FoD plugin does not honor environment variables #142
Labels
Comments
c0d3m0nky
pushed a commit
that referenced
this issue
Mar 13, 2024
…te,Workflow). (#118) * DAST Support Model class - Phase 1 commits * DAST Support Model class - Phase 1 commits * Support for DAST Scan Phase 2 Check in for Website and Workflow scan. * Dast Workflow Driven Scan from Jenkin phase 3 * Dast Workflow Driven Scan from Jenkin phase 3 cont.. * DAST Support for WorkflowDriven Phase 3 - Code changes for networkAuth settings, Patch File upload. * DAST WorkflowDrivenMacro scan setting saving phase 3 * Support for DAST Workflow driven Macro Scan type Phase 4 * DASt Support for Dynamic scan settings. Phase 3 * DAST Support for Website & Workflow Settings Phase 4 - UI validation coverage. * DAST Support for Creating Application and Release from Plugin. * DASt Support Code refactor for Workflow Driven API. * DAST Support for Free Style Template (WebSite & workflow driven) Phase 4 drop contd. Code refactored on request model to align with latest API changes. code refactored on JS files (removed debugger and console where it is not required). Added Allowed workflowDrivenMacro host UI to capture the selected host list passed onto back end. Code refactored on the Dynamic Descriptor file. @DataBoundContext. Code refactored on the Controller Code part to Parse the FOD API Response. Control Visibility for restrictToDirectoryAndSubdirectories based on scan type. * DAST Support for Free Style WebSite and Workflow Driven Removed geoloc API Removed network checkbox checked attribute. * DAST support for Website and Workflow driven reset the n/w auth type to first default on resetting. reset the login macro Id hidden field on Auth resetting when the scan type changed. * Removed Drop down control for TimeBox Scan Removed FOd Enum for Time box scan Refactored code in DAST Controller. * DAST Time box control UI change * Added Overload for Retrieve the scan settings from API.JS * DAST <Free Style>Support Code refactored. * DAST Support clear the allowed host list when binding values to UI in JavaScript method. * DAST Support [Removed http/https & Form crawling UI changes, and Back end] * DAST Support [Removed http/https & Form crawling UI changes, and Back end] * DAST support Mere conflict resolved. * DAST Workflow Macro File upload JS code Refactor. * [DAST Website & Workflow Driven] Code refactored for Website and Workflow Driven & Req Model to include Enable Page redundant. * DAST Support for Website and workflowMacro Driven scan-Code refactored. * DAST Support for WebSite Scan Fix for (Field Time box scan not reflected at Code behind ) * Rename Dynamic to DAST. * DAST Support - Rename from Dynamic to DAST * DAST Pipeline Support * Dast support api changes (#119) * API Changes for DAST Automated Changes * API Changes for url values * Removing All debuggers and requested changes --------- Co-authored-by: Krishna Chandak <[email protected]> * DAST Pipeline Support For WebSite and Workflow Macro Scan Types * DAST Support for Website|WorkflowDriven|API scan type. Changes: 1. Refactored code identified with review comments and pipeline changes. 2. Merged with API patch list from DAST API branch. * DAST Pipeline Support for WebSite|Workflow driven * DAST Pipeline Support for WebSite and Workflow Macro * DAST PipelineSupport for website and workflow driven. * DAST Pipeline for Website and Workflow * DAST Support Code Review comments addressed from PR fod-dev#118 Controller code refactored to handle InternalServer Error with error msg passed from Fod API. Added Model validation for Website and Workflow. Request model refactored for scan Policy type. Refactored DAST Model. * DAST Support - Modified the GET Response model for retrieving the saved website scan settings. * DAST Support for Pipeline Changed SharedBuild Step and Job model to accommodate overload ctor for pipeline. * Highligted mandatory fields and added spinner for file uploads with upload status message for Dast Automated form in post build action. * [DAST Support for pipeline for API Scan Types] [Code Refactored for DAST Free Style] * [DAST Pipeline API Scan type] * [DAST Pipeline Support for Website and Workflow Scan] * [DAST Support ] For Pipeline Website included hidden field for loginMacroFileId. Include allow host check/uncheck for Free Style. * [DAST Pipeline] POST Construct Attribute Method to segregate the save PUT API call during the Build Step. Only POST is invoke during the Build Job as part of perform. * [Dast Pipeline Support] Added Selection of Network and TimeBox Scan optional block if the values are present. Added PostConstruct method to save the scan settings instead of saving in the build step. Added Auto check for the optional block fields. * [DAST Pipeline] Refactored for supporting ctor overload for DastSharedBuildStep and Dast Jobmodel. * Pipeline code for Dast API Patch (#120) * Pipeline code for Dast API Patch * Pipeline code for Dast API Patch --------- Co-authored-by: Krishna Chandak <[email protected]> * [T-502002][T-505003] Added validation for Dast Pipeline and spinner for Release Id change (#121) * [DAST Support] 1. Code to allow file upload from the Remote/slave Jenkin server where build executes. 