, "This step has passed successfully");

            return null;
        }

        String getBuildName() {
            return build.getParent().getDisplayName();
        }
    }

    private String buildStepString() {
        StringBuilder sb = new StringBuilder();

        sb.append("count is ").append(count);

        if (severity != null) {
            sb.append(", severity is ").append(severity);
        }

        if (rule != null) {
            sb.append(", rule type is ").append(rule);
        }

        if (applicationId != null) {
            sb.append(", applicationId is ").append(applicationId);
        }

        if (queryBy != 0) {
            sb.append(", queryBy is ").append(queryBy);
        }

        sb.append(".");

        return sb.toString();
    }
}