2. Code to include the log msg from remote server. 3. Code refactored identified from debugging. 4. Code review comments addressed. * [Dast Support] Fix for renaming and descriptor file path change * [Dast Support] Fix for Logging error msg from perform build function. * Adding assessmentCategory and Fixes for pipeline (#124) Co-authored-by: Krishna Chandak <[email protected]> * [T-502002] Added file extension validation for all Dast API type File Path. * [Dast Support] Rename caused issue with FreeStyle template to load, fixes for renaming. * [Dast Support FreeStyle] Fix 1. For hiding enable redundant pages selection for workflow scan. 2. Fix for Application and release Type Selection Remove BSI (BSI token not supported for DAST) 3. Removed Debugger tag from pipeline script. * [Dast Support] Fix for FreeStyle load issue caused because of renaming from DASTFreeStyle to FreeStyle * Dast support file (#126) * [T-508014] Display uploaded file name * [T-508014] File name in upload --------- Co-authored-by: Krishna Chandak <[email protected]> * [DAST Support] Fixes for 1. File uploading in remote execution 2. Improved logging to support remote execution. 3. Refactored code for parsing the FOD API response into specific response model from Jenkin model class. 4. Refactored request model removed public fields which have the pub set attributes. Use Public Setter. 5. Include Serializable attribute to support remote serialization at executing node. 6. Added await to JS methods where the API invoked. 7. Refactored DastSharedBuildStep class to create API based on the workspace (local/remote). * [DAST Support] Included the uploadedFileDetails class and scope contained div Styles got overridden due to merge. * [DAST Support] Pipeline Auto Prov feature code fixes. https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=task&id=509001 * Fixes: FOD API Connect not null Error message. Serialization error that happened post saving the scan settings from FortifyDastFreeStyleBuildStep. Refactored the Workflow Scans Setting Save msg - removed redundant page param. Refactored network Auth Password and net Auth user name in DASt Free Style jelly file. * Addition features for FOD (#128) Co-authored-by: Krishna Chandak <[email protected]> * [DAST Support] Addressed Code review comments Dated 02-JAN-2024 and code fixes for 1. Pipeline Template Override Release Setting Entitlement freq not set. 2. Exception object been used at the place of Error in JS at PAi scan types- Refactored. 3. Refactored Magic Strings used in switch case block to Fod Enum - Code Review Change. 4. Added Null check for Add on service in pipeline logic - fix null pointer exception. 5. Added generic response handler in case of failure response from the Application Creation controller part of Auto Prov. 6. Added allowed host filed into DAST Job model for Validating. 7. Refactored null and undefined check in JS file - Code review Change. 8. Deleted Stale Start scan request model Java file - Code review Change. * [DAST Support] Fix for bug Where the Validation for Text box failed because of renaming the network username/password html id. removed alert & debugger added as part of debugging. * [DAST Support] Include null and empty string in job model validation. * Fixing issues related to API Scan for Pipeline (#129) * Fixing issues * Validation and Patch endpoint changes * Fixing show/hide for File Details * Removing logging --------- Co-authored-by: Krishna Chandak <[email protected]> * [Dast Support] Change the JQuery $ sign to JQ to fix jS script issue happening with latest Jenkin version 2.4+ * [Dast Support] Removed dead code in JS file. * [DAST Support] Reverting Jq to $ in windows on load, As it breaking the code for Creating new Application dialogue from FreeStyle. * [US-147008]/T[514001] Added validations * Revert "[US-147008]/T[514001] Added validations" Reverting the validation changes done in the jelly files as it breaks selected scan type selection and Optional block loading for login macro file upload. * Additional Services and API scan visibility fixes (#131) Co-authored-by: Krishna Chandak <[email protected]> * [DAST Support] Fix for 1.JS Issue LoginMacroCreationField is null (added null check). 2. hide Scan policy in Pipeline shown without override. 3. Commented out the UserUploadedFile F:entry section. Should show this only when uploaded file info is available. 4. Common.js JQ[This.dialogId] is not working in latest version of Jenkin, Replaced back to $ sign. * [Dast Support] Fix for Hiding the Login Macro optional block in case of other scan type selected. * Addition services refactoring (#132) * Addition services refactoring * Removing assignment as it is not required * Update DastFreeStyle.js * Update DastPipelineGenerator.js --------- Co-authored-by: Krishna Chandak <[email protected]> * [DAST Support] Fixes for 1. Exclude URL UI and back end code, Removal of Items from Excluded URl list. 2. election of Release Id Instead of choosing through the application and release dialog, Release Id entered not passed onto back end and scan fails. 3. DAST Pipeline Load the Scan configuration through the release Id selection, In case of scan type is Workflow - Controls related to website are visible. 4. Code refactor to Validation model. 5. code refactor on response and request models. * [DAST Support] Fixes: 1. Added RequireSiteAuthentication to true when login Macro File is set. 2. Added validation for time-zone and entitlement frequency. * Hiding upload file info (#133) Co-authored-by: Krishna Chandak <[email protected]> * [DAST Support] Fix for removing the Allowed Host List when the selection model changed from Release ID to Auto Prov. Changed the release version to 8.0 aligning with Fod Jenkin Release * [DAST Support] Fixes for [D-1598011] [US-993004] Unable to save scan … (#134) * [DAST Support] Fixes for [D-1598011] [US-993004] Unable to save scan settings with API scan type. Refactored Catch block and logging the error from FOD API response. * Added Excepted Exception Type (IO exception to Method signature) --------- Co-authored-by: vivek <[email protected]> * [DASTSupport] Defect fixes for (#136) * [DASTSupport] Defect fixes for https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=work_item&id=1600001 https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=work_item&id=1597005 https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=work_item&id=1600002 https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=work_item&id=1598003 https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=work_item&id=1602001 https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=work_item&id=1603006 https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=work_item&id=1606012 * Removed Alert message * [DAST Support] Fix for Invalid Login Macro Id error https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=work_item&id=1599013 Validation is triggered because of RequireSiteAuthentication set to true whenever the network authentication is set. where as RequireSiteAuthentication is independent. --------- Co-authored-by: vivek <[email protected]> * [Dast Support] Fix for Network Auth Setting Visibility in case of API scan Type. * UI fixes for Jenkins freestyle and pipeline * Added null check for ScancontrolVisibility * Update DastPipelineGenerator.js * Modified Environment Facing Value to default External. * [DAST Support] Fix for (#138) * [DAST Support] Fix for https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=work_item&id=1600002 https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=work_item&id=1597005 https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=work_item&id=1610011 * [DAST Support] Fix for https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=work_item&id=1606006 --------- Co-authored-by: vivek <[email protected]> * [D-1598002] Fixed website scan scope restriction issue * Removed unwanted code. * Removed debuggers and added info for scan scope * [D-1601013] Fixed issue related Timebox for API Scan. * [DAST Support] Fix for (#141) * [DAST Support] Fix for https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=work_item&id=1597005 https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=work_item&id=1598027 * Fix for DAST Support - removed console.log https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=work_item&id=1597005 https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=work_item&id=1598027 * Fix for DAST Support removed console.log https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=work_item&id=1597005 https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=work_item&id=1598027 --------- Co-authored-by: vivek <[email protected]> * [DAST Support] 8.0 Fix for https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=work_item&id=1597005 (#142) https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=work_item&id=1619002 Co-authored-by: vivek <[email protected]> * [DAST Support] Fix for https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=work_item&id=1612002 https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=work_item&id=1620007 (#143) * [DAST Support] Fix for https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=work_item&id=1612002 https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=work_item&id=1620007 * [Dast Support] Fix for https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=work_item&id=1620007 --------- Co-authored-by: vivek <[email protected]> * [DAST Support] Fix for displaying workflows file name display. https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=work_item&id=1612002 * [BuildToolSupport] Add dotnet as one of scan Central build tool (#144) * Fix for Dot net build tool and Assessment Type selection. * [Dast Support] Fix for DotNet Build Tool Addition and Creation of Application and Release assessment drop down not populated * [BuildToolSupport] Adding 'dotnet" build tool for static Scan --------- Co-authored-by: vivek <[email protected]> * [D-1621018] Resolved issue of creating new release for existing application * Removed unnecessary import. * [DAST Support] Fix for https://almoctane-ams.saas.microfocus.com/ui/entity-navigation?p=112082/7001&entityType=work_item&id=1620019 * [D-1622018] Fixed issue for 'Assign to Me' function not capturing ownerId when perform Generate pipeline script * [DAST Support] Fix for the spinner CSS loading issue in Jenkin 2.414.3 version. * [DAST Support] Reverting the CSS fix made on spinner. Until we get go green on applying this fix to master. --------- Co-authored-by: vivek <[email protected]> Co-authored-by: krchandak <[email protected]> Co-authored-by: Krishna Chandak <[email protected]> Co-authored-by: amar <[email protected]> Co-authored-by: amar-s-math <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Jenkins and plugins versions report
Environment
What Operating System are you using (both controller, and any agents involved in the problem)?
Reproduction steps
It seems the
fodStaticAssessmentstep does not honor theJAVA_HOMEenvironment variable, even though it's defined in Jenkins and on the machine for all users.This issue occurs with both a freestyle project and a pipeline project. In the case of a pipeline project, here is my pipeline script:
Pipeline Script
pipeline { agent any tools { maven "Maven (Latest)" jdk "JDK 17" } stages { stage('Get code') { steps { // Get code from GitHub repo git branch: 'v8.2.2', changelog: false, poll: false, url: 'https://github.com/micro-focus/FoD-WebGoat.git' // Test Java version sh "echo Testing java" sh "java -version" } } stage('Run Static Assessment') { tools { jdk "JDK 17" } steps { sh "echo JAVA_HOME=$JAVA_HOME" sh "echo PATH=$PATH" fodStaticAssessment applicationName: '', applicationType: '', assessmentType: '', attributes: '', auditPreference: '', bsiToken: '', businessCriticality: '', entitlementId: '', entitlementPreference: '', frequencyId: '', inProgressBuildResultType: 'FailBuild', inProgressScanActionType: 'Queue', isMicroservice: false, languageLevel: '', microserviceName: '', openSourceScan: '', overrideGlobalConfig: false, personalAccessToken: '', releaseId: '<redacted>', releaseName: '', remediationScanPreferenceType: 'RemediationScanIfAvailable', scanCentral: 'Maven', scanCentralBuildCommand: '', scanCentralBuildFile: '', scanCentralBuildToolVersion: '', scanCentralIncludeTests: '', scanCentralRequirementFile: '', scanCentralSkipBuild: '', scanCentralVirtualEnv: '', sdlcStatus: '', srcLocation: '.', technologyStack: '', tenantId: '', username: '' } } stage('Poll Results') { tools { jdk "JDK 17" } steps { fodPollResults bsiToken: '', personalAccessToken: '<redacted>', pollingInterval: 1, releaseId: '<redacted>', tenantId: '<redacted>', username: '' } } } }Expected Results
JAVA_HOMEwould be resolvable byscancentraland thefodStaticAssessmentstep would succeed.Actual Results
Here is a relevant snippet of the console output:
Console Output
Notice that
scancentralreportsJAVA_HOME: null, even though right before thefodStaticAssessmentstep, the commandecho JAVA_HOME=$JAVA_HOMEoutputted the correct value:Anything else?
A similar issue existed with the regular Fortify plugin, but the developer (Anna K) was able to figure out the solution. ("It turned out that we didn't take env overrides into account for our pipelines.")
The text was updated successfully, but these errors were encountered: