ON_IRRELEVANT_RESULT = Topic.create(\"Source code changed\", AnnotationEvents.class);\n\n /**\n * Called when the selected file is modified.\n */\n void update(String filePath);\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/events/ApplicationEvents.java",
"content": "package com.jfrog.ide.idea.events;\n\nimport com.intellij.util.messages.Topic;\n\n/**\n * Application based events.\n * \n * Created by romang on 3/5/17.\n */\npublic interface ApplicationEvents {\n // Scan started\n Topic ON_SCAN_LOCAL_STARTED = Topic.create(\"Local scan started\", ApplicationEvents.class);\n Topic ON_SCAN_LOCAL_CANCELED = Topic.create(\"Local scan canceled\", ApplicationEvents.class);\n Topic ON_SCAN_CI_STARTED = Topic.create(\"CI scan started\", ApplicationEvents.class);\n\n // Configuration changed\n Topic ON_CONFIGURATION_DETAILS_CHANGE = Topic.create(\"Configuration details changed\", ApplicationEvents.class);\n Topic ON_BUILDS_CONFIGURATION_CHANGE = Topic.create(\"Builds configuration changed\", ApplicationEvents.class);\n\n // Filter changed\n Topic ON_CI_FILTER_CHANGE = Topic.create(\"CI issues changed\", ApplicationEvents.class);\n\n /**\n * Called when a scan started, a configuration changed or a filter changed.\n */\n void update();\n\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/events/BuildEvents.java",
"content": "package com.jfrog.ide.idea.events;\n\nimport com.intellij.util.messages.Topic;\nimport com.jfrog.ide.common.ci.BuildGeneralInfo;\n\n/**\n * Project based events.\n *\n * @author yahavi\n */\npublic interface BuildEvents {\n Topic ON_SELECTED_BUILD = Topic.create(\"Build selected\", BuildEvents.class);\n\n /**\n * Called when the selected build is modified.\n */\n void update(BuildGeneralInfo generalInfo);\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/events/ProjectEvents.java",
"content": "package com.jfrog.ide.idea.events;\n\nimport com.intellij.util.messages.Topic;\nimport com.jfrog.ide.common.utils.ProjectsMap;\n\n/**\n * Project based events.\n *\n * @author yahavi\n */\npublic interface ProjectEvents {\n Topic ON_SCAN_CI_CHANGE = Topic.create(\"CI changed\", ProjectEvents.class);\n\n /**\n * Called when the store of issues in changed files is modified. It is modified only as a result of a user action to analyse all changed files.\n */\n void update(ProjectsMap.ProjectKey projectKey);\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/exclusion/Excludable.java",
"content": "package com.jfrog.ide.idea.exclusion;\n\nimport com.intellij.openapi.project.Project;\n\n/**\n * Created by Bar Belity on 28/05/2020.\n */\npublic interface Excludable {\n\n /**\n * Exclude from project-descriptor.\n */\n void exclude(Project project);\n\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/exclusion/ExclusionUtils.java",
"content": "package com.jfrog.ide.idea.exclusion;\n\nimport com.jfrog.ide.idea.navigation.NavigationTarget;\nimport org.jfrog.build.extractor.scan.DependencyTree;\n\n/**\n * Created by Bar Belity on 28/05/2020.\n */\npublic class ExclusionUtils {\n\n /**\n * Check if a specific node from the Dependencies-tree can be excluded from project-descriptor.\n *\n * @param nodeToExclude - The node in tree to exclude.\n * @param affectedNode - Direct dependency's node in tree which will be affected by the exclusion.\n * @return true if the provided nodeToExclude can be excluded from project-descriptor.\n */\n public static boolean isExcludable(DependencyTree nodeToExclude, DependencyTree affectedNode) {\n return MavenExclusion.isExcludable(nodeToExclude, affectedNode);\n }\n\n /**\n * Get the corresponding Excludable object for the node to exclude.\n *\n * @param nodeToExclude - The node in tree to exclude.\n * @param navigationTarget - The navigation-target of the node to exclude.\n * @return the corresponding Excludable object, Null if exclusion is not supported for this node.\n */\n public static Excludable getExcludable(DependencyTree nodeToExclude, DependencyTree affectedNode, NavigationTarget navigationTarget) {\n if (MavenExclusion.isExcludable(nodeToExclude, affectedNode)) {\n return new MavenExclusion(nodeToExclude, navigationTarget);\n }\n return null;\n }\n\n /**\n * Find node's root project node.\n * In single project tree - the root's parent is null.\n * In multi project tree - the root-parent's general info is null.\n * @param node - DependencyTree node to find its project's root.\n * @return the project root node.\n */\n public static DependencyTree getProjectRoot(DependencyTree node) {\n if (node == null) {\n return null;\n }\n while (node.getParent() != null && ((DependencyTree) node.getParent()).getGeneralInfo() != null) {\n node = (DependencyTree) node.getParent();\n }\n return node;\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/exclusion/MavenExclusion.java",
"content": "package com.jfrog.ide.idea.exclusion;\n\nimport com.intellij.openapi.command.WriteCommandAction;\nimport com.intellij.openapi.project.Project;\nimport com.intellij.pom.Navigatable;\nimport com.intellij.psi.PsiElement;\nimport com.intellij.psi.PsiFile;\nimport com.intellij.psi.PsiManager;\nimport com.intellij.psi.xml.XmlFile;\nimport com.intellij.psi.xml.XmlTag;\nimport com.jfrog.ide.idea.inspections.MavenInspection;\nimport com.jfrog.ide.idea.navigation.NavigationTarget;\nimport org.jfrog.build.extractor.scan.DependencyTree;\n\n/**\n * Created by Bar Belity on 28/05/2020.\n */\npublic class MavenExclusion implements Excludable {\n\n public static final String MAVEN_EXCLUSIONS_TAG = \"exclusions\";\n public static final String MAVEN_EXCLUSION_TAG = \"exclusion\";\n private final DependencyTree nodeToExclude;\n private final NavigationTarget navigationTarget;\n\n public MavenExclusion(DependencyTree nodeToExclude, NavigationTarget navigationTarget) {\n this.nodeToExclude = nodeToExclude;\n this.navigationTarget = navigationTarget;\n }\n\n /**\n * Walk up the dependencies-tree to validate that the project's root is of type 'Maven'.\n * This is required as dependency nodes in 'Gradle' projects are also of type 'Maven', and dependency nodes\n * can have type 'null'.\n * @param nodeToExclude - The node in tree to exclude.\n * @param affectedNode - Direct dependency's node in tree which will be affected by the exclusion.\n * @return true if nodeToExclude is a valid Maven node which can be excluded.\n */\n public static boolean isExcludable(DependencyTree nodeToExclude, DependencyTree affectedNode) {\n if (nodeToExclude == null || nodeToExclude.equals(affectedNode)) {\n return false;\n }\n return isMavenPackageType(ExclusionUtils.getProjectRoot(nodeToExclude));\n }\n\n public static boolean isMavenPackageType(DependencyTree node) {\n return node != null && node.getGeneralInfo() != null && \"maven\".equals(node.getGeneralInfo().getPkgType());\n }\n\n @Override\n public void exclude(Project project) {\n PsiFile psiFile = PsiManager.getInstance(project).findFile(navigationTarget.getElement().getContainingFile().getVirtualFile());\n if (!(psiFile instanceof XmlFile)) {\n return;\n }\n XmlFile file = (XmlFile) psiFile;\n\n WriteCommandAction.writeCommandAction(project, file).run(() -> {\n String groupId = nodeToExclude.getGeneralInfo().getGroupId();\n String artifactId = nodeToExclude.getGeneralInfo().getArtifactId();\n if (!(navigationTarget.getElement() instanceof XmlTag)) {\n return;\n }\n XmlTag xmlElement = (XmlTag) navigationTarget.getElement();\n navigateToElement(xmlElement);\n XmlTag exclusionsTag = xmlElement.findFirstSubTag(MAVEN_EXCLUSIONS_TAG);\n if (exclusionsTag == null) {\n exclusionsTag = xmlElement.createChildTag(MAVEN_EXCLUSIONS_TAG, \"\", \"\", false);\n createAndAddExclusionTags(exclusionsTag, groupId, artifactId);\n xmlElement.addSubTag(exclusionsTag, false);\n return;\n }\n\n XmlTag[] allExclusions = exclusionsTag.findSubTags(MAVEN_EXCLUSION_TAG);\n if (exclusionExists(allExclusions, groupId, artifactId)) {\n // Don't create exclusion tag.\n return;\n }\n createAndAddExclusionTags(exclusionsTag, groupId, artifactId);\n });\n }\n\n boolean exclusionExists(XmlTag[] allExclusions, String groupId, String artifactId) {\n for (XmlTag exclusionTag : allExclusions) {\n XmlTag groupIdTag = exclusionTag.findFirstSubTag(MavenInspection.MAVEN_GROUP_ID_TAG);\n if (groupIdTag == null || !groupId.equals(groupIdTag.getValue().getText())) {\n continue;\n }\n XmlTag artifactIdTag = exclusionTag.findFirstSubTag(MavenInspection.MAVEN_ARTIFACT_ID_TAG);\n if (artifactIdTag != null && artifactId.equals(artifactIdTag.getValue().getText())) {\n return true;\n }\n }\n return false;\n }\n\n void createAndAddExclusionTags(XmlTag exclusionsTag, String groupId, String artifactId) {\n XmlTag exclusionTag = exclusionsTag.createChildTag(MAVEN_EXCLUSION_TAG, \"\", \"\", false);\n XmlTag groupIdTag = exclusionTag.createChildTag(MavenInspection.MAVEN_GROUP_ID_TAG, \"\", groupId, false);\n XmlTag artifactIdTag = exclusionTag.createChildTag(MavenInspection.MAVEN_ARTIFACT_ID_TAG, \"\", artifactId, false);\n exclusionTag.addSubTag(groupIdTag, true);\n exclusionTag.addSubTag(artifactIdTag, false);\n exclusionsTag.addSubTag(exclusionTag, false);\n }\n\n private void navigateToElement(XmlTag xmlElement) {\n PsiElement navigationTarget = xmlElement.getNavigationElement();\n if (!(navigationTarget instanceof Navigatable)) {\n return;\n }\n Navigatable navigatable = (Navigatable) navigationTarget;\n if (navigatable.canNavigate()) {\n navigatable.navigate(true);\n }\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/inspections/AbstractInspection.java",
"content": "package com.jfrog.ide.idea.inspections;\n\nimport com.google.common.collect.ArrayListMultimap;\nimport com.google.common.collect.Multimap;\nimport com.intellij.codeInspection.LocalInspectionTool;\nimport com.intellij.codeInspection.LocalQuickFix;\nimport com.intellij.codeInspection.ProblemHighlightType;\nimport com.intellij.codeInspection.ProblemsHolder;\nimport com.intellij.lang.annotation.AnnotationHolder;\nimport com.intellij.lang.annotation.Annotator;\nimport com.intellij.openapi.project.Project;\nimport com.intellij.openapi.vfs.VirtualFile;\nimport com.intellij.openapi.wm.ToolWindow;\nimport com.intellij.openapi.wm.ToolWindowManager;\nimport com.intellij.psi.PsiElement;\nimport com.jfrog.ide.common.nodes.DependencyNode;\nimport com.jfrog.ide.common.nodes.DescriptorFileTreeNode;\nimport com.jfrog.ide.common.nodes.SortableChildrenTreeNode;\nimport com.jfrog.ide.common.nodes.VulnerabilityNode;\nimport com.jfrog.ide.common.nodes.subentities.ImpactTree;\nimport com.jfrog.ide.idea.inspections.upgradeversion.UpgradeVersion;\nimport com.jfrog.ide.idea.navigation.NavigationService;\nimport com.jfrog.ide.idea.scan.ScannerBase;\nimport com.jfrog.ide.idea.ui.ComponentsTree;\nimport com.jfrog.ide.idea.ui.LocalComponentsTree;\nimport com.jfrog.ide.idea.utils.Descriptor;\nimport org.apache.commons.collections4.CollectionUtils;\nimport org.apache.commons.collections4.ListUtils;\nimport org.apache.commons.lang3.StringUtils;\n\nimport javax.swing.tree.TreeNode;\nimport java.util.*;\nimport java.util.stream.Collectors;\n\n/**\n * Parent class of all inspections and annotations.\n * The inspections are the \"Show in JFrog plugin\" action.\n * The annotations are the \"Top issue\" and \"Licenses\" labels.\n *\n * @author yahavi\n */\npublic abstract class AbstractInspection extends LocalInspectionTool implements Annotator {\n\n private final String packageDescriptorName;\n // True if the code inspection was automatically triggered after an Xray scan using InspectionEngine.runInspectionOnFile(...).\n private boolean afterScan;\n\n AbstractInspection(Descriptor descriptor) {\n this.packageDescriptorName = descriptor.getFileName();\n }\n\n public void setAfterScan(boolean afterScan) {\n this.afterScan = afterScan;\n }\n\n /**\n * Get Psi element and decide whether to add \"Show in JFrog plugin\" option, and register a corresponding\n * navigation from item in tree to item in project-descriptor.\n *\n * @param problemsHolder - The \"Show in JFrog plugin\" option will be registered in this container.\n * @param element - The Psi element in the package descriptor\n * @param isOnTheFly - True if the inspection was triggered by opening a package descriptor file.\n * False if the inspection was triggered manually by clicking on \"Code | Inspect Code\".\n */\n void visitElement(ProblemsHolder problemsHolder, PsiElement element, boolean isOnTheFly) {\n if (!afterScan && !isOnTheFly) {\n // Code inspection was triggered manually by clicking on \"Code | Inspect Code\".\n return;\n }\n String componentName = createComponentName(element);\n if (StringUtils.isBlank(componentName)) {\n return; // Failed creating the component name\n }\n List dependencies = getDependencies(element, componentName);\n if (CollectionUtils.isEmpty(dependencies)) {\n return;\n }\n NavigationService navigationService = NavigationService.getInstance(element.getProject());\n for (DependencyNode dependency : dependencies) {\n if (isOnTheFly) {\n registerProblem(problemsHolder, dependency, element, componentName);\n }\n navigationService.addNavigation(dependency, element, componentName);\n }\n }\n\n /**\n * Get Psi element and decide whether to add licenses and top issue annotations.\n *\n * @param annotationHolder - The annotations will be registered in this container\n * @param element - The Psi element in the package descriptor\n */\n void visitElement(AnnotationHolder annotationHolder, PsiElement element) {\n String componentName = createComponentName(element);\n if (componentName == null) {\n return; // Failed creating the component name\n }\n List dependencies = getDependencies(element, componentName);\n if (CollectionUtils.isNotEmpty(dependencies)) {\n AnnotationUtils.registerAnnotation(annotationHolder, dependencies.get(0), element, showAnnotationIcon(element));\n }\n }\n\n /**\n * Get the relevant scan manager according to the project type and path.\n *\n * @param project - The Project\n * @param path - Path to project\n * @return ScanManager\n */\n abstract ScannerBase getScanner(Project project, String path);\n\n /**\n * Return true if and only if the Psi element is a dependency.\n *\n * @param element - The Psi element in the package descriptor.\n * @return true if and only if the Psi element is a dependency\n */\n abstract boolean isDependency(PsiElement element);\n\n /**\n * Create a component name from the Psi element. Called when isDependency(element) == true.\n *\n * @param element - The Psi element in the package descriptor\n * @return GeneralInfo\n */\n abstract String createComponentName(PsiElement element);\n\n /**\n * Get the file descriptors nodes that containing the dependency in the Psi element.\n *\n * @param element - The Psi element in the package descriptor\n * @return Set of file nodes containing the dependency or null if not found\n */\n Set getFileDescriptors(PsiElement element) {\n Project project = element.getProject();\n ComponentsTree componentsTree = LocalComponentsTree.getInstance(project);\n if (componentsTree == null || componentsTree.getModel() == null) {\n return null;\n }\n Set fileDescriptors = new HashSet<>();\n Enumeration roots = ((SortableChildrenTreeNode) componentsTree.getModel().getRoot()).children();\n for (TreeNode root : Collections.list(roots)) {\n if (root instanceof DescriptorFileTreeNode fileNode) {\n if (fileNode.getFilePath().equals(element.getContainingFile().getVirtualFile().getPath())) {\n fileDescriptors.add(fileNode);\n }\n }\n }\n return fileDescriptors;\n\n }\n\n /**\n * Override this method to determine whether to display multiple annotation icons in the same line.\n *\n * @param element - The Psi element in the package descriptor\n * @return true if it should show annotation icon.\n */\n boolean showAnnotationIcon(PsiElement element) {\n return true;\n }\n\n /**\n * Determine whether to apply the inspection on the Psi element.\n *\n * @param element - The Psi element in the package descriptor\n * @return true if and only if the element is a dependency and the plugin is ready to show inspection for it\n */\n boolean isShowInspection(PsiElement element) {\n Project project = element.getProject();\n\n ToolWindow toolWindow = ToolWindowManager.getInstance(project).getToolWindow(\"JFrog\");\n if (toolWindow == null) {\n return false; // Tool window not yet activated\n }\n\n VirtualFile editorFile = element.getContainingFile().getVirtualFile();\n if (editorFile == null || editorFile.getParent() == null || !editorFile.getPath().endsWith(packageDescriptorName)) {\n return false; // File is not a package descriptor file\n }\n\n\n ScannerBase scanner = getScanner(project, editorFile.getParent().getPath());\n if (scanner == null) {\n return false; // Scan manager for this project not yet created\n }\n return isDependency(element);\n }\n\n /**\n * Get all dependencies in the tree that relevant to the element.\n *\n * @param element - The Psi element in the package descriptor\n * @return all dependencies in the dependency tree that relevant to the element\n */\n List getDependencies(PsiElement element, String componentName) {\n if (!isShowInspection(element)) {\n return null; // Inspection is not needed for this element\n }\n Set filesNodes = getFileDescriptors(element);\n if (filesNodes == null) {\n return null; // No files descriptors found for this element\n }\n return filesNodes.stream()\n .map(descriptorFile -> getMatchDependencies(descriptorFile, componentName))\n .flatMap(Collection::stream)\n .collect(Collectors.toList());\n }\n\n /**\n * Get the dependencies that match to the input componentName.\n *\n * @param file - The Descriptor file node in the tree\n * @param componentName - Component name representing a dependency without version\n * @return the dependencies node that match to the input general info\n */\n private List getMatchDependencies(DescriptorFileTreeNode file, String componentName) {\n List dependencies = new ArrayList<>();\n for (DependencyNode dependency : file.getDependencies()) {\n if (isNodeMatch(dependency, componentName)) {\n dependencies.add(dependency);\n }\n }\n return dependencies;\n }\n\n /**\n * Compare the component name from the Psi element and the dependency node from the Dependency tree.\n *\n * @param node - the dependency node from the dependency tree\n * @param componentName - Component name representing a dependency without version\n * @return true if the node matches the component name\n */\n boolean isNodeMatch(DependencyNode node, String componentName) {\n String artifactID = node.getComponentIdWithoutPrefix();\n ImpactTree impactTree = node.getImpactTree();\n String versionPrefix = \":\";\n return StringUtils.equals(extractArtifactIdWithoutVersion(artifactID), componentName) || impactTree.contains(componentName+versionPrefix);\n }\n\n abstract UpgradeVersion getUpgradeVersion(String componentName, String fixVersion, Collection issues, String descriptorPath);\n\n void registerProblem(ProblemsHolder problemsHolder, DependencyNode dependency, PsiElement element, String componentName) {\n boolean isTransitive = dependency.isIndirect() || !StringUtils.contains(dependency.getTitle(), componentName);\n String dependencyDescription = getDependencyDescription(dependency.getTitle(), isTransitive);\n List quickFixes = new ArrayList<>();\n quickFixes.add(new ShowInDependencyTree(dependency, dependencyDescription));\n\n if (!isTransitive) {\n Multimap fixVersionToCves = ArrayListMultimap.create();\n dependency.children().asIterator().forEachRemaining(issueNode -> {\n List fixVersionStrings = ListUtils.emptyIfNull(((VulnerabilityNode) issueNode).getFixedVersions());\n for (String fixVersionString : fixVersionStrings) {\n String fixVersion = convertFixVersionStringToMinFixVersion(fixVersionString);\n fixVersionToCves.put(fixVersion, issueNode.toString());\n }\n });\n\n String descriptorPath = element.getContainingFile().getVirtualFile().getPath();\n fixVersionToCves.asMap().forEach((fixedVersion, issues) -> {\n UpgradeVersion upgradeVersion = getUpgradeVersion(dependency.getArtifactId(), fixedVersion, issues, descriptorPath);\n quickFixes.add(upgradeVersion);\n });\n }\n\n problemsHolder.registerProblem(\n element,\n \"JFrog: \" + dependencyDescription + \" has security vulnerabilities\",\n ProblemHighlightType.WARNING,\n quickFixes.toArray(LocalQuickFix[]::new)\n );\n }\n\n private String getDependencyDescription(String depComponent, boolean isTransitive) {\n String description = \"dependency <\" + depComponent + \">\";\n if (isTransitive) {\n description = \"transitive \" + description;\n }\n return description;\n }\n\n protected static String convertFixVersionStringToMinFixVersion(String fixVersionString) {\n // Possible fix version string formats:\n // 1.0 >> 1.0\n // (,1.0] >> N/A\n // (,1.0) >> N/A\n // [1.0] >> 1.0\n // (1.0,) >> N/A\n // (1.0, 2.0) >> N/A\n // [1.0, 2.0] >> 1.0\n String fixVersion = fixVersionString.trim().split(\",\")[0];\n if (fixVersion.charAt(0) == '(') {\n // If first character is '(' then we can't tell what's the minimal fix version\n return \"\";\n }\n fixVersion = StringUtils.strip(fixVersion, \"[\");\n fixVersion = StringUtils.strip(fixVersion, \"]\");\n return fixVersion;\n }\n\n\n private String extractArtifactIdWithoutVersion(String artifact) {\n int versionIndex = artifact.lastIndexOf(':');\n\n if (versionIndex != -1) {\n return artifact.substring(0, versionIndex);\n } else {\n return artifact;\n }\n }\n }"
},
{
"path": "src/main/java/com/jfrog/ide/idea/inspections/AnnotationIconRenderer.java",
"content": "package com.jfrog.ide.idea.inspections;\n\nimport com.intellij.openapi.actionSystem.AnAction;\nimport com.intellij.openapi.actionSystem.AnActionEvent;\nimport com.intellij.openapi.editor.markup.GutterIconRenderer;\nimport com.intellij.openapi.project.Project;\nimport com.intellij.util.ui.tree.TreeUtil;\nimport com.jfrog.ide.common.nodes.subentities.Severity;\nimport com.jfrog.ide.idea.ui.LocalComponentsTree;\nimport com.jfrog.ide.idea.ui.utils.IconUtils;\nimport com.jfrog.ide.idea.utils.Utils;\nimport org.apache.commons.lang3.StringUtils;\nimport org.jetbrains.annotations.NotNull;\nimport org.jetbrains.annotations.Nullable;\n\nimport javax.swing.*;\nimport javax.swing.tree.DefaultMutableTreeNode;\nimport java.util.Objects;\n\n/**\n * Represents the icon near the dependencies in the package descriptor file.\n *\n * @author yahavi\n **/\npublic class AnnotationIconRenderer extends GutterIconRenderer {\n private final DefaultMutableTreeNode node;\n private final String tooltipText;\n private final Icon icon;\n private Project project;\n\n public AnnotationIconRenderer(DefaultMutableTreeNode node, Severity severity, String tooltipText) {\n this.node = node;\n this.tooltipText = tooltipText;\n this.icon = IconUtils.load(StringUtils.lowerCase(severity.toString()));\n }\n\n public void setProject(Project project) {\n this.project = project;\n }\n\n @Override\n public boolean equals(Object obj) {\n if (!(obj instanceof AnnotationIconRenderer)) {\n return false;\n }\n return Objects.equals(icon, ((AnnotationIconRenderer) obj).getIcon());\n }\n\n @Override\n public int hashCode() {\n return Objects.hashCode(icon);\n }\n\n @Override\n public @NotNull Icon getIcon() {\n return icon;\n }\n\n @Override\n public @Nullable String getTooltipText() {\n return tooltipText;\n }\n\n @Override\n public @Nullable AnAction getClickAction() {\n return new AnAction() {\n @Override\n public void actionPerformed(@NotNull AnActionEvent e) {\n Utils.focusJFrogToolWindow(project);\n TreeUtil.selectInTree(project, node, true, LocalComponentsTree.getInstance(project), true);\n }\n };\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/inspections/AnnotationUtils.java",
"content": "package com.jfrog.ide.idea.inspections;\n\nimport com.intellij.lang.annotation.AnnotationBuilder;\nimport com.intellij.lang.annotation.AnnotationHolder;\nimport com.intellij.psi.PsiElement;\nimport com.jfrog.ide.common.nodes.DependencyNode;\nimport com.jfrog.ide.common.nodes.subentities.License;\n\nimport java.util.List;\nimport java.util.stream.Collectors;\n\nimport static com.intellij.lang.annotation.HighlightSeverity.INFORMATION;\n\n/**\n * @author yahavi\n */\npublic class AnnotationUtils {\n\n /**\n * Register \"Top issue\" and \"Licenses\" annotations.\n *\n * @param annotationHolder - The annotations will be registered in this container\n * @param dependency - The dependency tree node correlated to the element\n * @param element - The element to apply the annotations\n * @param showIcon - True if should add annotation icon\n */\n static void registerAnnotation(AnnotationHolder annotationHolder, DependencyNode dependency, PsiElement element, boolean showIcon) {\n String licensesString = getLicensesString(dependency);\n String topIssue = getTopIssueString(dependency);\n AnnotationIconRenderer iconRenderer = showIcon ? new AnnotationIconRenderer(dependency, dependency.getSeverity(), topIssue) : null;\n try {\n AnnotationBuilder builder = annotationHolder.newAnnotation(INFORMATION, topIssue).range(element);\n if (showIcon) {\n iconRenderer.setProject(element.getProject());\n builder = builder.gutterIconRenderer(iconRenderer);\n }\n builder.create();\n annotationHolder.newAnnotation(INFORMATION, licensesString).range(element).create();\n } catch (IllegalArgumentException e) {\n // Exception is thrown when the element we register the annotation for is out of bound of the\n // containing element exists in the provided annotationHolder.\n // This scenario may occur during a gradle-inspections.\n }\n }\n\n /**\n * Get the top issue string.\n *\n * @param node - The dependency tree node\n * @return the top issue string\n */\n private static String getTopIssueString(DependencyNode node) {\n return \"Top issue severity: \" + node.getSeverity();\n }\n\n /**\n * Get licenses string\n *\n * @param node - The dependency tree node\n * @return licenses string\n */\n private static String getLicensesString(DependencyNode node) {\n String results = \"Licenses: \";\n List licensesStrings = node.getLicenses().stream().map(License::getName).collect(Collectors.toList());\n if (licensesStrings.isEmpty()) {\n return results + \"Unknown\";\n }\n return results + String.join(\", \", licensesStrings);\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/inspections/GoInspection.java",
"content": "package com.jfrog.ide.idea.inspections;\n\nimport com.goide.vgo.mod.psi.VgoModuleSpec;\nimport com.goide.vgo.mod.psi.VgoRequireDirective;\nimport com.goide.vgo.mod.psi.VgoVisitor;\nimport com.intellij.codeInspection.ProblemsHolder;\nimport com.intellij.lang.annotation.AnnotationHolder;\nimport com.intellij.openapi.project.Project;\nimport com.intellij.psi.PsiElement;\nimport com.intellij.psi.PsiElementVisitor;\nimport com.jfrog.ide.idea.inspections.upgradeversion.GoUpgradeVersion;\nimport com.jfrog.ide.idea.inspections.upgradeversion.UpgradeVersion;\nimport com.jfrog.ide.idea.scan.ScanManager;\nimport com.jfrog.ide.idea.scan.ScannerBase;\nimport com.jfrog.ide.idea.utils.Descriptor;\nimport org.apache.commons.lang3.StringUtils;\nimport org.jetbrains.annotations.NotNull;\n\nimport java.util.Collection;\n\n/**\n * Created by Bar Belity on 17/02/2020.\n */\n\npublic class GoInspection extends AbstractInspection {\n\n public GoInspection() {\n super(Descriptor.GO);\n }\n\n @NotNull\n @Override\n public PsiElementVisitor buildVisitor(@NotNull final ProblemsHolder holder, boolean isOnTheFly) {\n return new VgoVisitor() {\n @Override\n public void visitModuleSpec(@NotNull VgoModuleSpec element) {\n super.visitPsiElement(element);\n GoInspection.this.visitElement(holder, element, isOnTheFly);\n }\n };\n }\n\n @Override\n public void annotate(@NotNull PsiElement element, @NotNull AnnotationHolder holder) {\n if (element instanceof VgoModuleSpec) {\n GoInspection.this.visitElement(holder, element);\n }\n }\n\n @Override\n boolean isDependency(PsiElement element) {\n PsiElement parentElement = element.getParent();\n return parentElement instanceof VgoRequireDirective;\n }\n\n @Override\n ScannerBase getScanner(Project project, String path) {\n return ScanManager.getScanners(project).stream()\n .filter(manager -> StringUtils.equals(manager.getProjectPath(), path))\n .findAny()\n .orElse(null);\n }\n\n @Override\n String createComponentName(PsiElement element) {\n VgoModuleSpec goElement = ((VgoModuleSpec) element);\n if (goElement.getModuleVersion() != null) {\n String version = goElement.getModuleVersion().getText();\n // String leading \"v\" from version\n version = StringUtils.strip(version, \"v\");\n return String.join(\":\", goElement.getIdentifier().getText(), version);\n }\n return \"\";\n }\n\n @Override\n UpgradeVersion getUpgradeVersion(String componentName, String fixVersion, Collection issue, String descriptorPath) {\n return new GoUpgradeVersion(componentName, fixVersion, issue, descriptorPath);\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/inspections/GradleGroovyInspection.java",
"content": "package com.jfrog.ide.idea.inspections;\n\nimport com.intellij.codeInspection.ProblemsHolder;\nimport com.intellij.lang.annotation.AnnotationHolder;\nimport com.intellij.psi.PsiElement;\nimport com.intellij.psi.PsiElementVisitor;\nimport com.jfrog.ide.idea.inspections.upgradeversion.GradleGroovyUpgradeVersion;\nimport com.jfrog.ide.idea.inspections.upgradeversion.UpgradeVersion;\nimport com.jfrog.ide.idea.utils.Descriptor;\nimport org.apache.commons.lang3.StringUtils;\nimport org.jetbrains.annotations.NotNull;\nimport org.jetbrains.plugins.groovy.lang.psi.GroovyElementVisitor;\nimport org.jetbrains.plugins.groovy.lang.psi.GroovyPsiElement;\nimport org.jetbrains.plugins.groovy.lang.psi.GroovyPsiElementVisitor;\nimport org.jetbrains.plugins.groovy.lang.psi.api.statements.arguments.GrArgumentList;\nimport org.jetbrains.plugins.groovy.lang.psi.api.statements.arguments.GrNamedArgument;\nimport org.jetbrains.plugins.groovy.lang.psi.api.statements.expressions.GrExpression;\nimport org.jetbrains.plugins.groovy.lang.psi.api.statements.expressions.literals.GrLiteral;\nimport org.jetbrains.plugins.groovy.lang.psi.api.util.GrNamedArgumentsOwner;\n\nimport java.util.ArrayList;\nimport java.util.Collection;\nimport java.util.List;\nimport java.util.Objects;\n\n/**\n * @author yahavi\n */\npublic class GradleGroovyInspection extends GradleInspection {\n\n public static final String GRADLE_GROUP_KEY = \"group\";\n public static final String GRADLE_NAME_KEY = \"name\";\n public static final String GRADLE_VERSION_KEY = \"version\";\n\n public GradleGroovyInspection() {\n super(Descriptor.GRADLE_GROOVY);\n }\n\n /**\n * Get the string value of the groovy literal.\n *\n * @param literal - The groovy literal\n * @return the value of the literal\n */\n public static String getLiteralValue(GrLiteral literal) {\n String artifact = Objects.toString((literal).getValue(), \"\");\n int versionIndex = artifact.lastIndexOf(':');\n if (versionIndex == -1) {\n return artifact;\n }\n return artifact.substring(0, versionIndex);\n }\n\n public static boolean isNamedArgumentComponent(PsiElement element) {\n return (element instanceof GrNamedArgumentsOwner && ((GrNamedArgumentsOwner) element).getNamedArguments().length >= 3);\n }\n\n @NotNull\n @Override\n public PsiElementVisitor buildVisitor(@NotNull final ProblemsHolder holder, boolean isOnTheFly) {\n return new GroovyPsiElementVisitor(new GroovyElementVisitor() {\n @Override\n public void visitArgumentList(@NotNull GrArgumentList list) {\n super.visitArgumentList(list);\n List elementsToVisit = parseComponentElements(list);\n for (GroovyPsiElement elementToVisit : elementsToVisit) {\n GradleGroovyInspection.this.visitElement(holder, elementToVisit, isOnTheFly);\n }\n }\n });\n }\n\n @Override\n boolean isDependency(PsiElement element) {\n PsiElement parent = element.getParent();\n for (int i = 0; i < 6; i++, parent = parent.getParent()) {\n if (StringUtils.startsWith(parent.getText(), \"dependencies\")) {\n return true;\n }\n }\n return false;\n }\n\n @Override\n public void annotate(@NotNull PsiElement element, @NotNull AnnotationHolder holder) {\n if (element instanceof GrArgumentList) {\n List elementsToVisit = parseComponentElements((GrArgumentList) element);\n for (GroovyPsiElement elementToVisit : elementsToVisit) {\n GradleGroovyInspection.this.visitElement(holder, elementToVisit);\n }\n }\n }\n\n List parseComponentElements(GrArgumentList element) {\n List elementsToVisit = new ArrayList<>();\n if (isNamedArgumentComponent(element)) {\n // Example: implementation group: 'j', name: 'k', version: 'l'\n elementsToVisit.add(element);\n } else {\n // Example:\n // implementation([group: 'net.lingala.zip4j', name: 'zip4j', version: '2.3.0'],\n // [group: 'org.codehaus.groovy', name: 'groovy-all', version: '3.0.5'])\n // OR\n // implementation(\"org.codehaus.groovy:groovy-all:3.0.5\")\n // OR\n // implementation 'net.lingala.zip4j:zip4j:2.3.0',\n // 'org.codehaus.groovy:groovy-all:3.0.5'\n for (GroovyPsiElement subElement : element.getAllArguments()) {\n if (isNamedArgumentComponent(subElement) || (subElement instanceof GrLiteral)) {\n elementsToVisit.add(subElement);\n } else if (subElement.getChildren().length > 0 && subElement.getChildren()[0] instanceof GrLiteral) {\n elementsToVisit.add((GrLiteral) subElement.getChildren()[0]);\n }\n }\n }\n return elementsToVisit;\n }\n\n @Override\n String createComponentName(PsiElement element) {\n if (isNamedArgumentComponent(element)) {\n // implementation group: 'j', name: 'k', version: 'l'\n return String.join(\":\",\n extractExpression(element, GRADLE_GROUP_KEY),\n extractExpression(element, GRADLE_NAME_KEY));\n }\n if (element instanceof GrLiteral) {\n // implementation 'g:h:i'\n return getLiteralValue((GrLiteral) element);\n }\n return \"\";\n }\n\n /**\n * Extract expression from groovy arguments.\n *\n * @param argumentList - The arguments list\n * @param name - The name of the argument to extract\n * @return the value of the argument\n */\n private String extractExpression(PsiElement argumentList, String name) {\n GrNamedArgument argument = ((GrNamedArgumentsOwner) argumentList).findNamedArgument(name);\n if (argument == null) {\n return \"\";\n }\n GrExpression grExpression = argument.getExpression();\n if (grExpression == null) {\n return \"\";\n }\n if (!(grExpression instanceof GrLiteral)) {\n return \"\";\n }\n return getLiteralValue((GrLiteral) grExpression);\n }\n\n @Override\n UpgradeVersion getUpgradeVersion(String componentName, String fixVersion, Collection issue, String descriptorPath) {\n return new GradleGroovyUpgradeVersion(componentName, fixVersion, issue);\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/inspections/GradleInspection.java",
"content": "package com.jfrog.ide.idea.inspections;\n\nimport com.intellij.openapi.editor.Document;\nimport com.intellij.openapi.project.Project;\nimport com.intellij.psi.PsiElement;\nimport com.jfrog.ide.idea.scan.GradleScanner;\nimport com.jfrog.ide.idea.scan.ScanManager;\nimport com.jfrog.ide.idea.scan.ScannerBase;\nimport com.jfrog.ide.idea.utils.Descriptor;\nimport org.apache.commons.lang3.StringUtils;\n\n/**\n * @author yahavi\n */\npublic abstract class GradleInspection extends AbstractInspection {\n private int lastAnnotatedLine;\n\n public GradleInspection(Descriptor descriptor) {\n super(descriptor);\n }\n\n @Override\n ScannerBase getScanner(Project project, String path) {\n return ScanManager.getScanners(project).stream()\n .filter(GradleScanner.class::isInstance)\n .findAny()\n .orElse(null);\n }\n\n\n @Override\n boolean showAnnotationIcon(PsiElement element) {\n Document document = element.getContainingFile().getViewProvider().getDocument();\n boolean showAnnotationIcon = true;\n if (document != null) {\n int currentLine = document.getLineNumber(element.getTextOffset());\n showAnnotationIcon = currentLine != lastAnnotatedLine;\n lastAnnotatedLine = currentLine;\n }\n return showAnnotationIcon;\n }\n\n public static String stripVersion(String componentId) {\n if (StringUtils.countMatches(componentId, \":\") >= 2) {\n // implementation('a:b:c')\n String[] splitComponent = componentId.split(\":\");\n componentId = splitComponent[0] + \":\" + splitComponent[1];\n }\n return componentId;\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/inspections/GradleKotlinInspection.java",
"content": "package com.jfrog.ide.idea.inspections;\n\nimport com.intellij.codeInspection.ProblemsHolder;\nimport com.intellij.lang.annotation.AnnotationHolder;\nimport com.intellij.psi.PsiElement;\nimport com.intellij.psi.PsiElementVisitor;\nimport com.jfrog.ide.idea.inspections.upgradeversion.GradleKotlinUpgradeVersion;\nimport com.jfrog.ide.idea.inspections.upgradeversion.UpgradeVersion;\nimport com.jfrog.ide.idea.utils.Descriptor;\nimport org.apache.commons.lang3.StringUtils;\nimport org.jetbrains.annotations.NotNull;\nimport org.jetbrains.kotlin.psi.*;\n\nimport java.util.Collection;\nimport java.util.List;\n\n/**\n * Each dependency in Gradle-Kotlin is a function call with at least one argument.\n * Examples:\n * compile(\"a:b:c\")\n * testCompile(\"d\", \"e\", \"f\")\n * implementation(project(\":project\")) // Subproject dependencies start with \":\"\n *\n * @author yahavi\n */\npublic class GradleKotlinInspection extends GradleInspection {\n\n public GradleKotlinInspection() {\n super(Descriptor.GRADLE_KOTLIN);\n }\n\n @NotNull\n @Override\n public PsiElementVisitor buildVisitor(@NotNull final ProblemsHolder holder, boolean isOnTheFly) {\n return new KtVisitorVoid() {\n @Override\n public void visitValueArgumentList(@NotNull KtValueArgumentList list) {\n // Verify that the visited file is a build.gradle.kts file\n if (((KtFile) list.getContainingFile()).isScript()) {\n GradleKotlinInspection.this.visitElement(holder, list, isOnTheFly);\n }\n }\n };\n }\n\n @Override\n public void annotate(@NotNull PsiElement element, @NotNull AnnotationHolder holder) {\n if (element instanceof KtValueArgumentList && ((KtFile) element.getContainingFile()).isScript()) {\n GradleKotlinInspection.this.visitElement(holder, element);\n }\n }\n\n @Override\n boolean isDependency(PsiElement element) {\n List argumentList = ((KtValueArgumentList) element).getArguments();\n if (argumentList.isEmpty() || !(argumentList.get(0).getArgumentExpression() instanceof KtStringTemplateExpression)) {\n return false;\n }\n // Make sure the element is under \"dependencies\" scope\n for (PsiElement parent = element.getParent(); parent != null; parent = parent.getParent()) {\n if (!(parent instanceof KtCallExpression)) {\n continue;\n }\n KtExpression expression = ((KtCallExpression) parent).getCalleeExpression();\n if (expression != null && \"dependencies\".equals(expression.getText())) {\n return true;\n }\n }\n return false;\n }\n\n @Override\n String createComponentName(PsiElement element) {\n if (!(element instanceof KtValueArgumentList)) {\n return \"\";\n }\n List argumentList = ((KtValueArgumentList) element).getArguments();\n if (argumentList.size() == 1) {\n // \"commons-collections:commons-collections:3.2.2\"\n String artifactId = extractArgument(argumentList.get(0));\n return StringUtils.substringBeforeLast(artifactId, \":\");\n }\n if (argumentList.size() >= 3) {\n // \"commons-collections\", \"commons-collections\"\n return String.join(\":\",\n extractArgument(argumentList.get(0)),\n extractArgument(argumentList.get(1))\n );\n }\n return \"\";\n }\n\n /**\n * Extract argument text from Kotlin argument.\n *\n * @param ktValueArgument - The arguments list\n * @return the value of the argument\n */\n private String extractArgument(KtValueArgument ktValueArgument) {\n // Remove quotes\n String value = ktValueArgument.getText().replaceAll(\"\\\"\", \"\");\n\n // Remove '@' suffix, for example commons-lang:commons-lang:2.4@jar\n return StringUtils.substringBefore(value, \"@\");\n }\n\n @Override\n UpgradeVersion getUpgradeVersion(String componentName, String fixVersion, Collection issue, String descriptorPath) {\n return new GradleKotlinUpgradeVersion(componentName, fixVersion, issue);\n }\n\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/inspections/JFrogSecurityAnnotator.java",
"content": "package com.jfrog.ide.idea.inspections;\n\nimport com.intellij.lang.annotation.AnnotationHolder;\nimport com.intellij.lang.annotation.ExternalAnnotator;\nimport com.intellij.lang.annotation.HighlightSeverity;\nimport com.intellij.openapi.editor.Document;\nimport com.intellij.openapi.editor.Editor;\nimport com.intellij.openapi.util.TextRange;\nimport com.intellij.openapi.util.text.StringUtil;\nimport com.intellij.psi.PsiDocumentManager;\nimport com.intellij.psi.PsiFile;\nimport com.jfrog.ide.common.nodes.FileIssueNode;\nimport com.jfrog.ide.common.nodes.FileTreeNode;\nimport com.jfrog.ide.common.nodes.SortableChildrenTreeNode;\nimport com.jfrog.ide.idea.events.AnnotationEvents;\nimport com.jfrog.ide.idea.ui.ComponentsTree;\nimport com.jfrog.ide.idea.ui.LocalComponentsTree;\nimport org.jetbrains.annotations.NotNull;\nimport org.jetbrains.annotations.Nullable;\n\nimport javax.swing.tree.TreeNode;\nimport java.util.ArrayList;\nimport java.util.Enumeration;\nimport java.util.List;\nimport java.util.Objects;\n\n/**\n * General Annotator for JFrog security source code issues (for Example: applicable CVE)\n * The annotator receives the JFrogSecurityWarning data from the most recent scan.\n *\n * @author Tal Arian\n */\npublic class JFrogSecurityAnnotator extends ExternalAnnotator> {\n\n @NotNull\n private static final HighlightSeverity HIGHLIGHT_TYPE = HighlightSeverity.WARNING;\n\n @Nullable\n @Override\n public PsiFile collectInformation(@NotNull PsiFile file, @NotNull Editor editor, boolean hasErrors) {\n return file;\n }\n\n @Nullable\n @Override\n public List doAnnotate(PsiFile file) {\n List issues = new ArrayList<>();\n ComponentsTree componentsTree = LocalComponentsTree.getInstance(file.getProject());\n if (componentsTree == null || componentsTree.getModel() == null) {\n return null;\n }\n Enumeration roots = ((SortableChildrenTreeNode) componentsTree.getModel().getRoot()).children();\n roots.asIterator().forEachRemaining(root -> {\n FileTreeNode fileNode = (FileTreeNode) root;\n if (fileNode.getFilePath().equals(file.getContainingFile().getVirtualFile().getPath())) {\n fileNode.children().asIterator().forEachRemaining(issueNode -> {\n if (issueNode instanceof FileIssueNode) {\n issues.add((FileIssueNode) issueNode);\n }\n }\n );\n }\n });\n return issues;\n }\n\n @Override\n public void apply(@NotNull PsiFile file, List warnings, @NotNull AnnotationHolder holder) {\n Document document = PsiDocumentManager.getInstance(file.getProject()).getDocument(file);\n if (document == null) {\n return;\n }\n warnings.stream().filter(Objects::nonNull).forEach(warning -> {\n int startOffset = StringUtil.lineColToOffset(file.getText(), warning.getRowStart(), warning.getColStart());\n int endOffset = StringUtil.lineColToOffset(file.getText(), warning.getRowEnd(), warning.getColEnd());\n AnnotationIconRenderer iconRenderer = new AnnotationIconRenderer(warning, warning.getSeverity(), \"\");\n iconRenderer.setProject(file.getProject());\n\n TextRange range = new TextRange(startOffset, endOffset);\n String lineText = document.getText(range);\n // If the file has been update after the scan and the relevant line is affected,\n // no annotation will be added.\n if (lineText.contains(warning.getLineSnippet())) {\n holder.newAnnotation(HIGHLIGHT_TYPE, \"\\uD83D\\uDC38 JFrog [\" + warning.getTitle() + \"]: \" + warning.getReason())\n .range(range)\n .gutterIconRenderer(iconRenderer)\n .create();\n }\n // Notify outdated scan result\n else {\n file.getProject().getMessageBus().syncPublisher(AnnotationEvents.ON_IRRELEVANT_RESULT).update(warning.getFilePath());\n }\n });\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/inspections/JFrogSecurityWarning.java",
"content": "package com.jfrog.ide.idea.inspections;\n\nimport com.jfrog.ide.common.nodes.subentities.FindingInfo;\nimport com.jfrog.ide.common.nodes.subentities.Severity;\nimport com.jfrog.ide.common.nodes.subentities.SourceCodeScanType;\nimport com.jfrog.ide.idea.scan.data.*;\nimport lombok.Getter;\n\nimport java.net.URI;\nimport java.nio.file.Paths;\nimport java.util.List;\n\n@Getter\npublic class JFrogSecurityWarning {\n private final int lineStart;\n private final int colStart;\n private final int lineEnd;\n private final int colEnd;\n private final String reason;\n private final String filePath;\n private final String lineSnippet;\n private String scannerSearchTarget;\n private final String ruleID;\n private final SourceCodeScanType reporter;\n private final Severity severity;\n private final FindingInfo[][] codeFlows;\n private final boolean isApplicable;\n\n public JFrogSecurityWarning(\n int lineStart,\n int colStart, int lineEnd,\n int colEnd, String reason,\n String filePath,\n String ruleID,\n String lineSnippet,\n SourceCodeScanType reporter,\n boolean isApplicable,\n Severity severity,\n FindingInfo[][] codeFlows\n ) {\n this.lineStart = lineStart;\n this.colStart = colStart;\n this.lineEnd = lineEnd;\n this.colEnd = colEnd;\n this.reason = reason;\n this.filePath = filePath;\n this.ruleID = ruleID;\n this.lineSnippet = lineSnippet;\n this.reporter = reporter;\n this.isApplicable = isApplicable;\n this.severity = severity;\n this.codeFlows = codeFlows;\n }\n\n public JFrogSecurityWarning(SarifResult result, SourceCodeScanType reporter, Rule rule) {\n this(getFirstRegion(result).getStartLine() - 1,\n getFirstRegion(result).getStartColumn() - 1,\n getFirstRegion(result).getEndLine() - 1,\n getFirstRegion(result).getEndColumn() - 1,\n determineReason(result.getMessage().getText(), rule.getShortDescription().getText(), reporter),\n getFilePath(result),\n result.getRuleId(),\n getFirstRegion(result).getSnippet().getText(),\n reporter,\n isWarningApplicable(result, rule),\n Severity.fromSarif(result.getSeverity()),\n convertCodeFlowsToFindingInfo(result.getCodeFlows())\n );\n }\n\n private static boolean isWarningApplicable(SarifResult result, Rule rule) {\n return !result.getKind().equals(\"pass\") && (rule.getRuleProperties().map(properties -> properties.getApplicability().equals(\"applicable\")).orElse(true));\n }\n\n private static String getFilePath(SarifResult result) {\n return !result.getLocations().isEmpty() ? uriToPath(result.getLocations().get(0).getPhysicalLocation().getArtifactLocation().getUri()) : \"\";\n }\n\n private static FindingInfo[][] convertCodeFlowsToFindingInfo(List codeFlows) {\n if (codeFlows == null || codeFlows.isEmpty()) {\n return null;\n }\n List flows = codeFlows.get(0).getThreadFlows();\n if (flows == null || flows.isEmpty()) {\n return null;\n }\n FindingInfo[][] results = new FindingInfo[flows.size()][];\n for (int i = 0; i < flows.size(); i++) {\n ThreadFlow flow = flows.get(i);\n List locations = flow.getLocations();\n results[i] = new FindingInfo[locations.size()];\n for (int j = 0; j < locations.size(); j++) {\n PhysicalLocation location = locations.get(j).getLocation().getPhysicalLocation();\n results[i][j] = new FindingInfo(\n uriToPath(location.getArtifactLocation().getUri()),\n location.getRegion().getStartLine(),\n location.getRegion().getStartColumn(),\n location.getRegion().getEndLine(),\n location.getRegion().getEndColumn(),\n location.getRegion().getSnippet().getText()\n );\n }\n }\n return results;\n }\n\n public static JFrogSecurityWarning notApplicable(String ruleId, SourceCodeScanType reporter) {\n return new JFrogSecurityWarning(0, 0, 0, 0, \"\", \"\", ruleId, \"\", reporter, false, Severity.Unknown, null);\n }\n\n public boolean isApplicable() {\n return this.isApplicable;\n }\n\n private static Region getFirstRegion(SarifResult result) {\n Region emptyRegion = new Region();\n emptyRegion.setSnippet(new Message());\n return !result.getLocations().isEmpty() ? result.getLocations().get(0).getPhysicalLocation().getRegion() : emptyRegion;\n }\n\n public void setScannerSearchTarget(String scannerSearchTarget) {\n this.scannerSearchTarget = scannerSearchTarget;\n }\n\n private static String uriToPath(String path) {\n return Paths.get(URI.create(path)).toString();\n }\n\n private static String determineReason(String resultMessage, String ruleMessage, SourceCodeScanType scannerType) {\n return scannerType.equals(SourceCodeScanType.SAST) ? ruleMessage : resultMessage;\n }\n}\n\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/inspections/JumpToCode.java",
"content": "package com.jfrog.ide.idea.inspections;\n\nimport com.intellij.openapi.application.ApplicationManager;\nimport com.intellij.openapi.editor.Document;\nimport com.intellij.openapi.editor.Editor;\nimport com.intellij.openapi.editor.ScrollType;\nimport com.intellij.openapi.editor.SelectionModel;\nimport com.intellij.openapi.editor.markup.HighlighterTargetArea;\nimport com.intellij.openapi.fileEditor.FileEditorManager;\nimport com.intellij.openapi.project.Project;\nimport com.intellij.openapi.util.text.StringUtil;\nimport com.intellij.openapi.vfs.LocalFileSystem;\nimport com.intellij.openapi.vfs.VirtualFile;\nimport com.intellij.psi.PsiFile;\nimport com.intellij.psi.util.PsiUtilBase;\nimport org.jetbrains.annotations.NotNull;\n\n/**\n * The JumpToCode class is responsible for navigating to a specific location in a code file\n * and highlighting the corresponding code.\n */\npublic class JumpToCode {\n Project project;\n FileEditorManager fileEditorManager;\n\n /**\n * Constructs a new {@code JumpToCode} with the provided project.\n *\n * @param project The current project.\n */\n private JumpToCode(@NotNull Project project) {\n this.project = project;\n fileEditorManager = FileEditorManager.getInstance(project);\n }\n\n public static JumpToCode getInstance(@NotNull Project project) {\n return project.getService(JumpToCode.class);\n }\n\n /**\n * Executes the jump to code operation by opening the file in the editor and highlighting the specified code range.\n *\n * @param filePath The path of the file to navigate to.\n * @param startRow The starting row of the code range.\n * @param endRow The ending row of the code range.\n * @param startColumn The starting column of the code range.\n * @param endColumn The ending column of the code range.\n */\n public void execute(String filePath, int startRow, int endRow, int startColumn, int endColumn) {\n if (this.project == null || this.fileEditorManager == null) return;\n VirtualFile file = getVirtualFile(filePath);\n if (file == null) return;\n ApplicationManager.getApplication().invokeLater(() -> {\n openFileInEditor(file);\n highlightCode(startRow, endRow, startColumn, endColumn);\n });\n }\n\n private void openFileInEditor(VirtualFile file) {\n fileEditorManager.openFile(file, true);\n }\n\n private void highlightCode(int startRow, int endRow, int startColumn, int endColumn) {\n Editor editor = fileEditorManager.getSelectedTextEditor();\n if (editor == null) return;\n Document document = getDocument(editor);\n if (document == null) return;\n int startOffset = getOffset(document, startRow, startColumn);\n int endOffset = getOffset(document, endRow, endColumn);\n highlightCode(editor, startOffset, endOffset);\n scrollToHighlightedCode(editor, startOffset);\n }\n\n private VirtualFile getVirtualFile(String path) {\n return LocalFileSystem.getInstance().findFileByPath(path);\n }\n\n private Document getDocument(Editor editor) {\n PsiFile psiFile = PsiUtilBase.getPsiFileInEditor(editor, project);\n if (psiFile == null) return null;\n return psiFile.getViewProvider().getDocument();\n }\n\n private int getOffset(Document document, int row, int column) {\n return StringUtil.lineColToOffset(document.getText(), row, column);\n }\n\n private void highlightCode(Editor editor, int startOffset, int endOffset) {\n SelectionModel selectionModel = editor.getSelectionModel();\n selectionModel.setSelection(startOffset, endOffset);\n editor.getMarkupModel().addRangeHighlighter(startOffset, endOffset, 0, null, HighlighterTargetArea.EXACT_RANGE);\n }\n\n private void scrollToHighlightedCode(Editor editor, int startOffset) {\n editor.getCaretModel().moveToOffset(startOffset);\n editor.getScrollingModel().scrollToCaret(ScrollType.CENTER);\n }\n}"
},
{
"path": "src/main/java/com/jfrog/ide/idea/inspections/MavenInspection.java",
"content": "package com.jfrog.ide.idea.inspections;\n\nimport com.intellij.codeInspection.ProblemsHolder;\nimport com.intellij.lang.annotation.AnnotationHolder;\nimport com.intellij.openapi.project.Project;\nimport com.intellij.psi.PsiElement;\nimport com.intellij.psi.PsiElementVisitor;\nimport com.intellij.psi.XmlElementVisitor;\nimport com.intellij.psi.impl.source.xml.XmlTagImpl;\nimport com.intellij.psi.xml.XmlTag;\nimport com.intellij.util.xml.DomElement;\nimport com.intellij.util.xml.DomManager;\nimport com.jfrog.ide.idea.inspections.upgradeversion.MavenUpgradeVersion;\nimport com.jfrog.ide.idea.inspections.upgradeversion.UpgradeVersion;\nimport com.jfrog.ide.idea.scan.MavenScanner;\nimport com.jfrog.ide.idea.scan.ScanManager;\nimport com.jfrog.ide.idea.scan.ScannerBase;\nimport com.jfrog.ide.idea.utils.Descriptor;\nimport org.apache.commons.lang3.StringUtils;\nimport org.jetbrains.annotations.NotNull;\nimport org.jetbrains.idea.maven.dom.model.MavenDomArtifactCoordinates;\nimport java.util.Collection;\n/**\n * @author yahavi\n */\npublic class MavenInspection extends AbstractInspection {\n\n public static final String MAVEN_DEPENDENCY_MANAGEMENT = \"dependencyManagement\";\n public static final String MAVEN_DEPENDENCIES_TAG = \"dependencies\";\n public static final String MAVEN_PLUGINS_TAG = \"plugins\";\n public static final String MAVEN_DEPENDENCY_TAG = \"dependency\";\n public static final String MAVEN_PLUGIN_TAG = \"plugin\";\n public static final String MAVEN_ARTIFACT_ID_TAG = \"artifactId\";\n public static final String MAVEN_GROUP_ID_TAG = \"groupId\";\n\n public MavenInspection() {\n super(Descriptor.MAVEN);\n }\n\n @NotNull\n @Override\n public PsiElementVisitor buildVisitor(@NotNull final ProblemsHolder holder, boolean isOnTheFly) {\n return new XmlElementVisitor() {\n @Override\n public void visitXmlTag(@NotNull XmlTag element) {\n if (isDependencyOrPlugin(element)) {\n MavenInspection.this.visitElement(holder, element, isOnTheFly);\n }\n }\n };\n }\n\n @Override\n public void annotate(@NotNull PsiElement element, @NotNull AnnotationHolder holder) {\n if (element instanceof XmlTag && isDependencyOrPlugin((XmlTag) element)) {\n MavenInspection.this.visitElement(holder, element);\n }\n }\n\n boolean isDependencyOrPlugin(XmlTag xmlTag) {\n return StringUtils.equalsAny(xmlTag.getName(), MAVEN_DEPENDENCY_TAG, MAVEN_PLUGIN_TAG);\n }\n\n @Override\n boolean isDependency(PsiElement element) {\n PsiElement parentElement = element.getParent();\n if ((parentElement instanceof XmlTag) &&\n StringUtils.equalsAny(((XmlTag) parentElement).getName(), MAVEN_DEPENDENCIES_TAG, MAVEN_PLUGINS_TAG)) {\n return true;\n }\n PsiElement grandParentElement = parentElement.getParent();\n return (grandParentElement instanceof XmlTag &&\n StringUtils.equals(((XmlTag) grandParentElement).getName(), MAVEN_DEPENDENCY_MANAGEMENT));\n }\n\n @Override\n ScannerBase getScanner(Project project, String path) {\n return ScanManager.getScanners(project).stream()\n .filter(MavenScanner.class::isInstance)\n .findAny()\n .orElse(null);\n }\n\n @Override\n String createComponentName(PsiElement element) {\n XmlTag groupId = ((XmlTagImpl) element).findFirstSubTag(MAVEN_GROUP_ID_TAG);\n XmlTag artifactId = ((XmlTagImpl) element).findFirstSubTag(MAVEN_ARTIFACT_ID_TAG);\n if (groupId == null || artifactId == null) {\n return null;\n }\n DomElement domElement = DomManager.getDomManager(element.getProject()).getDomElement((XmlTag) element);\n if (domElement instanceof MavenDomArtifactCoordinates) {\n return String.join(\":\", groupId.getValue().getText(), artifactId.getValue().getText());\n }\n return null;\n }\n\n @Override\n UpgradeVersion getUpgradeVersion(String componentName, String fixVersion, Collection issue, String descriptorPath) {\n return new MavenUpgradeVersion(componentName, fixVersion, issue);\n }\n\n}\n\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/inspections/NpmInspection.java",
"content": "package com.jfrog.ide.idea.inspections;\n\nimport com.intellij.codeInspection.ProblemsHolder;\nimport com.intellij.json.psi.JsonElementVisitor;\nimport com.intellij.json.psi.JsonProperty;\nimport com.intellij.lang.annotation.AnnotationHolder;\nimport com.intellij.openapi.project.Project;\nimport com.intellij.psi.PsiElement;\nimport com.intellij.psi.PsiElementVisitor;\nimport com.jfrog.ide.idea.inspections.upgradeversion.NpmUpgradeVersion;\nimport com.jfrog.ide.idea.inspections.upgradeversion.UpgradeVersion;\nimport com.jfrog.ide.idea.scan.NpmScanner;\nimport com.jfrog.ide.idea.scan.ScanManager;\nimport com.jfrog.ide.idea.scan.ScannerBase;\nimport com.jfrog.ide.idea.utils.Descriptor;\nimport org.apache.commons.lang3.StringUtils;\nimport org.jetbrains.annotations.NotNull;\n\nimport java.util.Collection;\n\n/**\n * @author yahavi\n */\npublic class NpmInspection extends AbstractInspection {\n\n public NpmInspection() {\n super(Descriptor.NPM);\n }\n\n @NotNull\n @Override\n public PsiElementVisitor buildVisitor(@NotNull final ProblemsHolder holder, boolean isOnTheFly) {\n return new JsonElementVisitor() {\n @Override\n public void visitProperty(@NotNull JsonProperty element) {\n super.visitProperty(element);\n NpmInspection.this.visitElement(holder, element, isOnTheFly);\n }\n };\n }\n\n @Override\n public void annotate(@NotNull PsiElement element, @NotNull AnnotationHolder holder) {\n if (element instanceof JsonProperty) {\n NpmInspection.this.visitElement(holder, element);\n }\n }\n\n @Override\n boolean isDependency(PsiElement element) {\n PsiElement parentElement = element.getParent().getParent();\n return parentElement != null && StringUtils.equalsAny(parentElement.getFirstChild().getText(), \"\\\"dependencies\\\"\", \"\\\"devDependencies\\\"\");\n }\n\n @Override\n ScannerBase getScanner(Project project, String path) {\n return ScanManager.getScanners(project).stream()\n .filter(manager -> StringUtils.equals(manager.getProjectPath(), path))\n .filter(this::isMatchingScanner)\n .findAny()\n .orElse(null);\n }\n\n boolean isMatchingScanner(ScannerBase scanner) {\n return scanner instanceof NpmScanner;\n }\n\n @Override\n String createComponentName(PsiElement element) {\n return StringUtils.unwrap(element.getFirstChild().getText(), \"\\\"\");\n }\n\n @Override\n UpgradeVersion getUpgradeVersion(String componentName, String fixVersion, Collection issue, String descriptorPath) {\n return new NpmUpgradeVersion(componentName, fixVersion, issue, descriptorPath);\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/inspections/ShowInDependencyTree.java",
"content": "package com.jfrog.ide.idea.inspections;\n\nimport com.intellij.codeInsight.intention.HighPriorityAction;\nimport com.intellij.codeInspection.LocalQuickFix;\nimport com.intellij.codeInspection.ProblemDescriptor;\nimport com.intellij.openapi.project.Project;\nimport com.intellij.openapi.util.Iconable;\nimport com.intellij.util.ui.tree.TreeUtil;\nimport com.jfrog.ide.common.nodes.DependencyNode;\nimport com.jfrog.ide.idea.ui.LocalComponentsTree;\nimport com.jfrog.ide.idea.ui.utils.IconUtils;\nimport com.jfrog.ide.idea.utils.Utils;\nimport org.jetbrains.annotations.NotNull;\n\nimport javax.swing.*;\n\n/**\n * Adds the yellow bulb action - \"Show in JFrog plugin\".\n *\n * @author yahavi\n */\npublic class ShowInDependencyTree implements LocalQuickFix, Iconable, HighPriorityAction {\n\n final static String SHOW_IN_TREE_MESSAGE = \"Show vulnerability info in JFrog plugin\";\n private final DependencyNode node;\n private final String dependencyDescription;\n\n public ShowInDependencyTree(DependencyNode node, String dependencyDescription) {\n this.node = node;\n this.dependencyDescription = dependencyDescription;\n }\n\n @Override\n public Icon getIcon(int flags) {\n return IconUtils.load(\"jfrog_icon\");\n }\n\n @NotNull\n @Override\n public String getFamilyName() {\n return SHOW_IN_TREE_MESSAGE + \" - \" + dependencyDescription;\n }\n\n @Override\n public void applyFix(@NotNull Project project, @NotNull ProblemDescriptor descriptor) {\n Utils.focusJFrogToolWindow(project);\n TreeUtil.selectInTree(project, node, true, LocalComponentsTree.getInstance(project), true);\n }\n}"
},
{
"path": "src/main/java/com/jfrog/ide/idea/inspections/YarnInspection.java",
"content": "package com.jfrog.ide.idea.inspections;\n\nimport com.jfrog.ide.idea.inspections.upgradeversion.UpgradeVersion;\nimport com.jfrog.ide.idea.inspections.upgradeversion.YarnUpgradeVersion;\nimport com.jfrog.ide.idea.scan.ScannerBase;\nimport com.jfrog.ide.idea.scan.YarnScanner;\n\nimport java.util.Collection;\n\n\n/**\n * @author michaels\n */\npublic class YarnInspection extends NpmInspection {\n @Override\n boolean isMatchingScanner(ScannerBase scanner) {\n return scanner instanceof YarnScanner;\n }\n\n @Override\n UpgradeVersion getUpgradeVersion(String componentName, String fixVersion, Collection issue, String descriptorPath) {\n return new YarnUpgradeVersion(componentName, fixVersion, issue, descriptorPath);\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/inspections/upgradeversion/GoUpgradeVersion.java",
"content": "package com.jfrog.ide.idea.inspections.upgradeversion;\n\nimport com.intellij.codeInspection.ProblemDescriptor;\nimport com.intellij.openapi.project.Project;\nimport com.jfrog.ide.common.go.GoComponentUpdater;\nimport com.jfrog.ide.idea.utils.GoUtils;\nimport org.jetbrains.annotations.NotNull;\n\nimport java.io.IOException;\nimport java.nio.file.Path;\nimport java.nio.file.Paths;\nimport java.util.Collection;\n\n/**\n * Adds the yellow bulb action - \"Upgrade Version\".\n *\n * @author michaels\n */\npublic class GoUpgradeVersion extends UpgradeVersion {\n private final String descriptorPath;\n\n public GoUpgradeVersion(String componentName, String fixVersion, Collection issue, String descriptorPath) {\n super(componentName, fixVersion, issue);\n this.descriptorPath = descriptorPath;\n }\n\n @Override\n public void upgradeComponentVersion(@NotNull Project project, @NotNull ProblemDescriptor descriptor) throws IOException {\n Path modulePath = Paths.get(descriptorPath).getParent();\n String goExec = GoUtils.getGoExeAndSetEnv(env, project);\n GoComponentUpdater goComponentUpdater = new GoComponentUpdater(modulePath, this.log, this.env, goExec);\n goComponentUpdater.run(componentName, fixVersion);\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/inspections/upgradeversion/GradleGroovyUpgradeVersion.java",
"content": "package com.jfrog.ide.idea.inspections.upgradeversion;\n\nimport com.intellij.codeInspection.ProblemDescriptor;\nimport com.intellij.openapi.project.Project;\nimport com.intellij.psi.PsiElement;\nimport org.apache.commons.lang3.StringUtils;\nimport org.jetbrains.annotations.NotNull;\nimport org.jetbrains.plugins.groovy.lang.psi.GroovyPsiElementFactory;\nimport org.jetbrains.plugins.groovy.lang.psi.api.statements.arguments.GrNamedArgument;\nimport org.jetbrains.plugins.groovy.lang.psi.api.statements.expressions.literals.GrLiteral;\nimport org.jetbrains.plugins.groovy.lang.psi.api.util.GrNamedArgumentsOwner;\n\nimport java.util.Collection;\n\nimport static com.jfrog.ide.idea.inspections.GradleGroovyInspection.GRADLE_VERSION_KEY;\nimport static com.jfrog.ide.idea.inspections.GradleGroovyInspection.getLiteralValue;\nimport static com.jfrog.ide.idea.inspections.GradleInspection.stripVersion;\n\n\n/**\n * Adds the yellow bulb action - \"Upgrade Version\".\n *\n * @author michaels\n */\npublic class GradleGroovyUpgradeVersion extends UpgradeVersion {\n\n public GradleGroovyUpgradeVersion(String componentName, String fixVersion, Collection issue) {\n super(componentName, fixVersion, issue);\n }\n\n @Override\n public void upgradeComponentVersion(@NotNull Project project, @NotNull ProblemDescriptor descriptor) {\n PsiElement element = descriptor.getPsiElement();\n GroovyPsiElementFactory psiFactory = GroovyPsiElementFactory.getInstance(project);\n\n if (element instanceof GrNamedArgumentsOwner) {\n // group: 'com', name: 'guava', version: '1.1.1' >> group: 'com', name: 'guava', version: '2.2.2'\n GrNamedArgument versionArg = ((GrNamedArgumentsOwner) element).findNamedArgument(GRADLE_VERSION_KEY);\n if (versionArg != null && versionArg.getExpression() != null) {\n versionArg.getExpression().replace(psiFactory.createExpressionFromText(StringUtils.wrap(fixVersion, \"'\")));\n return;\n }\n }\n\n if (element instanceof GrLiteral) {\n // 'com:guava:1.1.1' >> 'com:guava:2.2.2'\n String componentString = getLiteralValue((GrLiteral) element);\n String fixedComponentString = String.join(\":\", stripVersion(componentString), fixVersion);\n element.replace(psiFactory.createExpressionFromText(StringUtils.wrap(fixedComponentString, \"'\")));\n }\n }\n}"
},
{
"path": "src/main/java/com/jfrog/ide/idea/inspections/upgradeversion/GradleKotlinUpgradeVersion.java",
"content": "package com.jfrog.ide.idea.inspections.upgradeversion;\n\nimport com.intellij.codeInspection.ProblemDescriptor;\nimport com.intellij.openapi.project.Project;\nimport org.apache.commons.lang3.StringUtils;\nimport org.jetbrains.annotations.NotNull;\nimport org.jetbrains.kotlin.psi.KtExpression;\nimport org.jetbrains.kotlin.psi.KtStringTemplateExpression;\nimport org.jetbrains.kotlin.psi.KtValueArgument;\nimport org.jetbrains.kotlin.psi.KtValueArgumentList;\n\nimport java.util.Collection;\nimport java.util.List;\n\nimport static com.jfrog.ide.idea.inspections.GradleInspection.stripVersion;\n\n/**\n * Adds the yellow bulb action - \"Upgrade Version\".\n *\n * @author michaels\n */\npublic class GradleKotlinUpgradeVersion extends UpgradeVersion {\n\n public GradleKotlinUpgradeVersion(String componentName, String fixVersion, Collection issue) {\n super(componentName, fixVersion, issue);\n }\n\n @Override\n public void upgradeComponentVersion(@NotNull Project project, @NotNull ProblemDescriptor descriptor) {\n List argumentList = ((KtValueArgumentList) descriptor.getPsiElement()).getArguments();\n String updateText = \"\";\n KtExpression expressionToUpdate = null;\n\n if (argumentList.size() == 1) {\n // \"commons-collections:commons-collections:3.2.2\"\n expressionToUpdate = argumentList.get(0).getArgumentExpression();\n if (expressionToUpdate != null) {\n String stripQuotes = StringUtils.unwrap(expressionToUpdate.getText(), \"\\\"\");\n updateText = stripVersion(stripQuotes) + \":\" + fixVersion;\n }\n } else if (argumentList.size() >= 3) {\n // \"commons-collections\", \"commons-collections\", \"3.2.2\"\n expressionToUpdate = argumentList.get(2).getArgumentExpression();\n updateText = fixVersion;\n }\n\n if (expressionToUpdate instanceof KtStringTemplateExpression) {\n ((KtStringTemplateExpression) expressionToUpdate).updateText(StringUtils.wrap(updateText, \"\\\"\"));\n }\n }\n}"
},
{
"path": "src/main/java/com/jfrog/ide/idea/inspections/upgradeversion/MavenUpgradeVersion.java",
"content": "package com.jfrog.ide.idea.inspections.upgradeversion;\n\nimport com.intellij.codeInspection.ProblemDescriptor;\nimport com.intellij.openapi.project.Project;\nimport com.intellij.psi.impl.source.xml.XmlTagImpl;\nimport com.intellij.psi.xml.XmlTag;\nimport com.intellij.psi.xml.XmlTagValue;\nimport org.jetbrains.annotations.NotNull;\nimport org.jetbrains.idea.maven.dom.MavenDomUtil;\nimport org.jetbrains.idea.maven.dom.model.MavenDomProjectModel;\n\nimport java.util.Collection;\nimport java.util.regex.Matcher;\nimport java.util.regex.Pattern;\n\nimport static org.jetbrains.idea.maven.dom.MavenDomProjectProcessorUtils.findProperty;\n\n/**\n * Adds the yellow bulb action - \"Upgrade Version\".\n *\n * @author michaels\n */\npublic class MavenUpgradeVersion extends UpgradeVersion {\n\n private static final Pattern POM_PROPERTY_REGEX = Pattern.compile(\"^\\\\$\\\\{(.*)}\");\n\n public MavenUpgradeVersion(String componentName, String fixVersion, Collection issue) {\n super(componentName, fixVersion, issue);\n }\n\n @Override\n public void upgradeComponentVersion(@NotNull Project project, @NotNull ProblemDescriptor descriptor) {\n final XmlTag[] versions = ((XmlTagImpl) descriptor.getPsiElement()).findSubTags(\"version\");\n XmlTagValue versionTagValue = versions[0].getValue();\n Matcher propMatcher = POM_PROPERTY_REGEX.matcher(versionTagValue.getText());\n if (!propMatcher.find()) {\n // Simple version tag. (example: '1.2.3')\n versionTagValue.setText(fixVersion);\n } else {\n // Property version tag. (example: '${my.ver}')\n MavenDomProjectModel domModel = MavenDomUtil.getMavenDomProjectModel(project, descriptor.getPsiElement().getContainingFile().getVirtualFile());\n if (domModel != null) {\n XmlTag prop = findProperty(domModel.getProperties(), propMatcher.group(1));\n if (prop != null) {\n prop.getValue().setText(fixVersion);\n }\n }\n }\n }\n}"
},
{
"path": "src/main/java/com/jfrog/ide/idea/inspections/upgradeversion/NpmUpgradeVersion.java",
"content": "package com.jfrog.ide.idea.inspections.upgradeversion;\n\nimport com.intellij.codeInspection.ProblemDescriptor;\nimport com.intellij.openapi.project.Project;\nimport com.jfrog.ide.common.npm.NpmComponentUpdater;\nimport org.jetbrains.annotations.NotNull;\n\nimport java.io.IOException;\nimport java.nio.file.Path;\nimport java.nio.file.Paths;\nimport java.util.Collection;\n\n/**\n * Adds the yellow bulb action - \"Upgrade Version\".\n *\n * @author michaels\n */\npublic class NpmUpgradeVersion extends UpgradeVersion {\n private final String descriptorPath;\n\n public NpmUpgradeVersion(String componentName, String fixVersion, Collection issue, String descriptorPath) {\n super(componentName, fixVersion, issue);\n this.descriptorPath = descriptorPath;\n }\n\n @Override\n public void upgradeComponentVersion(@NotNull Project project, @NotNull ProblemDescriptor descriptor) throws IOException {\n Path modulePath = Paths.get(descriptorPath).getParent();\n NpmComponentUpdater npmComponentUpdater = new NpmComponentUpdater(modulePath, this.log, this.env);\n npmComponentUpdater.run(componentName, fixVersion);\n }\n\n}"
},
{
"path": "src/main/java/com/jfrog/ide/idea/inspections/upgradeversion/UpgradeVersion.java",
"content": "package com.jfrog.ide.idea.inspections.upgradeversion;\n\nimport com.intellij.codeInsight.intention.HighPriorityAction;\nimport com.intellij.codeInspection.LocalQuickFix;\nimport com.intellij.codeInspection.ProblemDescriptor;\nimport com.intellij.openapi.application.ApplicationManager;\nimport com.intellij.openapi.command.WriteCommandAction;\nimport com.intellij.openapi.progress.ProgressManager;\nimport com.intellij.openapi.progress.Task;\nimport com.intellij.openapi.project.Project;\nimport com.intellij.openapi.util.Iconable;\nimport com.intellij.util.EnvironmentUtil;\nimport com.jfrog.ide.idea.log.Logger;\nimport com.jfrog.ide.idea.ui.utils.IconUtils;\nimport org.jetbrains.annotations.NotNull;\n\nimport javax.swing.*;\nimport java.io.IOException;\nimport java.util.Collection;\nimport java.util.HashMap;\nimport java.util.Map;\n\n/**\n * Adds the yellow bulb action - \"Upgrade Version\".\n *\n * @author michaels\n */\npublic abstract class UpgradeVersion implements LocalQuickFix, Iconable, HighPriorityAction {\n protected String componentName;\n protected String fixVersion;\n protected String issue;\n protected Logger log;\n protected Map env;\n\n public UpgradeVersion(String componentName, String fixVersion, Collection issue) {\n this.componentName = componentName;\n this.fixVersion = fixVersion;\n this.issue = issue.toString();\n this.log = Logger.getInstance();\n this.env = new HashMap<>(EnvironmentUtil.getEnvironmentMap());\n }\n\n @Override\n public Icon getIcon(int flags) {\n return IconUtils.load(\"jfrog_icon\");\n }\n\n @NotNull\n @Override\n public String getFamilyName() {\n return \"Upgrade version to \" + fixVersion + \" to fix \" + issue;\n }\n\n @Override\n public void applyFix(@NotNull Project project, @NotNull ProblemDescriptor descriptor) {\n Task.Backgroundable scanAndUpdateTask = new Task.Backgroundable(project, \"Upgrading dependency...\") {\n @Override\n public void run(@NotNull com.intellij.openapi.progress.ProgressIndicator indicator) {\n ApplicationManager.getApplication().invokeAndWait(() -> {\n WriteCommandAction.runWriteCommandAction(project, () -> {\n try {\n upgradeComponentVersion(project, descriptor);\n log.info(\"Upgraded \" + componentName + \" to version \" + fixVersion + \" successfully.\");\n } catch (IOException e) {\n log.error(\"Failed while trying to upgrade component \" + componentName + \" to version \" + fixVersion + \". Error: \" + e);\n }\n });\n descriptor.getPsiElement().getContainingFile().getVirtualFile().refresh(false, false);\n });\n }\n };\n ProgressManager.getInstance().run(scanAndUpdateTask);\n }\n\n abstract public void upgradeComponentVersion(@NotNull Project project, @NotNull ProblemDescriptor descriptor) throws IOException;\n}"
},
{
"path": "src/main/java/com/jfrog/ide/idea/inspections/upgradeversion/YarnUpgradeVersion.java",
"content": "package com.jfrog.ide.idea.inspections.upgradeversion;\n\nimport com.intellij.codeInspection.ProblemDescriptor;\nimport com.intellij.openapi.project.Project;\nimport com.jfrog.ide.common.yarn.YarnComponentUpdater;\nimport org.jetbrains.annotations.NotNull;\n\nimport java.io.IOException;\nimport java.nio.file.Path;\nimport java.nio.file.Paths;\nimport java.util.Collection;\n\n/**\n * Adds the yellow bulb action - \"Upgrade Version\".\n *\n * @author michaels\n */\npublic class YarnUpgradeVersion extends UpgradeVersion {\n private final String descriptorPath;\n\n public YarnUpgradeVersion(String componentName, String fixVersion, Collection issue, String descriptorPath) {\n super(componentName, fixVersion, issue);\n this.descriptorPath = descriptorPath;\n }\n\n @Override\n public void upgradeComponentVersion(@NotNull Project project, @NotNull ProblemDescriptor descriptor) throws IOException {\n Path modulePath = Paths.get(descriptorPath).getParent();\n YarnComponentUpdater yarnComponentUpdater = new YarnComponentUpdater(modulePath, this.log, this.env);\n yarnComponentUpdater.run(componentName, fixVersion);\n }\n}"
},
{
"path": "src/main/java/com/jfrog/ide/idea/log/Logger.java",
"content": "package com.jfrog.ide.idea.log;\n\nimport com.intellij.notification.*;\nimport com.intellij.openapi.actionSystem.AnAction;\nimport com.intellij.openapi.actionSystem.AnActionEvent;\nimport com.intellij.openapi.application.ApplicationManager;\nimport com.intellij.openapi.options.Configurable;\nimport com.intellij.openapi.options.ShowSettingsUtil;\nimport com.intellij.openapi.project.Project;\nimport com.intellij.openapi.ui.popup.Balloon;\nimport com.intellij.openapi.ui.popup.JBPopupFactory;\nimport com.intellij.openapi.wm.StatusBar;\nimport com.intellij.openapi.wm.WindowManager;\nimport com.intellij.ui.JBColor;\nimport com.intellij.ui.awt.RelativePoint;\nimport com.jfrog.ide.idea.ui.utils.IconUtils;\nimport org.apache.commons.lang3.StringUtils;\nimport org.codehaus.plexus.util.ExceptionUtils;\nimport org.jetbrains.annotations.NotNull;\nimport org.jfrog.build.api.util.Log;\n\nimport static javax.swing.event.HyperlinkEvent.EventType.ACTIVATED;\n\n/**\n * @author yahavi\n */\npublic class Logger implements Log {\n private static final long serialVersionUID = 1L;\n\n private static final NotificationGroup EVENT_LOG_NOTIFIER = NotificationGroupManager.getInstance().getNotificationGroup(\"JFrog Log\");\n private static final NotificationGroup BALLOON_NOTIFIER = NotificationGroupManager.getInstance().getNotificationGroup(\"JFrog Errors\");\n private static final com.intellij.openapi.diagnostic.Logger ideaLogger = com.intellij.openapi.diagnostic.Logger.getInstance(Logger.class);\n private static Notification lastNotification;\n\n private static final String INFORMATION_TITLE = \"JFrog\";\n private static final String ERROR_TITLE = \"JFrog scan failed\";\n\n public static Logger getInstance() {\n return ApplicationManager.getApplication().getService(Logger.class);\n }\n\n private Logger() {\n }\n\n @Override\n public void debug(String message) {\n ideaLogger.debug(message);\n }\n\n @Override\n public void info(String message) {\n ideaLogger.info(message);\n NotificationType notificationType = NotificationType.INFORMATION;\n log(INFORMATION_TITLE, message, notificationType);\n }\n\n @Override\n public void warn(String message) {\n ideaLogger.warn(message);\n NotificationType notificationType = NotificationType.WARNING;\n log(INFORMATION_TITLE, message, notificationType);\n }\n\n /**\n * Log an error.\n * Notice - For the best user experience, make sure that only interactive actions should call this method.\n *\n * @param message - The message to log\n */\n @Override\n public void error(String message) {\n // We log to IntelliJ log in \"warn\" log level to avoid popup annoying fatal errors\n ideaLogger.warn(message);\n NotificationType notificationType = NotificationType.ERROR;\n popupBalloon(message, notificationType);\n log(ERROR_TITLE, message, notificationType);\n }\n\n /**\n * Log an error.\n * Notice - For the best user experience, make sure that only interactive actions should call this method.\n *\n * @param message - The message to log\n * @param t - The exception raised\n */\n @Override\n public void error(String message, Throwable t) {\n // We log to IntelliJ log in \"warn\" log level to avoid popup annoying fatal errors\n ideaLogger.warn(message, t);\n NotificationType notificationType = NotificationType.ERROR;\n popupBalloon(message, notificationType);\n String title = StringUtils.defaultIfBlank(t.getMessage(), ERROR_TITLE);\n log(title, message + System.lineSeparator() + ExceptionUtils.getStackTrace(t), notificationType);\n }\n\n private static void log(String title, String details, NotificationType notificationType) {\n if (StringUtils.isBlank(details)) {\n details = title;\n }\n Notifications.Bus.notify(EVENT_LOG_NOTIFIER.createNotification(title, prependPrefix(details, notificationType), notificationType));\n }\n\n private static void popupBalloon(String content, NotificationType notificationType) {\n if (lastNotification != null) {\n lastNotification.hideBalloon();\n }\n if (StringUtils.isBlank(content)) {\n content = ERROR_TITLE;\n }\n Notification notification = BALLOON_NOTIFIER.createNotification(ERROR_TITLE, content, notificationType);\n lastNotification = notification;\n Notifications.Bus.notify(notification);\n }\n\n private static String prependPrefix(String message, NotificationType notificationType) {\n return switch (notificationType) {\n case WARNING -> \"[WARN] \" + message;\n case ERROR -> \"[ERROR] \" + message;\n default -> \"[INFO] \" + message;\n };\n }\n\n /**\n * Add a log message with an open settings link.\n * Usage example:\n * Logger.openSettings(\"It looks like Gradle home was not properly set in your project.\n * Click here to set Gradle home.\", project, GradleConfigurable.class);\n *\n * @param details - The log message\n * @param project - IDEA project\n * @param configurable - IDEA settings to open\n */\n public static void addOpenSettingsLink(String details, Project project, Class configurable) {\n EVENT_LOG_NOTIFIER.createNotification(INFORMATION_TITLE, prependPrefix(details, NotificationType.INFORMATION), NotificationType.INFORMATION)\n .addAction(new AnAction() {\n @Override\n public void actionPerformed(@NotNull AnActionEvent e) {\n ShowSettingsUtil.getInstance().showSettingsDialog(project, configurable);\n }\n })\n .notify(project);\n }\n\n /**\n * Popup a balloon with an actionable link.\n * Usage example:\n * Logger.showActionableBalloon(project,\n * \"The scan results have expired. Click here to trigger a scan.\",\n * () -> ScanManager.getInstance(project).startScan());\n *\n * @param project - IDEA project\n * @param htmlContent - The log message\n * @param action - The action to perform\n */\n public static void showActionableBalloon(Project project, String htmlContent, Runnable action) {\n StatusBar statusBar = WindowManager.getInstance().getStatusBar(project);\n JBPopupFactory.getInstance().createHtmlTextBalloonBuilder(htmlContent,\n IconUtils.load(\"jfrog_icon\"),\n JBColor.foreground(),\n JBColor.background(),\n event -> {\n if (event.getEventType() != ACTIVATED) {\n return;\n }\n action.run();\n })\n .setCloseButtonEnabled(true)\n .setHideOnAction(true)\n .setHideOnClickOutside(true)\n .setHideOnLinkClick(true)\n .setHideOnKeyOutside(true)\n .setDialogMode(true)\n .createBalloon()\n .show(RelativePoint.getNorthWestOf(statusBar.getComponent()), Balloon.Position.atRight);\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/log/ProgressIndicatorImpl.java",
"content": "package com.jfrog.ide.idea.log;\n\n\nimport com.intellij.openapi.progress.ProgressIndicator;\n\n/**\n * @author yahavi\n */\npublic class ProgressIndicatorImpl implements com.jfrog.ide.common.log.ProgressIndicator {\n\n private final ProgressIndicator indicator;\n\n public ProgressIndicatorImpl(ProgressIndicator indicator) {\n this.indicator = indicator;\n }\n\n @Override\n public void setFraction(double fraction) {\n indicator.setIndeterminate(false);\n indicator.setFraction(fraction);\n }\n\n @Override\n public void setIndeterminate(boolean indeterminate) {\n indicator.setIndeterminate(true);\n }\n\n @Override\n public void setText(String text) {\n indicator.setText(text);\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/navigation/NavigationService.java",
"content": "package com.jfrog.ide.idea.navigation;\n\nimport com.google.common.collect.Maps;\nimport com.intellij.openapi.editor.Document;\nimport com.intellij.openapi.project.Project;\nimport com.intellij.psi.FileViewProvider;\nimport com.intellij.psi.PsiElement;\nimport com.intellij.psi.PsiFile;\nimport com.jfrog.ide.common.nodes.DependencyNode;\nimport org.jetbrains.annotations.NotNull;\n\nimport java.util.Collections;\nimport java.util.HashSet;\nimport java.util.Map;\nimport java.util.Set;\n\n/**\n * Created by Bar Belity on 27/04/2020.\n * Manage navigation from node in Issues-tree to its corresponding item in the project descriptor.\n */\npublic class NavigationService {\n\n private final Map> navigationMap = Maps.newHashMap();\n\n public static NavigationService getInstance(@NotNull Project project) {\n return project.getService(NavigationService.class);\n }\n\n /**\n * Clear existing navigation map.\n */\n public static void clearNavigationMap(@NotNull Project project) {\n NavigationService navigationService = NavigationService.getInstance(project);\n navigationService.navigationMap.clear();\n }\n\n /**\n * Add a navigation element to the node in tree.\n *\n * @param treeNode The tree-node to register the navigation from.\n * @param navigationTargetElement The PsiElement we register the navigation to.\n */\n public void addNavigation(DependencyNode treeNode, PsiElement navigationTargetElement, String componentName) {\n PsiFile containingFile = navigationTargetElement.getContainingFile();\n FileViewProvider fileViewProvider = containingFile.getViewProvider();\n Document document = fileViewProvider.getDocument();\n if (document == null) {\n return;\n }\n NavigationTarget navigationTarget = new NavigationTarget(navigationTargetElement, document.getLineNumber(navigationTargetElement.getTextOffset()), componentName);\n Set navigationTargets = navigationMap.get(treeNode);\n if (navigationTargets == null) {\n navigationTargets = new HashSet<>(Collections.singletonList(navigationTarget));\n\n navigationMap.put(treeNode, navigationTargets);\n return;\n }\n navigationTargets.add(navigationTarget);\n }\n\n /**\n * Get navigation targets for a specific node in tree.\n *\n * @param treeNode The tree-node to get its navigation.\n * @return Set of candidates for navigation.\n */\n public Set getNavigation(DependencyNode treeNode) {\n return navigationMap.get(treeNode);\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/navigation/NavigationTarget.java",
"content": "package com.jfrog.ide.idea.navigation;\n\nimport com.intellij.psi.PsiElement;\n\nimport java.util.Objects;\n\n/**\n * Created by Bar Belity on 14/05/2020.\n */\npublic class NavigationTarget {\n\n private final PsiElement element;\n private final int lineNumber;\n\n private final String componentName;\n\n NavigationTarget(PsiElement element, int lineNumber, String componentName) {\n this.element = element;\n this.lineNumber = lineNumber;\n this.componentName = componentName;\n }\n\n public PsiElement getElement() {\n return element;\n }\n\n public int getLineNumber() {\n return lineNumber;\n }\n\n public String getComponentName() {\n return componentName;\n }\n\n @Override\n public boolean equals(Object o) {\n if (this == o) return true;\n if (!(o instanceof NavigationTarget)) return false;\n NavigationTarget that = (NavigationTarget) o;\n return lineNumber == that.lineNumber &&\n element.isValid() && that.element.isValid() &&\n Objects.equals(element.getContainingFile(), that.element.getContainingFile());\n }\n\n @Override\n public int hashCode() {\n return Objects.hash(element.getContainingFile(), lineNumber);\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/ApplicabilityScannerExecutor.java",
"content": "package com.jfrog.ide.idea.scan;\n\nimport com.jfrog.ide.common.log.ProgressIndicator;\nimport com.jfrog.ide.common.nodes.ApplicableIssueNode;\nimport com.jfrog.ide.common.nodes.FileTreeNode;\nimport com.jfrog.ide.common.nodes.VulnerabilityNode;\nimport com.jfrog.ide.common.nodes.subentities.SourceCodeScanType;\nimport com.jfrog.ide.idea.inspections.JFrogSecurityWarning;\nimport com.jfrog.ide.idea.scan.data.*;\nimport com.jfrog.xray.client.services.entitlements.Feature;\nimport org.apache.commons.lang3.StringUtils;\nimport org.jfrog.build.api.util.Log;\n\nimport java.io.IOException;\nimport java.nio.file.Path;\nimport java.util.*;\nimport java.util.stream.Collectors;\n\n/**\n * @author Tal Arian\n */\npublic class ApplicabilityScannerExecutor extends ScanBinaryExecutor {\n private static final List SCANNER_ARGS = List.of(\"ca\");\n private static final List SUPPORTED_PACKAGE_TYPES = List.of(PackageManagerType.PYPI, PackageManagerType.NPM, PackageManagerType.YARN, PackageManagerType.GRADLE, PackageManagerType.MAVEN);\n\n public ApplicabilityScannerExecutor(Log log) {\n super(SourceCodeScanType.CONTEXTUAL, log);\n supportedPackageTypes = SUPPORTED_PACKAGE_TYPES;\n }\n\n public List execute(ScanConfig.Builder inputFileBuilder, Runnable checkCanceled, ProgressIndicator indicator) throws IOException, InterruptedException {\n return super.execute(inputFileBuilder, SCANNER_ARGS, checkCanceled, indicator);\n }\n\n @Override\n protected List parseOutputSarif(Path outputFile) throws IOException, IndexOutOfBoundsException {\n Output output = getOutputObj(outputFile);\n List warnings = new ArrayList<>();\n for (Run run : output.getRuns()) {\n List rules = run.getTool().getDriver().getRules();\n Map> resultsByRule = run.getResults().stream()\n .filter(SarifResult::isNotSuppressed)\n .filter(r -> !\"informational\".equals(r.getKind()))\n .collect(Collectors.groupingBy(SarifResult::getRuleId));\n\n for (Rule rule : getUniqueRules(rules)) {\n Optional props = rule.getRuleProperties();\n if (props.isEmpty()) {\n continue;\n }\n String applicability = props.get().getApplicability();\n if (applicability == null) {\n continue;\n }\n\n if (\"applicable\".equals(applicability)) {\n List evidence = resultsByRule.getOrDefault(rule.getId(), List.of());\n for (SarifResult result : evidence) {\n if (!result.getLocations().isEmpty()) {\n warnings.add(new JFrogSecurityWarning(result, scanType, rule));\n }\n }\n } else if (\"not_applicable\".equals(applicability)) {\n warnings.add(JFrogSecurityWarning.notApplicable(rule.getId(), scanType));\n }\n }\n }\n return warnings;\n }\n\n private List getUniqueRules(List rules) {\n Map ruleMap = new LinkedHashMap<>();\n for (Rule rule : rules) {\n Rule existing = ruleMap.get(rule.getId());\n if (existing == null) {\n ruleMap.put(rule.getId(), rule);\n } else {\n Optional existingProps = existing.getRuleProperties();\n if (existingProps.isPresent() && \"not_applicable\".equals(existingProps.get().getApplicability())) {\n Optional currentProps = rule.getRuleProperties();\n if (currentProps.isPresent() && !\"not_applicable\".equals(currentProps.get().getApplicability())) {\n ruleMap.put(rule.getId(), rule);\n }\n }\n }\n }\n return new ArrayList<>(ruleMap.values());\n }\n\n @Override\n List createSpecificFileIssueNodes(List warnings) {\n return createSpecificFileIssueNodes(warnings, new HashMap<>());\n }\n\n List createSpecificFileIssueNodes(List warnings, Map> issuesMap) {\n HashMap results = new HashMap<>();\n for (JFrogSecurityWarning warning : warnings) {\n // Update all VulnerabilityNodes that have the warning's CVE\n String cve = StringUtils.removeStart(warning.getRuleID(), \"applic_\");\n List issues = issuesMap.get(cve);\n if (issues != null) {\n if (warning.isApplicable()) {\n // Create FileTreeNodes for files with applicable issues\n FileTreeNode fileNode = results.get(warning.getFilePath());\n if (fileNode == null) {\n fileNode = new FileTreeNode(warning.getFilePath());\n results.put(warning.getFilePath(), fileNode);\n }\n\n ApplicableIssueNode applicableIssue = new ApplicableIssueNode(\n cve, warning.getLineStart(), warning.getColStart(), warning.getLineEnd(), warning.getColEnd(),\n warning.getFilePath(), warning.getReason(), warning.getLineSnippet(), warning.getScannerSearchTarget(),\n issues.get(0), warning.getRuleID());\n fileNode.addIssue(applicableIssue);\n for (VulnerabilityNode issue : issues) {\n issue.updateApplicableInfo(applicableIssue);\n }\n } else {\n // Mark non-applicable vulnerabilities.\n for (VulnerabilityNode issue : issues) {\n issue.setNotApplicable();\n }\n }\n }\n }\n return new ArrayList<>(results.values());\n }\n\n @Override\n Feature getScannerFeatureName() {\n return Feature.CONTEXTUAL_ANALYSIS;\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/GoScanner.java",
"content": "package com.jfrog.ide.idea.scan;\n\nimport com.google.common.collect.Maps;\nimport com.intellij.diagnostic.PluginException;\nimport com.intellij.openapi.project.Project;\nimport com.intellij.openapi.vfs.LocalFileSystem;\nimport com.intellij.openapi.vfs.VirtualFile;\nimport com.intellij.psi.PsiFile;\nimport com.intellij.psi.PsiManager;\nimport com.intellij.util.EnvironmentUtil;\nimport com.jfrog.ide.common.deptree.DepTree;\nimport com.jfrog.ide.common.go.GoTreeBuilder;\nimport com.jfrog.ide.common.scan.ComponentPrefix;\nimport com.jfrog.ide.common.scan.ScanLogic;\nimport com.jfrog.ide.idea.inspections.AbstractInspection;\nimport com.jfrog.ide.idea.inspections.GoInspection;\nimport com.jfrog.ide.idea.scan.data.PackageManagerType;\nimport com.jfrog.ide.idea.ui.ComponentsTree;\nimport com.jfrog.ide.idea.ui.menus.filtermanager.ConsistentFilterManager;\nimport com.jfrog.ide.idea.utils.GoUtils;\n\nimport javax.annotation.Nullable;\nimport java.io.IOException;\nimport java.nio.file.Paths;\nimport java.util.Map;\nimport java.util.concurrent.ExecutorService;\n\n/**\n * Created by Bar Belity on 06/02/2020.\n */\npublic class GoScanner extends SingleDescriptorScanner {\n private final GoTreeBuilder goTreeBuilder;\n\n /**\n * @param project currently opened IntelliJ project. We'll use this project to retrieve project based services\n * like {@link ConsistentFilterManager} and {@link ComponentsTree}.\n * @param basePath the go.mod directory\n * @param executor an executor that should limit the number of running tasks to 3\n * @param scanLogic the scan logic to use\n */\n GoScanner(Project project, String basePath, ExecutorService executor, ScanLogic scanLogic) {\n super(project, basePath, ComponentPrefix.GO, executor, Paths.get(basePath, \"go.mod\").toString(), scanLogic);\n getLog().info(\"Found Go project: \" + getProjectPath());\n Map env = Maps.newHashMap(EnvironmentUtil.getEnvironmentMap());\n String goExec = null;\n try {\n goExec = GoUtils.getGoExeAndSetEnv(env, project);\n } catch (NoClassDefFoundError error) {\n getLog().warn(\"Go plugin is not installed. Install it to get a better experience.\");\n }\n goTreeBuilder = new GoTreeBuilder(goExec, Paths.get(basePath), descriptorFilePath, env, getLog());\n }\n\n @Override\n protected DepTree buildTree() throws IOException {\n return goTreeBuilder.buildTree();\n }\n\n @Override\n protected PsiFile[] getProjectDescriptors() {\n VirtualFile file = LocalFileSystem.getInstance().findFileByPath(descriptorFilePath);\n if (file == null) {\n return null;\n }\n PsiFile psiFile = PsiManager.getInstance(project).findFile(file);\n return new PsiFile[]{psiFile};\n }\n\n @Override\n protected @Nullable AbstractInspection getInspectionTool() {\n try {\n return new GoInspection();\n } catch (PluginException e) {\n // Go plugin is disabled or not installed\n getLog().warn(\"Inspections for Go projects require the Go language plugin to be installed and enabled. \" +\n \"Please make sure the Go plugin is installed and enabled for a complete experience.\");\n return null;\n }\n }\n\n @Override\n protected PackageManagerType getPackageManagerType() {\n return PackageManagerType.GO;\n }\n\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/GradleScanner.java",
"content": "package com.jfrog.ide.idea.scan;\n\nimport com.google.common.collect.Maps;\nimport com.intellij.ide.plugins.PluginManagerCore;\nimport com.intellij.openapi.application.ApplicationManager;\nimport com.intellij.openapi.extensions.PluginId;\nimport com.intellij.openapi.project.Project;\nimport com.intellij.openapi.vfs.LocalFileSystem;\nimport com.intellij.openapi.vfs.VirtualFile;\nimport com.intellij.psi.PsiFile;\nimport com.intellij.psi.PsiManager;\nimport com.intellij.util.EnvironmentUtil;\nimport com.jfrog.ide.common.deptree.DepTree;\nimport com.jfrog.ide.common.gradle.GradleTreeBuilder;\nimport com.jfrog.ide.common.scan.ComponentPrefix;\nimport com.jfrog.ide.common.scan.ScanLogic;\nimport com.jfrog.ide.idea.inspections.AbstractInspection;\nimport com.jfrog.ide.idea.inspections.GradleGroovyInspection;\nimport com.jfrog.ide.idea.inspections.GradleKotlinInspection;\nimport com.jfrog.ide.idea.log.Logger;\nimport com.jfrog.ide.idea.scan.data.PackageManagerType;\nimport com.jfrog.ide.idea.ui.ComponentsTree;\nimport com.jfrog.ide.idea.ui.menus.filtermanager.ConsistentFilterManager;\nimport org.apache.commons.lang3.StringUtils;\nimport org.apache.commons.lang3.SystemUtils;\nimport org.jetbrains.plugins.gradle.service.GradleInstallationManager;\nimport org.jetbrains.plugins.gradle.service.settings.GradleConfigurable;\nimport org.jetbrains.plugins.gradle.settings.DistributionType;\nimport org.jetbrains.plugins.gradle.settings.GradleProjectSettings;\nimport org.jetbrains.plugins.gradle.settings.GradleSettings;\n\nimport java.io.File;\nimport java.io.IOException;\nimport java.nio.file.Files;\nimport java.nio.file.Path;\nimport java.nio.file.Paths;\nimport java.util.Map;\nimport java.util.concurrent.ExecutorService;\n\nimport static com.jfrog.ide.common.log.Utils.logError;\n\n/**\n * Created by Yahav Itzhak on 9 Nov 2017.\n */\npublic class GradleScanner extends SingleDescriptorScanner {\n private final GradleTreeBuilder gradleTreeBuilder;\n private boolean kotlin;\n\n /**\n * @param project currently opened IntelliJ project. We'll use this project to retrieve project based services\n * like {@link ConsistentFilterManager} and {@link ComponentsTree}.\n * @param basePath the build.gradle or build.gradle.kts directory\n * @param executor an executor that should limit the number of running tasks to 3\n * @param scanLogic the scan logic to use\n */\n GradleScanner(Project project, String basePath, ExecutorService executor, ScanLogic scanLogic) {\n super(project, basePath, ComponentPrefix.GAV, executor, scanLogic);\n getLog().info(\"Found Gradle project: \" + getProjectPath());\n Path dirPath = Paths.get(this.basePath);\n Path buildGradleKotlinPath = dirPath.resolve(\"build.gradle.kts\");\n if (Files.exists(buildGradleKotlinPath)) {\n descriptorFilePath = buildGradleKotlinPath.toString();\n } else {\n descriptorFilePath = dirPath.resolve(\"build.gradle\").toString();\n }\n Map env = Maps.newHashMap(EnvironmentUtil.getEnvironmentMap());\n Path pluginLibDir = PluginManagerCore.getPlugin(PluginId.findId(\"org.jfrog.idea\")).getPluginPath().resolve(\"lib\");\n env.put(\"pluginLibDir\", pluginLibDir.toAbsolutePath().toString());\n gradleTreeBuilder = new GradleTreeBuilder(Paths.get(basePath), descriptorFilePath, env, getGradleExeAndJdk(env));\n }\n\n @Override\n protected PsiFile[] getProjectDescriptors() {\n LocalFileSystem localFileSystem = LocalFileSystem.getInstance();\n Path basePath = Paths.get(this.basePath);\n VirtualFile file = localFileSystem.findFileByPath(basePath.resolve(\"build.gradle\").toString());\n if (file == null) {\n file = localFileSystem.findFileByPath(basePath.resolve(\"build.gradle.kts\").toString());\n if (file == null) {\n return null;\n }\n kotlin = true;\n }\n PsiFile psiFile = PsiManager.getInstance(project).findFile(file);\n return new PsiFile[]{psiFile};\n }\n\n @Override\n protected AbstractInspection getInspectionTool() {\n return kotlin ? new GradleKotlinInspection() : new GradleGroovyInspection();\n }\n\n @Override\n protected PackageManagerType getPackageManagerType() {\n return PackageManagerType.GRADLE;\n }\n\n @Override\n protected DepTree buildTree() throws IOException {\n return gradleTreeBuilder.buildTree(getLog());\n }\n\n /**\n * Extract the chosen Gradle executable path from the Gradle plugin. If Gradle is not configured well, return null.\n *\n * @param env - The environment variables map to set the JAVA_HOME\n * @return the chosen Gradle executable path or null\n */\n String getGradleExeAndJdk(Map env) {\n File gradleHome = resolveGradleAndSetJavaHome(env);\n if (gradleHome == null) {\n getLog().info(\"Using Gradle from system path.\");\n return null;\n }\n String gradleExe = gradleHome.toPath().resolve(\"bin\").resolve(SystemUtils.IS_OS_WINDOWS ? \"gradle.bat\" : \"gradle\").toString();\n getLog().info(\"Using Gradle executable \" + gradleExe);\n return gradleExe;\n }\n\n /**\n * Resolve Gradle executable and Java home from Gradle settings.\n *\n * @param env - The environment variables to set the JAVA_HOME\n * @return gradle executable\n */\n private File resolveGradleAndSetJavaHome(Map env) {\n GradleSettings gradleSettings = GradleSettings.getInstance(project);\n GradleProjectSettings projectSettings = gradleSettings.getLinkedProjectSettings(basePath);\n if (projectSettings == null && SystemUtils.IS_OS_WINDOWS) {\n projectSettings = gradleSettings.getLinkedProjectSettings(basePath.replaceAll(\"\\\\\\\\\", \"/\"));\n }\n if (projectSettings == null) {\n logError(getLog(), \"Couldn't retrieve Gradle project settings. Hint - make sure the Gradle project was properly imported.\", false);\n return null;\n }\n GradleInstallationManager gradleInstallationManager = ApplicationManager.getApplication().getService(GradleInstallationManager.class);\n\n // Set JAVA_HOME\n String javaHome = gradleInstallationManager.getGradleJvmPath(project, projectSettings.getExternalProjectPath());\n if (StringUtils.isNotBlank(javaHome)) {\n getLog().info(\"Using Java home: \" + javaHome);\n env.put(\"JAVA_HOME\", javaHome);\n }\n\n File gradleHome = gradleInstallationManager.getGradleHome(project, projectSettings.getExternalProjectPath());\n if (gradleHome != null) {\n return gradleHome;\n }\n if (StringUtils.isNotBlank(projectSettings.getGradleHome())) {\n return new File(projectSettings.getGradleHome());\n }\n\n // Gradle wasn't set properly\n if (isMisconfigurationError(projectSettings.getExternalProjectPath())) {\n Logger.addOpenSettingsLink(\"It looks like Gradle home was not properly set in your project. \" +\n \"Click here to set Gradle home.\", project, GradleConfigurable.class);\n } else {\n getLog().warn(\"Can't run Gradle from Gradle settings. Hint - try to reload Gradle project and then refresh the scan.\");\n }\n return null;\n }\n\n private boolean isMisconfigurationError(String linkedProjectPath) {\n GradleProjectSettings projectSettings = GradleSettings.getInstance(project).getLinkedProjectSettings(linkedProjectPath);\n if (projectSettings != null) {\n DistributionType distributionType = projectSettings.getDistributionType();\n // Distribution type has not been chosen or the distribution type is not Gradle wrapper.\n // If the distribution type is wrapped, it is probable that the Gradle wrapper is not yet created.\n return distributionType == null || !distributionType.isWrapped();\n }\n // Gradle project settings are not set\n return true;\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/IACScannerExecutor.java",
"content": "package com.jfrog.ide.idea.scan;\n\nimport com.jfrog.ide.common.log.ProgressIndicator;\nimport com.jfrog.ide.common.nodes.FileIssueNode;\nimport com.jfrog.ide.common.nodes.FileTreeNode;\nimport com.jfrog.ide.common.nodes.subentities.SourceCodeScanType;\nimport com.jfrog.ide.idea.inspections.JFrogSecurityWarning;\nimport com.jfrog.ide.idea.scan.data.PackageManagerType;\nimport com.jfrog.ide.idea.scan.data.ScanConfig;\nimport com.jfrog.xray.client.services.entitlements.Feature;\nimport org.jfrog.build.api.util.Log;\n\nimport java.io.IOException;\nimport java.util.ArrayList;\nimport java.util.HashMap;\nimport java.util.List;\n\n/**\n * @author Tal Arian\n */\npublic class IACScannerExecutor extends ScanBinaryExecutor {\n private static final List SCANNER_ARGS = List.of(\"iac\");\n private static final String ISSUE_TITLE = \"Infrastructure as Code Vulnerability\";\n\n public IACScannerExecutor(Log log) {\n super(SourceCodeScanType.IAC, log);\n }\n\n public List execute(ScanConfig.Builder inputFileBuilder, Runnable checkCanceled, ProgressIndicator indicator) throws IOException, InterruptedException {\n return super.execute(inputFileBuilder, SCANNER_ARGS, checkCanceled, indicator);\n }\n\n @Override\n List createSpecificFileIssueNodes(List warnings) {\n HashMap results = new HashMap<>();\n for (JFrogSecurityWarning warning : warnings) {\n // Create FileTreeNodes for files with found issues\n FileTreeNode fileNode = results.get(warning.getFilePath());\n if (fileNode == null) {\n fileNode = new FileTreeNode(warning.getFilePath());\n results.put(warning.getFilePath(), fileNode);\n }\n\n FileIssueNode issueNode = new FileIssueNode(ISSUE_TITLE,\n warning.getFilePath(), warning.getLineStart(), warning.getColStart(), warning.getLineEnd(), warning.getColEnd(),\n warning.getScannerSearchTarget(), warning.getLineSnippet(), warning.getReporter(), warning.getSeverity(), warning.getRuleID());\n fileNode.addIssue(issueNode);\n }\n return new ArrayList<>(results.values());\n }\n\n @Override\n public Feature getScannerFeatureName() {\n return Feature.INFRASTRUCTURE_AS_CODE;\n }\n\n @Override\n protected boolean isPackageTypeSupported(PackageManagerType packageType) {\n return true;\n }\n\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/MavenScanner.java",
"content": "package com.jfrog.ide.idea.scan;\n\nimport com.intellij.ide.highlighter.XmlFileType;\nimport com.intellij.openapi.project.Project;\nimport com.intellij.openapi.vfs.VirtualFile;\nimport com.intellij.psi.PsiFile;\nimport com.intellij.psi.PsiManager;\nimport com.intellij.psi.search.FilenameIndex;\nimport com.intellij.psi.search.GlobalSearchScope;\nimport com.jfrog.ide.common.deptree.DepTree;\nimport com.jfrog.ide.common.deptree.DepTreeNode;\nimport com.jfrog.ide.common.nodes.DependencyNode;\nimport com.jfrog.ide.common.nodes.DescriptorFileTreeNode;\nimport com.jfrog.ide.common.nodes.FileTreeNode;\nimport com.jfrog.ide.common.scan.ComponentPrefix;\nimport com.jfrog.ide.common.scan.ScanLogic;\nimport com.jfrog.ide.idea.inspections.AbstractInspection;\nimport com.jfrog.ide.idea.inspections.MavenInspection;\nimport com.jfrog.ide.idea.scan.data.PackageManagerType;\nimport com.jfrog.ide.idea.ui.ComponentsTree;\nimport com.jfrog.ide.idea.ui.menus.filtermanager.ConsistentFilterManager;\nimport com.jfrog.ide.idea.utils.Utils;\nimport org.jetbrains.annotations.NotNull;\nimport org.jetbrains.idea.maven.model.MavenArtifact;\nimport org.jetbrains.idea.maven.model.MavenArtifactNode;\nimport org.jetbrains.idea.maven.model.MavenArtifactState;\nimport org.jetbrains.idea.maven.model.MavenId;\nimport org.jetbrains.idea.maven.project.MavenProject;\nimport org.jetbrains.idea.maven.project.MavenProjectsManager;\n\nimport java.nio.file.Path;\nimport java.nio.file.Paths;\nimport java.util.*;\nimport java.util.concurrent.CopyOnWriteArrayList;\nimport java.util.concurrent.ExecutorService;\nimport java.util.stream.Collectors;\n\nimport static com.jfrog.ide.common.utils.Utils.createComponentId;\n\n/**\n * Created by romang on 3/2/17.\n */\npublic class MavenScanner extends ScannerBase {\n private final String POM_FILE_NAME = \"pom.xml\";\n\n /**\n * @param project - Currently opened IntelliJ project. We'll use this project to retrieve project based services\n * like {@link ConsistentFilterManager} and {@link ComponentsTree}.\n * @param executor - An executor that should limit the number of running tasks to 3\n */\n MavenScanner(Project project, ExecutorService executor, ScanLogic scanLogic) {\n super(project, Utils.getProjectBasePath(project).toString(), ComponentPrefix.GAV, executor, scanLogic);\n getLog().info(\"Found Maven project: \" + getProjectPath());\n }\n\n static boolean isApplicable(@NotNull Project project) {\n return MavenProjectsManager.getInstance(project).hasProjects();\n }\n\n /**\n * Returns all project modules locations as Paths.\n * Other scanners such as npm will use this paths in order to find modules.\n *\n * @return all project modules locations as Paths\n */\n public Set getProjectPaths() {\n return MavenProjectsManager.getInstance(project).getProjects().stream()\n .map(MavenProject::getDirectory)\n .map(Paths::get)\n .collect(Collectors.toSet());\n }\n\n @Override\n protected DepTree buildTree() {\n String rootId = project.getName();\n DepTreeNode rootNode = new DepTreeNode();\n Map nodes = new HashMap<>();\n MavenProjectsManager.getInstance(project).getRootProjects().forEach(rootMavenProject -> populateMavenModule(nodes, rootNode, rootMavenProject));\n if (rootNode.getChildren().size() == 1) {\n return new DepTree(rootNode.getChildren().iterator().next(), nodes);\n }\n nodes.put(rootId, rootNode);\n return new DepTree(rootId, nodes);\n }\n\n @Override\n protected PsiFile[] getProjectDescriptors() {\n // As project can contain subprojects, look for all 'pom.xml' files under it.\n GlobalSearchScope scope = GlobalSearchScope.getScopeRestrictedByFileTypes(GlobalSearchScope.projectScope(project), XmlFileType.INSTANCE);\n Collection allPoms = FilenameIndex.getVirtualFilesByName(POM_FILE_NAME, scope);\n PsiManager psiManager = PsiManager.getInstance(project);\n return allPoms.stream().map(psiManager::findFile).toArray(PsiFile[]::new);\n }\n\n @Override\n protected AbstractInspection getInspectionTool() {\n return new MavenInspection();\n }\n\n @Override\n protected PackageManagerType getPackageManagerType() {\n return PackageManagerType.MAVEN;\n }\n\n /**\n * Populate recursively the dependency tree with the maven module and its dependencies.\n *\n * @param nodes a map of {@link DepTreeNode}s by their component IDs to be filled with the module's components.\n * @param parentModule the parent dependency node\n * @param mavenProject the root Maven project\n */\n private void populateMavenModule(Map nodes, DepTreeNode parentModule, MavenProject mavenProject) {\n MavenId mavenId = mavenProject.getMavenId();\n String compId = createComponentId(mavenId.getGroupId(), mavenId.getArtifactId(), mavenId.getVersion());\n DepTreeNode mavenNode = getOrCreateMavenModuleNode(nodes, compId, mavenProject);\n parentModule.getChildren().add(compId);\n addMavenProjectDependencies(nodes, mavenNode, mavenProject);\n mavenProject.getExistingModuleFiles().stream()\n .map(this::getModuleByVirtualFile)\n .filter(Objects::nonNull)\n .forEach(mavenModule -> populateMavenModule(nodes, mavenNode, mavenModule));\n }\n\n private MavenProject getModuleByVirtualFile(VirtualFile virtualFile) {\n return MavenProjectsManager.getInstance(project).getProjects()\n .stream()\n .filter(mavenModule -> Objects.equals(mavenModule.getFile().getCanonicalPath(), virtualFile.getCanonicalPath()))\n .findAny()\n .orElse(null);\n }\n\n private void addMavenProjectDependencies(Map nodes, DepTreeNode moduleNode, MavenProject mavenProject) {\n mavenProject.getDependencyTree()\n .stream()\n .filter(mavenArtifactNode -> mavenArtifactNode.getState() == MavenArtifactState.ADDED)\n .forEach(mavenArtifactNode -> updateChildrenNodes(nodes, moduleNode, mavenArtifactNode, true));\n }\n\n private DepTreeNode getOrCreateMavenModuleNode(Map nodes, String moduleCompId, MavenProject mavenProject) {\n if (!nodes.containsKey(moduleCompId)) {\n nodes.put(moduleCompId, new DepTreeNode());\n }\n return nodes.get(moduleCompId).descriptorFilePath(mavenProject.getPath());\n }\n\n private void updateChildrenNodes(Map nodes, DepTreeNode parentNode, MavenArtifactNode mavenArtifactNode, boolean setScopes) {\n MavenArtifact mavenArtifact = mavenArtifactNode.getArtifact();\n String compId = mavenArtifact.getDisplayStringSimple();\n DepTreeNode currentNode;\n if (nodes.containsKey(compId)) {\n currentNode = nodes.get(compId);\n } else {\n currentNode = new DepTreeNode();\n nodes.put(compId, currentNode);\n }\n if (setScopes) {\n currentNode.getScopes().add(mavenArtifact.getScope());\n }\n mavenArtifactNode.getDependencies()\n .stream()\n .filter(mavenArtifactChild -> mavenArtifactChild.getState() == MavenArtifactState.ADDED)\n .forEach(childrenArtifactNode -> updateChildrenNodes(nodes, currentNode, childrenArtifactNode, false));\n parentNode.getChildren().add(compId);\n }\n\n /**\n * Groups a collection of {@link DependencyNode}s by the descriptor files of the modules that depend on them.\n * The returned DependencyNodes inside the {@link FileTreeNode}s are clones of the ones in depScanResults.\n *\n * @param depScanResults collection of DependencyNodes\n * @param depTree the project's dependency tree\n * @param parents a map of components by their IDs and their parents in the dependency tree\n * @return a list of FileTreeNodes (that are all DescriptorFileTreeNodes) having the DependencyNodes as their children\n */\n @Override\n protected List groupDependenciesToDescriptorNodes(Collection depScanResults, DepTree depTree, Map> parents) {\n Map descriptorMap = new HashMap<>();\n Map> visitedComponents = new HashMap<>();\n for (DependencyNode dependencyNode : depScanResults) {\n String vulnerableDepId = dependencyNode.getComponentIdWithoutPrefix();\n Set affectedModulesIds = getDependentModules(vulnerableDepId, depTree, parents, visitedComponents);\n for (String descriptorId : affectedModulesIds) {\n String descriptorPath = depTree.nodes().get(descriptorId).getDescriptorFilePath();\n descriptorMap.putIfAbsent(descriptorPath, new DescriptorFileTreeNode(descriptorPath));\n\n // Each dependency might be a child of more than one POM file, but Artifact is a tree node, so it can have only one parent.\n // The solution for this is to clone the dependency before adding it as a child of the POM.\n DependencyNode clonedDep = (DependencyNode) dependencyNode.clone();\n clonedDep.setIndirect(!vulnerableDepId.equals(descriptorId) && !parents.get(vulnerableDepId).contains(descriptorId));\n descriptorMap.get(descriptorPath).addDependency(clonedDep);\n }\n }\n return new CopyOnWriteArrayList<>(descriptorMap.values());\n }\n\n /**\n * Retrieve component IDs of all modules in the project that are dependent on the specified component.\n *\n * @param compId the component ID to identify modules depending on it\n * @param depTree the project's dependency tree\n * @param parents a map of components by their IDs and their parents in the dependency tree\n * @param visitedComponents a map of components for which dependent modules have already been found\n * @return a set of component IDs representing modules dependent on the specified component\n */\n Set getDependentModules(String compId, DepTree depTree, Map> parents, Map> visitedComponents) {\n if (visitedComponents.containsKey(compId)) {\n return visitedComponents.get(compId);\n }\n Set modulesIds = new HashSet<>();\n if (depTree.nodes().get(compId).getDescriptorFilePath() != null) {\n modulesIds.add(compId);\n }\n if (parents.containsKey(compId)) {\n for (String parentId : parents.get(compId)) {\n modulesIds.addAll(getDependentModules(parentId, depTree, parents, visitedComponents));\n }\n }\n visitedComponents.put(compId, modulesIds);\n return modulesIds;\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/NpmScanner.java",
"content": "package com.jfrog.ide.idea.scan;\n\nimport com.intellij.openapi.project.Project;\nimport com.intellij.openapi.vfs.LocalFileSystem;\nimport com.intellij.openapi.vfs.VirtualFile;\nimport com.intellij.psi.PsiFile;\nimport com.intellij.psi.PsiManager;\nimport com.intellij.util.EnvironmentUtil;\nimport com.jfrog.ide.common.deptree.DepTree;\nimport com.jfrog.ide.common.npm.NpmTreeBuilder;\nimport com.jfrog.ide.common.scan.ComponentPrefix;\nimport com.jfrog.ide.common.scan.ScanLogic;\nimport com.jfrog.ide.idea.inspections.AbstractInspection;\nimport com.jfrog.ide.idea.inspections.NpmInspection;\nimport com.jfrog.ide.idea.scan.data.PackageManagerType;\nimport com.jfrog.ide.idea.ui.ComponentsTree;\nimport com.jfrog.ide.idea.ui.menus.filtermanager.ConsistentFilterManager;\n\nimport java.io.IOException;\nimport java.nio.file.Paths;\nimport java.util.concurrent.ExecutorService;\n\n/**\n * Created by Yahav Itzhak on 13 Dec 2017.\n */\npublic class NpmScanner extends SingleDescriptorScanner {\n private final NpmTreeBuilder npmTreeBuilder;\n\n /**\n * @param project currently opened IntelliJ project. We'll use this project to retrieve project based services\n * like {@link ConsistentFilterManager} and {@link ComponentsTree}.\n * @param basePath the package.json directory\n * @param executor an executor that should limit the number of running tasks to 3\n * @param scanLogic the scan logic to use\n */\n NpmScanner(Project project, String basePath, ExecutorService executor, ScanLogic scanLogic) {\n super(project, basePath, ComponentPrefix.NPM, executor, Paths.get(basePath, \"package.json\").toString(), scanLogic);\n getLog().info(\"Found npm project: \" + getProjectPath());\n npmTreeBuilder = new NpmTreeBuilder(Paths.get(basePath), descriptorFilePath, EnvironmentUtil.getEnvironmentMap());\n }\n\n @Override\n protected DepTree buildTree() throws IOException {\n return npmTreeBuilder.buildTree(getLog());\n }\n\n @Override\n protected PsiFile[] getProjectDescriptors() {\n VirtualFile file = LocalFileSystem.getInstance().findFileByPath(descriptorFilePath);\n if (file == null) {\n return null;\n }\n PsiFile psiFile = PsiManager.getInstance(project).findFile(file);\n return new PsiFile[]{psiFile};\n }\n\n @Override\n protected AbstractInspection getInspectionTool() {\n return new NpmInspection();\n }\n\n @Override\n protected PackageManagerType getPackageManagerType() {\n return PackageManagerType.NPM;\n }\n\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/PypiScanner.java",
"content": "package com.jfrog.ide.idea.scan;\n\nimport com.intellij.execution.ExecutionException;\nimport com.intellij.openapi.project.Project;\nimport com.intellij.openapi.projectRoots.Sdk;\nimport com.intellij.psi.PsiFile;\nimport com.jetbrains.python.packaging.PyPackage;\nimport com.jetbrains.python.packaging.PyPackageManager;\nimport com.jetbrains.python.packaging.PyRequirement;\nimport com.jfrog.ide.common.deptree.DepTree;\nimport com.jfrog.ide.common.deptree.DepTreeNode;\nimport com.jfrog.ide.common.scan.ComponentPrefix;\nimport com.jfrog.ide.common.scan.ScanLogic;\nimport com.jfrog.ide.idea.inspections.AbstractInspection;\nimport com.jfrog.ide.idea.scan.data.PackageManagerType;\nimport com.jfrog.ide.idea.ui.ComponentsTree;\nimport com.jfrog.ide.idea.ui.menus.filtermanager.ConsistentFilterManager;\nimport org.apache.commons.collections4.CollectionUtils;\n\nimport java.io.IOException;\nimport java.util.*;\nimport java.util.concurrent.ExecutorService;\n\nimport static com.jfrog.ide.common.utils.Utils.createComponentId;\n\n/**\n * @author yahavi\n */\npublic class PypiScanner extends SingleDescriptorScanner {\n private final Sdk pythonSdk;\n\n /**\n * @param project currently opened IntelliJ project. We'll use this project to retrieve project based services\n * like {@link ConsistentFilterManager} and {@link ComponentsTree}.\n * @param pythonSdk the Python SDK\n * @param executor an executor that should limit the number of running tasks to 3\n * @param scanLogic the scan logic to use\n */\n PypiScanner(Project project, Sdk pythonSdk, ExecutorService executor, ScanLogic scanLogic) {\n super(project, pythonSdk.getHomePath(), ComponentPrefix.PYPI, executor, pythonSdk.getHomePath(), scanLogic);\n this.pythonSdk = pythonSdk;\n getLog().info(\"Found PyPI SDK: \" + getProjectPath());\n }\n\n @Override\n protected DepTree buildTree() throws IOException {\n try {\n return createSdkDependencyTree(pythonSdk);\n } catch (ExecutionException e) {\n throw new IOException(e);\n }\n }\n\n /**\n * Create a dependency tree for a given Python SDK.\n *\n * @param pythonSdk the Python SDK\n * @return dependency tree created for a given Python SDK.\n */\n private DepTree createSdkDependencyTree(Sdk pythonSdk) throws ExecutionException {\n // Retrieve all PyPI packages\n PyPackageManager packageManager = PyPackageManager.getInstance(pythonSdk);\n List packages = packageManager.refreshAndGetPackages(true);\n getLog().debug(CollectionUtils.size(packages) + \" PyPI packages found in SDK \" + pythonSdk.getName());\n\n // Create dependency mapping\n Map compIdByCompName = new HashMap<>();\n Set dependencies = new HashSet<>();\n for (PyPackage pyPackage : packages) {\n String compId = createComponentId(pyPackage.getName(), pyPackage.getVersion());\n compIdByCompName.put(pyPackage.getName().toLowerCase(), compId);\n dependencies.add(compId);\n }\n\n // Populate each node's children\n Map nodes = new HashMap<>();\n for (PyPackage pyPackage : packages) {\n String compId = createComponentId(pyPackage.getName(), pyPackage.getVersion());\n DepTreeNode node = new DepTreeNode();\n for (PyRequirement requirement : pyPackage.getRequirements()) {\n String depId = compIdByCompName.get(requirement.getName().toLowerCase());\n if (depId == null) {\n getLog().warn(\"Dependency \" + requirement.getName() + \" is not installed.\");\n continue;\n }\n node.getChildren().add(depId);\n }\n nodes.put(compId, node);\n }\n\n // Create root SDK node\n String rootCompId = pythonSdk.getName();\n DepTreeNode sdkNode = new DepTreeNode().descriptorFilePath(pythonSdk.getHomePath());\n sdkNode.children(dependencies);\n nodes.put(rootCompId, sdkNode);\n return new DepTree(rootCompId, nodes);\n }\n\n @Override\n protected PsiFile[] getProjectDescriptors() {\n return null;\n }\n\n @Override\n protected AbstractInspection getInspectionTool() {\n return null;\n }\n\n @Override\n protected PackageManagerType getPackageManagerType() {\n return PackageManagerType.PYPI;\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/SastScannerExecutor.java",
"content": "package com.jfrog.ide.idea.scan;\n\nimport com.jfrog.ide.common.log.ProgressIndicator;\nimport com.jfrog.ide.common.nodes.FileIssueNode;\nimport com.jfrog.ide.common.nodes.FileTreeNode;\nimport com.jfrog.ide.common.nodes.SastIssueNode;\nimport com.jfrog.ide.common.nodes.subentities.SourceCodeScanType;\nimport com.jfrog.ide.idea.inspections.JFrogSecurityWarning;\nimport com.jfrog.ide.idea.scan.data.PackageManagerType;\nimport com.jfrog.ide.idea.scan.data.ScanConfig;\nimport com.jfrog.xray.client.services.entitlements.Feature;\nimport org.jfrog.build.api.util.Log;\n\nimport java.io.IOException;\nimport java.util.ArrayList;\nimport java.util.HashMap;\nimport java.util.List;\n\n/**\n * @author Tal Arian\n */\npublic class SastScannerExecutor extends ScanBinaryExecutor {\n private static final List SCANNER_ARGS = List.of(\"zd\");\n // This variable is used to indicate that this scanner supports only the new config (input) format.\n // In the near future, when all scanners will use only the new input file structure this variable as well\n // as the ScanConfig and ScanConfigs classes can be safely removed.\n private static final boolean RUN_WITH_NEW_CONFIG_FILE = true;\n private static final List SUPPORTED_PACKAGE_TYPES = List.of(PackageManagerType.PYPI, PackageManagerType.NPM, PackageManagerType.YARN, PackageManagerType.GRADLE, PackageManagerType.MAVEN);\n\n public SastScannerExecutor(Log log) {\n super(SourceCodeScanType.SAST, log);\n }\n\n public List execute(ScanConfig.Builder inputFileBuilder, Runnable checkCanceled, ProgressIndicator indicator) throws IOException, InterruptedException {\n return super.execute(inputFileBuilder, SCANNER_ARGS, checkCanceled, RUN_WITH_NEW_CONFIG_FILE, indicator);\n }\n\n @Override\n List createSpecificFileIssueNodes(List warnings) {\n HashMap results = new HashMap<>();\n for (JFrogSecurityWarning warning : warnings) {\n // Create FileTreeNodes for files with found issues\n FileTreeNode fileNode = results.get(warning.getFilePath());\n if (fileNode == null) {\n fileNode = new FileTreeNode(warning.getFilePath());\n results.put(warning.getFilePath(), fileNode);\n }\n\n FileIssueNode issueNode = new SastIssueNode(warning.getReason(),\n warning.getFilePath(), warning.getLineStart(), warning.getColStart(), warning.getLineEnd(), warning.getColEnd(),\n warning.getScannerSearchTarget(), warning.getLineSnippet(), warning.getCodeFlows(), warning.getSeverity(), warning.getRuleID());\n fileNode.addIssue(issueNode);\n }\n return new ArrayList<>(results.values());\n }\n\n @Override\n public Feature getScannerFeatureName() {\n // TODO: change to SAST feature when Xray entitlement service supports it.\n return Feature.CONTEXTUAL_ANALYSIS;\n }\n\n @Override\n protected boolean isPackageTypeSupported(PackageManagerType packageType) {\n return packageType != null && SUPPORTED_PACKAGE_TYPES.contains(packageType);\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/ScanBinaryExecutor.java",
"content": "package com.jfrog.ide.idea.scan;\n\nimport com.fasterxml.jackson.databind.ObjectMapper;\nimport com.intellij.util.EnvironmentUtil;\nimport com.jfrog.ide.common.configuration.ServerConfig;\nimport com.jfrog.ide.common.log.ProgressIndicator;\nimport com.jfrog.ide.common.nodes.FileTreeNode;\nimport com.jfrog.ide.common.nodes.subentities.SourceCodeScanType;\nimport com.jfrog.ide.idea.configuration.GlobalSettings;\nimport com.jfrog.ide.idea.configuration.ServerConfigImpl;\nimport com.jfrog.ide.idea.inspections.JFrogSecurityWarning;\nimport com.jfrog.ide.idea.log.Logger;\nimport com.jfrog.ide.idea.scan.data.*;\nimport com.jfrog.xray.client.Xray;\nimport com.jfrog.xray.client.services.entitlements.Feature;\nimport lombok.Getter;\nimport net.lingala.zip4j.ZipFile;\nimport net.lingala.zip4j.exception.ZipException;\nimport net.lingala.zip4j.model.UnzipParameters;\nimport org.apache.commons.codec.digest.DigestUtils;\nimport org.apache.commons.io.FileUtils;\nimport org.apache.commons.lang3.StringUtils;\nimport org.apache.commons.lang3.SystemUtils;\nimport org.apache.http.Header;\nimport org.jfrog.build.api.util.Log;\nimport org.jfrog.build.api.util.NullLog;\nimport org.jfrog.build.client.ProxyConfiguration;\nimport org.jfrog.build.extractor.clientConfiguration.ArtifactoryManagerBuilder;\nimport org.jfrog.build.extractor.clientConfiguration.client.artifactory.ArtifactoryManager;\nimport org.jfrog.build.extractor.executor.CommandExecutor;\nimport org.jfrog.build.extractor.executor.CommandResults;\n\nimport java.io.File;\nimport java.io.FileInputStream;\nimport java.io.IOException;\nimport java.net.URISyntaxException;\nimport java.nio.file.Files;\nimport java.nio.file.Path;\nimport java.time.LocalDateTime;\nimport java.util.*;\nimport java.util.concurrent.TimeUnit;\n\nimport static com.jfrog.ide.common.utils.ArtifactoryConnectionUtils.createAnonymousAccessArtifactoryManagerBuilder;\nimport static com.jfrog.ide.common.utils.ArtifactoryConnectionUtils.createArtifactoryManagerBuilder;\nimport static com.jfrog.ide.common.utils.Utils.createMapper;\nimport static com.jfrog.ide.common.utils.Utils.createYAMLMapper;\nimport static com.jfrog.ide.common.utils.XrayConnectionUtils.createXrayClientBuilder;\nimport static com.jfrog.ide.idea.scan.utils.ScanUtils.getOSAndArc;\nimport static com.jfrog.ide.idea.utils.Utils.HOME_PATH;\nimport static java.lang.String.join;\n\n/**\n * @author Tal Arian\n */\npublic abstract class ScanBinaryExecutor {\n public static final Path BINARIES_DIR = HOME_PATH.resolve(\"dependencies\").resolve(\"jfrog-security\");\n private static final int UPDATE_INTERVAL = 1;\n private static final int USER_NOT_ENTITLED = 31;\n private static final int NOT_SUPPORTED = 13;\n private static final String SCANNER_BINARY_NAME = \"analyzerManager\";\n static final String DEFAULT_SCANNER_BINARY_VERSION = \"1.30.1\";\n private static final String BINARY_DOWNLOAD_URL_PREFIX = \"xsc-gen-exe-analyzer-manager-local/v1/\";\n private static final String DOWNLOAD_SCANNER_NAME = \"analyzerManager.zip\";\n private static final String MINIMAL_XRAY_VERSION_SUPPORTED_FOR_ENTITLEMENT = \"3.66.0\";\n private static final String ENV_PLATFORM = \"JF_PLATFORM_URL\";\n private static final String ENV_USER = \"JF_USER\";\n private static final String ENV_PASSWORD = \"JF_PASS\";\n private static final String ENV_ACCESS_TOKEN = \"JF_TOKEN\";\n private static final String ENV_HTTP_PROXY = \"HTTP_PROXY\";\n private static final String JFROG_RELEASES = \"https://releases.jfrog.io/artifactory/\";\n private static Path binaryTargetPath;\n private static Path archiveTargetPath;\n @Getter\n private static String osDistribution;\n private static LocalDateTime nextUpdateCheck;\n private static String lastDownloadedVersion;\n protected final SourceCodeScanType scanType;\n protected Collection supportedPackageTypes;\n private final Log log;\n private boolean notSupported;\n private final static Object downloadLock = new Object();\n\n ScanBinaryExecutor(SourceCodeScanType scanType, Log log) {\n this.scanType = scanType;\n this.log = log;\n String executable = SystemUtils.IS_OS_WINDOWS ? SCANNER_BINARY_NAME + \".exe\" : SCANNER_BINARY_NAME;\n binaryTargetPath = BINARIES_DIR.resolve(SCANNER_BINARY_NAME).resolve(executable);\n archiveTargetPath = BINARIES_DIR.resolve(DOWNLOAD_SCANNER_NAME);\n setOsDistribution();\n }\n\n private ArtifactoryManagerBuilder createManagerBuilder(boolean useJFrogReleases, ServerConfig server) {\n if (useJFrogReleases) {\n return createAnonymousAccessArtifactoryManagerBuilder(JFROG_RELEASES, server.getProxyConfForTargetUrl(JFROG_RELEASES), log);\n }\n try {\n return createArtifactoryManagerBuilder(server, log);\n } catch (Exception e) {\n log.warn(e.getMessage());\n notSupported = true;\n }\n return null;\n }\n\n protected void setOsDistribution() {\n try {\n osDistribution = getOSAndArc();\n } catch (IOException e) {\n log.warn(e.getMessage());\n notSupported = true;\n }\n }\n\n String getBinaryDownloadURL(String externalResourcesRepo) {\n String downloadUrlPrefix = \"\";\n if (!StringUtils.isEmpty(externalResourcesRepo)) {\n downloadUrlPrefix = String.format(\"%s/artifactory/\", externalResourcesRepo);\n }\n String binaryDownloadUrl = BINARY_DOWNLOAD_URL_PREFIX + getEffectiveScannerVersion();\n return String.format(\"%s%s/%s/%s\", downloadUrlPrefix, binaryDownloadUrl, getOsDistribution(), DOWNLOAD_SCANNER_NAME);\n }\n\n String getEffectiveScannerVersion() {\n try {\n ServerConfigImpl serverConfig = GlobalSettings.getInstance().getServerConfig();\n if (serverConfig != null && StringUtils.isNotBlank(serverConfig.getScannerBinaryVersion())) {\n return serverConfig.getScannerBinaryVersion();\n }\n } catch (Exception e) {\n log.debug(\"Could not read scanner binary version from settings, using default.\");\n }\n return DEFAULT_SCANNER_BINARY_VERSION;\n }\n\n abstract Feature getScannerFeatureName();\n\n abstract List execute(ScanConfig.Builder inputFileBuilder, Runnable checkCanceled, ProgressIndicator indicator) throws IOException, InterruptedException, URISyntaxException;\n\n protected List execute(ScanConfig.Builder inputFileBuilder, List args, Runnable checkCanceled, ProgressIndicator indicator) throws IOException, InterruptedException {\n return execute(inputFileBuilder, args, checkCanceled, false, indicator);\n }\n\n protected List execute(ScanConfig.Builder inputFileBuilder, List args, Runnable checkCanceled, boolean newConfigFormat, ProgressIndicator indicator) throws IOException, InterruptedException {\n if (!shouldExecute()) {\n return List.of();\n }\n checkCanceled.run();\n updateBinaryIfNeeded();\n Path outputTempDir = null;\n Path inputFile = null;\n try {\n outputTempDir = Files.createTempDirectory(\"\");\n Path outputFilePath = Files.createTempFile(outputTempDir, \"\", \".sarif\");\n inputFileBuilder.output(outputFilePath.toString());\n inputFileBuilder.scanType(scanType);\n ScanConfig inputParams = inputFileBuilder.Build();\n args = new ArrayList<>(args);\n inputFile = newConfigFormat ? createTempRunInputFile(new NewScansConfig(new NewScanConfig(inputParams))) : createTempRunInputFile(new ScansConfig(List.of(inputParams)));\n args.add(inputFile.toString());\n if (newConfigFormat) {\n args.add(outputFilePath.toString());\n }\n\n Logger log = Logger.getInstance();\n // The following logging is done outside the commandExecutor because the commandExecutor log level is set to INFO.\n // As it is an internal binary execution, the message should be printed for DEBUG use only.\n indicator.setText(String.format(\"Running %s scan at %s\", scanType.toString().toLowerCase(), String.join(\" \", inputParams.getRoots())));\n String cmd = String.format(\"%s %s\", binaryTargetPath.toString(), join(\" \", args));\n log.info(String.format(\"Executing JAS scanner %s with config: %s\", cmd, inputParams));\n CommandExecutor commandExecutor = new CommandExecutor(binaryTargetPath.toString(), createEnvWithCredentials());\n CommandResults commandResults = commandExecutor.exeCommand(binaryTargetPath.toFile().getParentFile(), args,\n null, new NullLog(), Long.MAX_VALUE, TimeUnit.MINUTES);\n\n checkCanceled.run();\n\n if (commandResults.isOk()) {\n log.info(String.format(\"Finished successfully to run command: %s\", cmd));\n log.debug(commandResults.getRes());\n return parseOutputSarif(outputFilePath);\n }\n log.info(String.format(\"Failed to run command: %s\", cmd));\n switch (commandResults.getExitValue()) {\n case USER_NOT_ENTITLED -> {\n log.debug(\"User not entitled for advance security scan\");\n return List.of();\n }\n case NOT_SUPPORTED -> {\n log.info(String.format(\"Scanner %s is not supported in the current Analyzer Manager version.\", scanType));\n return List.of();\n }\n default -> {\n log.info(commandResults.getRes());\n throw new IOException(commandResults.getErr());\n }\n }\n } finally {\n if (outputTempDir != null) {\n FileUtils.deleteQuietly(outputTempDir.toFile());\n }\n if (inputFile != null) {\n FileUtils.deleteQuietly(inputFile.toFile());\n }\n }\n }\n\n abstract List createSpecificFileIssueNodes(List warnings);\n\n private void updateBinaryIfNeeded() throws IOException {\n // Allow only one thread to check and update the binary at any time.\n synchronized (downloadLock) {\n LocalDateTime currentTime = LocalDateTime.now();\n boolean targetExists = Files.exists(binaryTargetPath);\n boolean versionChanged = !getEffectiveScannerVersion().equals(lastDownloadedVersion);\n if (targetExists && !versionChanged && nextUpdateCheck != null && currentTime.isBefore(nextUpdateCheck)) {\n return;\n }\n ServerConfig server = GlobalSettings.getInstance().getServerConfig();\n String externalResourcesRepo = server.getExternalResourcesRepo();\n ArtifactoryManagerBuilder artifactoryManagerBuilder = createManagerBuilder(StringUtils.isEmpty(externalResourcesRepo), server);\n try (ArtifactoryManager artifactoryManager = artifactoryManagerBuilder.build()) {\n if (targetExists) {\n // Check for new version of the binary\n try (FileInputStream archiveBinaryFile = new FileInputStream(archiveTargetPath.toFile())) {\n String latestBinaryChecksum = getFileChecksumFromServer(artifactoryManager, externalResourcesRepo);\n String currentBinaryCheckSum = DigestUtils.sha256Hex(archiveBinaryFile);\n if (latestBinaryChecksum.equals(currentBinaryCheckSum)) {\n lastDownloadedVersion = getEffectiveScannerVersion();\n nextUpdateCheck = currentTime.plusDays(UPDATE_INTERVAL);\n return;\n }\n log.debug(String.format(\"Resource %s is not up to date. Downloading it.\", archiveTargetPath));\n }\n } else {\n log.debug(String.format(\"Resource %s is not found. Downloading it.\", binaryTargetPath));\n }\n downloadBinary(artifactoryManager, externalResourcesRepo);\n lastDownloadedVersion = getEffectiveScannerVersion();\n }\n }\n }\n\n public String getFileChecksumFromServer(ArtifactoryManager artifactoryManager, String externalResourcesRepo) throws IOException {\n String url = getBinaryDownloadURL(externalResourcesRepo);\n Header[] headers = artifactoryManager.downloadHeaders(url);\n for (Header header : headers) {\n if (StringUtils.equalsIgnoreCase(header.getName(), \"x-checksum-sha256\")) {\n return header.getValue();\n }\n }\n log.warn(String.format(\"Failed to retrieve file checksum from: %s/%s \", artifactoryManager.getUrl(), url));\n return \"\";\n }\n\n protected boolean shouldExecute() {\n if (notSupported) {\n return false;\n }\n ServerConfig server = GlobalSettings.getInstance().getServerConfig();\n try (Xray xrayClient = createXrayClientBuilder(server, log).build()) {\n try {\n if (!xrayClient.system().version().isAtLeast(MINIMAL_XRAY_VERSION_SUPPORTED_FOR_ENTITLEMENT)) {\n return false;\n }\n return xrayClient.entitlements().isEntitled(getScannerFeatureName());\n } catch (IOException e) {\n log.error(\"Couldn't connect to JFrog Xray. Please check your credentials.\", e);\n return false;\n }\n }\n }\n\n protected boolean isPackageTypeSupported(PackageManagerType type) {\n return type != null && supportedPackageTypes.contains(type);\n }\n\n protected List parseOutputSarif(Path outputFile) throws IOException,IndexOutOfBoundsException {\n Output output = getOutputObj(outputFile);\n List warnings = new ArrayList<>();\n\n output.getRuns().forEach(run -> run.getResults().stream()\n .filter(SarifResult::isNotSuppressed)\n .filter(result -> !\"informational\".equals(result.getKind()))\n .forEach(result -> warnings.add(new JFrogSecurityWarning(result, scanType, run.getRuleFromRunById(result.getRuleId())))));\n\n Optional run = output.getRuns().stream().findFirst();\n if (run.isPresent()) {\n List scanners = run.get().getTool().getDriver().getRules();\n // Adds the scanner search target data\n for (JFrogSecurityWarning warning : warnings) {\n String scannerSearchTarget = scanners.stream().filter(scanner -> scanner.getId().equals(warning.getRuleID())).findFirst().map(Rule::getFullDescription).map(Message::getText).orElse(\"\");\n warning.setScannerSearchTarget(scannerSearchTarget);\n }\n }\n return warnings;\n }\n\n protected Output getOutputObj(Path outputFile) throws IOException {\n ObjectMapper om = createMapper();\n return om.readValue(outputFile.toFile(), Output.class);\n }\n\n protected void downloadBinary(ArtifactoryManager artifactoryManager, String externalResourcesRepo) throws IOException {\n String downloadUrl = getBinaryDownloadURL(externalResourcesRepo);\n File downloadArchive = artifactoryManager.downloadToFile(downloadUrl, archiveTargetPath.toString());\n log.debug(String.format(\"Downloading: %s\", downloadUrl));\n if (downloadArchive == null) {\n throw new IOException(\"An empty response received from Artifactory.\");\n }\n // Delete current scanners\n FileUtils.deleteDirectory(binaryTargetPath.toFile().getParentFile());\n // Extract archive\n UnzipParameters params = new UnzipParameters();\n params.setExtractSymbolicLinks(false);\n try (ZipFile zip = new ZipFile(archiveTargetPath.toFile())) {\n zip.extractAll(binaryTargetPath.toFile().getParentFile().toString(), params);\n } catch (ZipException exception) {\n throw new IOException(\"An error occurred while trying to unarchived the JFrog executable:\\n\" + exception.getMessage());\n }\n // Set executable permissions to the downloaded scanner\n if (!binaryTargetPath.toFile().setExecutable(true)) {\n throw new IOException(\"An error occurred while trying to give access permissions to the JFrog executable.\");\n }\n }\n\n Path createTempRunInputFile(Object scanInput) throws IOException {\n ObjectMapper om = createYAMLMapper();\n Path tempDir = Files.createTempDirectory(\"\");\n Path inputPath = Files.createTempFile(tempDir, \"\", \".yaml\");\n om.writeValue(inputPath.toFile(), scanInput);\n return inputPath;\n }\n\n private Map createEnvWithCredentials() {\n Map env = new HashMap<>(EnvironmentUtil.getEnvironmentMap());\n ServerConfigImpl serverConfig = GlobalSettings.getInstance().getServerConfig();\n env.put(ENV_PLATFORM, serverConfig.getUrl());\n if (StringUtils.isNotEmpty(serverConfig.getAccessToken())) {\n env.put(ENV_ACCESS_TOKEN, serverConfig.getAccessToken());\n } else {\n env.put(ENV_USER, serverConfig.getUsername());\n env.put(ENV_PASSWORD, serverConfig.getPassword());\n }\n\n ProxyConfiguration proxyConfiguration = serverConfig.getProxyConfForTargetUrl(serverConfig.getUrl());\n if (proxyConfiguration != null) {\n String proxyUrl = proxyConfiguration.host + \":\" + proxyConfiguration.port;\n if (StringUtils.isNoneBlank(proxyConfiguration.username, proxyConfiguration.password)) {\n proxyUrl = proxyConfiguration.username + \":\" + proxyConfiguration.password + \"@\" + proxyUrl;\n }\n //jfrog-ignore\n env.put(ENV_HTTP_PROXY, \"http://\" + proxyUrl);\n }\n return env;\n }\n\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/ScanManager.java",
"content": "package com.jfrog.ide.idea.scan;\n\nimport com.google.common.collect.Maps;\nimport com.google.common.collect.Sets;\nimport com.intellij.ide.BrowserUtil;\nimport com.intellij.openapi.project.DumbService;\nimport com.intellij.openapi.project.Project;\nimport com.jfrog.ide.common.configuration.ServerConfig;\nimport com.jfrog.ide.common.scan.GraphScanLogic;\nimport com.jfrog.ide.common.scan.ScanLogic;\nimport com.jfrog.ide.idea.configuration.GlobalSettings;\nimport com.jfrog.ide.idea.events.ApplicationEvents;\nimport com.jfrog.ide.idea.log.Logger;\nimport com.jfrog.ide.idea.navigation.NavigationService;\nimport com.jfrog.ide.idea.ui.LocalComponentsTree;\nimport com.jfrog.xray.client.impl.XrayClient;\nimport com.jfrog.xray.client.impl.util.JFrogInactiveEnvironmentException;\nimport com.jfrog.xray.client.services.system.Version;\nimport org.apache.commons.lang3.exception.ExceptionUtils;\nimport org.jetbrains.annotations.NotNull;\nimport org.jetbrains.annotations.Nullable;\n\nimport java.io.IOException;\nimport java.util.Map;\nimport java.util.Set;\nimport java.util.concurrent.ExecutorService;\nimport java.util.concurrent.Executors;\nimport java.util.concurrent.TimeUnit;\n\nimport static com.jfrog.ide.common.log.Utils.logError;\nimport static com.jfrog.ide.common.utils.XrayConnectionUtils.createXrayClientBuilder;\n\npublic class ScanManager {\n private final Project project;\n private final ScannerFactory factory;\n private final SourceCodeScannerManager sourceCodeScannerManager;\n private Map scanners = Maps.newHashMap();\n private ExecutorService executor;\n\n private ScanManager(@NotNull Project project) {\n this.project = project;\n factory = new ScannerFactory(project);\n sourceCodeScannerManager = new SourceCodeScannerManager(project);\n }\n\n public static ScanManager getInstance(@NotNull Project project) {\n return project.getService(ScanManager.class);\n }\n\n public static Set getScanners(@NotNull Project project) {\n ScanManager scanManager = getInstance(project);\n return Sets.newHashSet(scanManager.scanners.values());\n }\n\n public void runInspections(Project project) {\n try {\n refreshScanners(null, null);\n getScanners(project).forEach(ScannerBase::runInspections);\n } catch (InterruptedException | IOException e) {\n logError(Logger.getInstance(), \"\", e, false);\n }\n }\n\n /**\n * Start an Xray scan for all projects.\n */\n public void startScan() {\n if (DumbService.isDumb(project)) { // If intellij is still indexing the project\n return;\n }\n\n if (isScanInProgress()) {\n Logger.getInstance().info(\"Previous scan still running...\");\n return;\n }\n\n if (!GlobalSettings.getInstance().reloadMissingConfiguration()) {\n Logger.getInstance().error(\"Xray server is not configured.\");\n return;\n }\n\n project.getMessageBus().syncPublisher(ApplicationEvents.ON_SCAN_LOCAL_STARTED).update();\n LocalComponentsTree componentsTree = LocalComponentsTree.getInstance(project);\n componentsTree.setScanningEmptyText();\n Thread currScanThread = new Thread(() -> {\n executor = Executors.newFixedThreadPool(3);\n try {\n // Source code scanners\n sourceCodeScannerManager.asyncScanAndUpdateResults(executor, Logger.getInstance());\n // Dependencies scanners\n ScanLogic scanLogic = createScanLogic();\n refreshScanners(scanLogic, executor);\n NavigationService.clearNavigationMap(project);\n for (ScannerBase scanner : scanners.values()) {\n scanner.asyncScanAndUpdateResults();\n }\n executor.shutdown();\n if (!executor.awaitTermination(Long.MAX_VALUE, TimeUnit.MINUTES)) {\n logError(Logger.getInstance(), \"Scan timeout elapsed. The scan is being canceled.\", true);\n }\n // Cache tree only if no errors occurred during scan.\n if (scanners.values().stream().anyMatch(ScannerBase::isScanErrorOccurred)) {\n componentsTree.deleteCachedTree();\n componentsTree.setScanErrorEmptyText();\n } else if (scanners.values().stream().anyMatch(ScannerBase::isScanCanceled)) {\n project.getMessageBus().syncPublisher(ApplicationEvents.ON_SCAN_LOCAL_CANCELED).update();\n } else {\n componentsTree.cacheTree();\n componentsTree.setNoIssuesEmptyText();\n }\n } catch (JFrogInactiveEnvironmentException e) {\n handleJfrogInactiveEnvironment(e.getRedirectUrl());\n componentsTree.setScanErrorEmptyText();\n } catch (IOException | RuntimeException | InterruptedException e) {\n logError(Logger.getInstance(), ExceptionUtils.getRootCauseMessage(e), e, true);\n componentsTree.setScanErrorEmptyText();\n } finally {\n executor.shutdownNow();\n }\n });\n currScanThread.start();\n }\n\n public void stopScan() {\n executor.shutdown();\n scanners.values().forEach(ScannerBase::stopScan);\n sourceCodeScannerManager.stopScan();\n }\n\n /**\n * Handle inactive JFrog platform (free-tier) by displaying a clear warning message and a reactivation link.\n *\n * @param reactivationUrl is an URL to reactivate the specific free-tier platform.\n */\n private void handleJfrogInactiveEnvironment(String reactivationUrl) {\n Logger.getInstance().warn(\"JFrog Platform is not active.\");\n Logger.showActionableBalloon(project, \"JFrog Platform is not active.\\nYou can activate it here. \", () -> BrowserUtil.browse(reactivationUrl));\n }\n\n /**\n * Scan projects, create new Scanners and delete unnecessary ones.\n */\n public void refreshScanners(ScanLogic scanLogic, @Nullable ExecutorService executor) throws IOException, InterruptedException {\n scanners = factory.refreshScanners(scanners, scanLogic, executor);\n }\n\n public boolean isScanInProgress() {\n return scanners.values().stream().anyMatch(ScannerBase::isScanInProgress) || sourceCodeScannerManager.isScanInProgress();\n }\n\n /**\n * Create the scan logic according to Xray version.\n *\n * @return Xray scan logic\n */\n private ScanLogic createScanLogic() throws IOException {\n Logger logger = Logger.getInstance();\n ServerConfig server = GlobalSettings.getInstance().getServerConfig();\n try (XrayClient client = createXrayClientBuilder(server, logger).build()) {\n Version xrayVersion = client.system().version();\n GraphScanLogic.validateXraySupport(xrayVersion);\n }\n return new GraphScanLogic(logger);\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/ScannerBase.java",
"content": "package com.jfrog.ide.idea.scan;\n\nimport com.google.common.collect.Sets;\nimport com.intellij.codeInsight.daemon.DaemonCodeAnalyzer;\nimport com.intellij.codeInspection.GlobalInspectionContext;\nimport com.intellij.codeInspection.InspectionEngine;\nimport com.intellij.codeInspection.InspectionManager;\nimport com.intellij.codeInspection.LocalInspectionTool;\nimport com.intellij.codeInspection.ex.LocalInspectionToolWrapper;\nimport com.intellij.openapi.application.ApplicationManager;\nimport com.intellij.openapi.fileEditor.FileEditor;\nimport com.intellij.openapi.fileEditor.FileEditorManager;\nimport com.intellij.openapi.progress.ProcessCanceledException;\nimport com.intellij.openapi.progress.ProgressManager;\nimport com.intellij.openapi.progress.Task;\nimport com.intellij.openapi.project.DumbService;\nimport com.intellij.openapi.project.Project;\nimport com.intellij.psi.PsiFile;\nimport com.jfrog.ide.common.configuration.ServerConfig;\nimport com.jfrog.ide.common.deptree.DepTree;\nimport com.jfrog.ide.common.deptree.DepTreeNode;\nimport com.jfrog.ide.common.log.ProgressIndicator;\nimport com.jfrog.ide.common.nodes.DependencyNode;\nimport com.jfrog.ide.common.nodes.FileTreeNode;\nimport com.jfrog.ide.common.scan.ComponentPrefix;\nimport com.jfrog.ide.common.scan.ScanLogic;\nimport com.jfrog.ide.idea.configuration.GlobalSettings;\nimport com.jfrog.ide.idea.inspections.AbstractInspection;\nimport com.jfrog.ide.idea.log.Logger;\nimport com.jfrog.ide.idea.log.ProgressIndicatorImpl;\nimport com.jfrog.ide.idea.scan.data.PackageManagerType;\nimport com.jfrog.ide.idea.scan.utils.ImpactTreeBuilder;\nimport com.jfrog.ide.idea.ui.ComponentsTree;\nimport com.jfrog.ide.idea.ui.LocalComponentsTree;\nimport com.jfrog.ide.idea.ui.menus.filtermanager.ConsistentFilterManager;\nimport com.jfrog.ide.idea.utils.Utils;\nimport com.jfrog.xray.client.services.summary.Components;\nimport lombok.Getter;\nimport org.apache.commons.lang3.ArrayUtils;\nimport org.apache.commons.lang3.StringUtils;\nimport org.apache.commons.lang3.exception.ExceptionUtils;\nimport org.jetbrains.annotations.NotNull;\nimport org.jfrog.build.api.util.Log;\n\nimport javax.annotation.Nullable;\nimport javax.swing.*;\nimport java.io.IOException;\nimport java.nio.file.Path;\nimport java.nio.file.Paths;\nimport java.util.*;\nimport java.util.concurrent.CountDownLatch;\nimport java.util.concurrent.ExecutorService;\nimport java.util.concurrent.atomic.AtomicBoolean;\n\nimport static com.jfrog.ide.common.log.Utils.logError;\n\n/**\n * Created by romang on 4/26/17.\n */\npublic abstract class ScannerBase {\n private final ServerConfig serverConfig;\n private final ComponentPrefix prefix;\n @Getter\n private final Log log;\n // Lock to prevent multiple simultaneous scans\n private final AtomicBoolean scanInProgress = new AtomicBoolean(false);\n private final AtomicBoolean scanError = new AtomicBoolean(false);\n private final AtomicBoolean scanCanceled = new AtomicBoolean(false);\n\n private ScanLogic scanLogic;\n protected Project project;\n protected SourceCodeScannerManager sourceCodeScannerManager;\n String basePath;\n private ExecutorService executor;\n private com.intellij.openapi.progress.ProgressIndicator progressIndicator;\n\n /**\n * @param project currently opened IntelliJ project. We'll use this project to retrieve project based services\n * like {@link ConsistentFilterManager} and {@link ComponentsTree}\n * @param basePath project base path\n * @param prefix components prefix for xray scan, e.g. gav:// or npm://\n * @param executor an executor that should limit the number of running tasks to 3\n * @param scanLogic the scan logic to use\n */\n ScannerBase(@NotNull Project project, String basePath, ComponentPrefix prefix, ExecutorService executor, ScanLogic scanLogic) {\n this.serverConfig = GlobalSettings.getInstance().getServerConfig();\n this.prefix = prefix;\n this.log = Logger.getInstance();\n this.executor = executor;\n this.basePath = basePath;\n this.project = project;\n this.sourceCodeScannerManager = new SourceCodeScannerManager(project, getPackageManagerType());\n this.scanLogic = scanLogic;\n }\n\n void setExecutor(ExecutorService executor) {\n this.executor = executor;\n }\n\n void setScanLogic(ScanLogic logic) {\n this.scanLogic = logic;\n }\n\n /**\n * Collect and return {@link Components} to be scanned by JFrog Xray.\n * Implementation should be project type specific.\n */\n protected abstract DepTree buildTree() throws IOException;\n\n /**\n * Return all project descriptors under the scan-manager project, which need to be inspected by the corresponding {@link LocalInspectionTool}.\n *\n * @return all project descriptors under the scan-manager project to be inspected.\n */\n protected abstract PsiFile[] getProjectDescriptors();\n\n /**\n * Return the Inspection tool corresponding to the scan-manager type.\n * The returned Inspection tool is used to perform the inspection on the project-descriptor files.\n *\n * @return the Inspection tool corresponding to the scan-manager type.\n */\n @Nullable\n protected abstract AbstractInspection getInspectionTool();\n\n protected void sendUsageReport() {\n ApplicationManager.getApplication().invokeLater(() -> Utils.sendUsageReport(getPackageManagerType().getName() + \"-deps\"));\n }\n\n protected abstract PackageManagerType getPackageManagerType();\n\n /**\n * Groups a collection of {@link DependencyNode}s by the descriptor files of the modules that depend on them.\n * The returned DependencyNodes inside the {@link FileTreeNode}s might be clones of the ones in depScanResults, but\n * it's not guaranteed.\n *\n * @param depScanResults collection of DependencyNodes\n * @param depTree the project's dependency tree\n * @param parents a map of components by their IDs and their parents in the dependency tree\n * @return a list of FileTreeNodes (that are all DescriptorFileTreeNodes) having the DependencyNodes as their children\n */\n protected abstract List groupDependenciesToDescriptorNodes(Collection depScanResults, DepTree depTree, Map> parents);\n\n /**\n * Scan and update dependency components.\n *\n * @param indicator - The progress indicator\n */\n private void scanAndUpdate(ProgressIndicator indicator) {\n try {\n sendUsageReport();\n\n // Building dependency tree\n indicator.setText(\"1/3: Building dependency tree\");\n DepTree depTree = buildTree();\n checkCanceled();\n\n // Sending the dependency tree to Xray for scanning\n indicator.setText(\"2/3: Xray scanning project dependencies\");\n log.debug(\"Start scan for '\" + basePath + \"'.\");\n Map results = scanLogic.scanArtifacts(depTree, serverConfig, indicator, prefix, this::checkCanceled);\n checkCanceled();\n\n indicator.setText(\"3/3: Finalizing\");\n if (results == null || results.isEmpty()) {\n // No violations/vulnerabilities or no components to scan or an error was thrown\n return;\n }\n List fileTreeNodes = buildImpactGraph(results, depTree);\n addScanResults(fileTreeNodes);\n\n // Contextual Analysis\n List applicabilityScanResults = sourceCodeScannerManager.applicabilityScan(indicator, fileTreeNodes, this::checkCanceled);\n addScanResults(applicabilityScanResults);\n\n // Force inspections run due to changes in the displayed tree\n runInspections();\n\n } catch (ProcessCanceledException e) {\n log.info(\"Xray scan was canceled\");\n scanCanceled.set(true);\n } catch (Exception e) {\n scanError.set(true);\n logError(log, \"Xray scan failed\", e, true);\n }\n }\n\n protected List buildImpactGraph(Map vulnerableDependencies, DepTree depTree) throws IOException {\n Map> parents = getParents(depTree);\n ImpactTreeBuilder.populateImpactTrees(vulnerableDependencies, parents, depTree.rootId());\n return groupDependenciesToDescriptorNodes(vulnerableDependencies.values(), depTree, parents);\n }\n\n /**\n * Find the parents of each node in the given {@link DepTree}.\n * Nodes without parents (the root) don't appear in the returned map.\n *\n * @param depTree the {@link DepTree} to find the parents of its nodes\n * @return a map of nodes from the {@link DepTree} amd each one's parents\n */\n static Map> getParents(DepTree depTree) {\n Map> parents = new HashMap<>();\n for (Map.Entry node : depTree.nodes().entrySet()) {\n String parentId = node.getKey();\n for (String childId : node.getValue().getChildren()) {\n parents.putIfAbsent(childId, new HashSet<>());\n parents.get(childId).add(parentId);\n }\n }\n return parents;\n }\n\n /**\n * Launch async dependency scan.\n */\n void asyncScanAndUpdateResults() {\n if (DumbService.isDumb(project)) { // If intellij is still indexing the project\n return;\n }\n // The tasks run asynchronously. To make sure no more than 3 tasks are running concurrently,\n // we use a count-down latch that signals to that executor service that it can get more tasks.\n CountDownLatch latch = new CountDownLatch(1);\n Task.Backgroundable scanAndUpdateTask = new Task.Backgroundable(null, getTaskTitle()) {\n @Override\n public void run(@NotNull com.intellij.openapi.progress.ProgressIndicator indicator) {\n if (project.isDisposed()) {\n return;\n }\n // Prevent multiple simultaneous scans\n if (!scanInProgress.compareAndSet(false, true)) {\n log.info(\"Scan already in progress\");\n return;\n }\n progressIndicator = indicator;\n scanAndUpdate(new ProgressIndicatorImpl(indicator));\n }\n\n @Override\n public void onFinished() {\n latch.countDown();\n scanInProgress.set(false);\n }\n\n @Override\n public void onThrowable(@NotNull Throwable error) {\n log.error(ExceptionUtils.getRootCauseMessage(error));\n scanError.set(true);\n }\n\n };\n executor.submit(createRunnable(scanAndUpdateTask, latch, progressIndicator, log));\n }\n\n /**\n * Stop the current scan.\n */\n void stopScan() {\n if (progressIndicator != null) {\n progressIndicator.cancel();\n }\n }\n\n /**\n * Get text to display in the task progress.\n *\n * @return text to display in the task progress.\n */\n private String getTaskTitle() {\n Path projectBasePath = Utils.getProjectBasePath(project);\n Path wsBasePath = Paths.get(basePath);\n String relativePath = \"\";\n if (projectBasePath.isAbsolute() == wsBasePath.isAbsolute()) {\n // If one of the path is relative and the other one is absolute, the following exception is thrown:\n // IllegalArgumentException: 'other' is different type of Path\n relativePath = projectBasePath.relativize(wsBasePath).toString();\n }\n return \"JFrog scanning \" + StringUtils.defaultIfBlank(relativePath, project.getName());\n }\n\n /**\n * Create a runnable to be submitted to the executor service, or run directly.\n *\n * @param task The task to submit\n * @param latch The countdown latch, which makes sure the executor service doesn't get more than 3 tasks.\n * If null, the scan was initiated by a change in the project descriptor and the executor\n * service is terminated. In this case, there is no requirement to wait.\n * @param progressIndicator The task's {@link com.intellij.openapi.progress.ProgressIndicator} object.\n */\n public static Runnable createRunnable(Task.Backgroundable task, CountDownLatch latch, com.intellij.openapi.progress.ProgressIndicator progressIndicator, Log log) {\n return () -> {\n // The progress manager is only good for foreground threads.\n if (SwingUtilities.isEventDispatchThread()) {\n task.queue();\n } else {\n // Run the scan task when the thread is in the foreground.\n ApplicationManager.getApplication().invokeLater(task::queue);\n }\n try {\n // Wait for scan to finish, to make sure the thread pool remain full\n if (latch != null) {\n latch.await();\n }\n } catch (InterruptedException e) {\n // This exception is thrown when this thread is interrupted (e.g. when the scan timeout has elapsed).\n logError(log, ExceptionUtils.getRootCauseMessage(e), e, false);\n progressIndicator.cancel();\n }\n };\n }\n\n /**\n * Returns all project modules locations as Paths.\n * Other scanners such as npm will use these paths in order to find modules.\n *\n * @return all project modules locations as Paths\n */\n public Set getProjectPaths() {\n Set paths = Sets.newHashSet();\n paths.add(Paths.get(basePath));\n return paths;\n }\n\n void runInspections() {\n DumbService.getInstance(project).smartInvokeLater(() -> {\n PsiFile[] projectDescriptors = getProjectDescriptors();\n if (ArrayUtils.isEmpty(projectDescriptors)) {\n return;\n }\n GlobalInspectionContext context = InspectionManager.getInstance(project).createNewGlobalContext();\n AbstractInspection localInspectionTool = getInspectionTool();\n if (localInspectionTool == null) {\n return;\n }\n localInspectionTool.setAfterScan(true);\n for (PsiFile descriptor : projectDescriptors) {\n // Run inspection on descriptor.\n InspectionEngine.runInspectionOnFile(descriptor, new LocalInspectionToolWrapper(localInspectionTool), context);\n FileEditor[] editors = FileEditorManager.getInstance(project).getAllEditors(descriptor.getVirtualFile());\n if (!ArrayUtils.isEmpty(editors)) {\n // Refresh descriptor highlighting only if it is already opened.\n DaemonCodeAnalyzer.getInstance(project).restart(descriptor);\n }\n }\n });\n }\n\n private void addScanResults(List fileTreeNodes) {\n if (fileTreeNodes.isEmpty()) {\n return;\n }\n LocalComponentsTree componentsTree = LocalComponentsTree.getInstance(project);\n componentsTree.addScanResults(fileTreeNodes);\n }\n\n protected void checkCanceled() {\n if (project.isOpen()) {\n // The project is closed if we are in test mode.\n // In tests, we can't check if the user canceled the scan, since we don't have the ProgressManager service.\n ProgressManager.checkCanceled();\n }\n }\n\n boolean isScanInProgress() {\n return this.scanInProgress.get();\n }\n\n boolean isScanErrorOccurred() {\n return this.scanError.get();\n }\n\n boolean isScanCanceled() {\n return this.scanCanceled.get();\n }\n\n public String getProjectPath() {\n return this.basePath;\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/ScannerFactory.java",
"content": "package com.jfrog.ide.idea.scan;\n\nimport com.google.common.base.Objects;\nimport com.google.common.collect.Maps;\nimport com.intellij.openapi.module.Module;\nimport com.intellij.openapi.module.ModuleManager;\nimport com.intellij.openapi.project.Project;\nimport com.intellij.openapi.projectRoots.Sdk;\nimport com.jetbrains.python.sdk.PythonSdkUtil;\nimport com.jfrog.ide.common.scan.ScanLogic;\nimport com.jfrog.ide.common.utils.PackageFileFinder;\nimport com.jfrog.ide.idea.configuration.GlobalSettings;\nimport com.jfrog.ide.idea.log.Logger;\nimport org.jetbrains.annotations.Nullable;\n\nimport java.io.IOException;\nimport java.nio.file.Path;\nimport java.util.Collection;\nimport java.util.Map;\nimport java.util.Set;\nimport java.util.concurrent.ExecutorService;\n\nimport static com.jfrog.ide.idea.scan.utils.ScanUtils.createScanPaths;\nimport static com.jfrog.ide.idea.utils.Utils.getProjectBasePath;\n\n/**\n * Created by yahavi\n */\npublic class ScannerFactory {\n private final Project project;\n\n public ScannerFactory(Project project) {\n this.project = project;\n }\n\n public static int getModuleIdentifier(String name, String path) {\n return Objects.hashCode(name, path);\n }\n\n /**\n * Scan projects, create new Scanners and delete unnecessary ones.\n * Existing Scanners from previous scans, are not overridden.\n */\n public Map refreshScanners(Map oldScanners, ScanLogic scanLogic,\n @Nullable ExecutorService executor) throws IOException {\n Map scanners = Maps.newHashMap();\n refreshMavenScanner(scanners, oldScanners, executor, scanLogic);\n refreshPypiScanners(scanners, oldScanners, executor, scanLogic);\n Set scanPaths = createScanPaths(project);\n oldScanners.values().stream().map(ScannerBase::getProjectPaths).flatMap(Collection::stream).forEach(scanPaths::add);\n refreshGenericScanners(scanners, oldScanners, scanPaths, executor, scanLogic);\n return scanners;\n }\n\n /**\n * Create npm, Gradle, Go and Yarn Scanners.\n *\n * @param newScanners the new Scanners map to add the Scanners into\n * @param oldScanners the Scanners map including the Scanner of the current project, or an empty map for a fresh start\n * @param scanPaths potential paths for scanning for package descriptor files\n * @param executor the thread pool\n * @throws IOException in case of any I/O error during the search for the actual package descriptor files.\n */\n private void refreshGenericScanners(Map newScanners, Map oldScanners,\n Set scanPaths, ExecutorService executor, ScanLogic scanLogic) throws IOException {\n Path basePath = getProjectBasePath(project);\n PackageFileFinder packageFileFinder = new PackageFileFinder(scanPaths, basePath,\n GlobalSettings.getInstance().getServerConfig().getExcludedPaths(), Logger.getInstance());\n\n // Create Yarn scanners\n Set yarnLockDirs = packageFileFinder.getYarnPackagesFilePairs();\n refreshGenericScannersByType(yarnLockDirs, newScanners, oldScanners, GenericScannerType.YARN, executor, scanLogic);\n\n // Create npm scanners\n Set packageJsonDirs = packageFileFinder.getNpmPackagesFilePairs();\n refreshGenericScannersByType(packageJsonDirs, newScanners, oldScanners, GenericScannerType.NPM, executor, scanLogic);\n\n // Create Gradle scanners\n Set buildGradleDirs = packageFileFinder.getBuildGradlePackagesFilePairs();\n refreshGenericScannersByType(buildGradleDirs, newScanners, oldScanners, GenericScannerType.GRADLE, executor, scanLogic);\n\n // Create Go scanners\n Set goModDirs = packageFileFinder.getGoPackagesFilePairs();\n refreshGenericScannersByType(goModDirs, newScanners, oldScanners, GenericScannerType.GO, executor, scanLogic);\n }\n\n /**\n * Create a MavenScanner if this is a Maven project.\n *\n * @param newScanners new scanners map\n * @param oldScanners existing scanners map\n * @param executor an executor that should limit the number of running tasks to 3\n * @param scanLogic the scan logic to use\n */\n private void refreshMavenScanner(Map newScanners, Map oldScanners,\n ExecutorService executor, ScanLogic scanLogic) {\n int projectHash = getModuleIdentifier(project.getName(), project.getBasePath());\n ScannerBase scanner = oldScanners.get(projectHash);\n\n // Check if a ScanManager for this project already exists\n if (scanner != null) {\n // Set the new executor on the old scan manager\n scanner.setExecutor(executor);\n scanner.setScanLogic(scanLogic);\n newScanners.put(projectHash, scanner);\n } else {\n // Unlike other scanners whereby we create them if the package descriptor exist, MavenScanner is created if\n // the Maven plugin is installed and there are Maven projects loaded.\n try {\n if (MavenScanner.isApplicable(project)) {\n scanner = new MavenScanner(project, executor, scanLogic);\n newScanners.put(projectHash, scanner);\n }\n } catch (NoClassDefFoundError noClassDefFoundError) {\n // The Maven plugin is not installed.\n }\n }\n }\n\n /**\n * Create PypiScanner for each module with Python SDK configured.\n *\n * @param newScanners new scanners map\n * @param oldScanners existing scanners map\n * @param executor an executor that should limit the number of running tasks to 3\n * @param scanLogic the scan logic to use\n */\n private void refreshPypiScanners(Map newScanners, Map oldScanners,\n ExecutorService executor, ScanLogic scanLogic) {\n try {\n for (Module module : ModuleManager.getInstance(project).getModules()) {\n Sdk pythonSdk = PythonSdkUtil.findPythonSdk(module);\n if (pythonSdk == null) {\n continue;\n }\n int projectHash = getModuleIdentifier(pythonSdk.getName(), pythonSdk.getHomePath());\n ScannerBase scanner = oldScanners.get(projectHash);\n if (scanner == null) {\n scanner = new PypiScanner(project, pythonSdk, executor, scanLogic);\n }\n scanner.setExecutor(executor);\n scanner.setScanLogic(scanLogic);\n newScanners.put(projectHash, scanner);\n }\n } catch (NoClassDefFoundError noClassDefFoundError) {\n // The Python plugin is not installed.\n }\n }\n\n private void refreshGenericScannersByType(Set packageDirs, Map newScanners, Map oldScanners,\n GenericScannerType type, ExecutorService executor, ScanLogic scanLogic) {\n for (String dir : packageDirs) {\n int projectHash = getModuleIdentifier(dir, dir);\n ScannerBase scanner = oldScanners.get(projectHash);\n if (scanner == null) {\n scanner = createGenericScanner(type, dir, executor, scanLogic);\n }\n if (scanner != null) {\n scanner.setExecutor(executor);\n scanner.setScanLogic(scanLogic);\n newScanners.put(projectHash, scanner);\n }\n }\n }\n\n /**\n * Create a new scanner according to the type. Add it to the scanners map.\n * Supported types: Go, npm, gradle and Yarn.\n *\n * @param type project type\n * @param dir project dir\n * @param executor an executor that should limit the number of running tasks to 3\n * @param scanLogic the scan logic to use\n */\n private ScannerBase createGenericScanner(GenericScannerType type, String dir, ExecutorService executor, ScanLogic scanLogic) {\n try {\n switch (type) {\n case GRADLE:\n return new GradleScanner(project, dir, executor, scanLogic);\n case YARN:\n return new YarnScanner(project, dir, executor, scanLogic);\n case NPM:\n return new NpmScanner(project, dir, executor, scanLogic);\n case GO:\n return new GoScanner(project, dir, executor, scanLogic);\n }\n } catch (NoClassDefFoundError noClassDefFoundError) {\n // The Gradle plugin is not installed.\n }\n return null;\n }\n\n private enum GenericScannerType {\n GRADLE,\n NPM,\n GO,\n YARN\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/SecretsScannerExecutor.java",
"content": "package com.jfrog.ide.idea.scan;\n\nimport com.jfrog.ide.common.log.ProgressIndicator;\nimport com.jfrog.ide.common.nodes.FileIssueNode;\nimport com.jfrog.ide.common.nodes.FileTreeNode;\nimport com.jfrog.ide.common.nodes.subentities.SourceCodeScanType;\nimport com.jfrog.ide.idea.inspections.JFrogSecurityWarning;\nimport com.jfrog.ide.idea.scan.data.PackageManagerType;\nimport com.jfrog.ide.idea.scan.data.ScanConfig;\nimport com.jfrog.xray.client.services.entitlements.Feature;\nimport org.jfrog.build.api.util.Log;\n\nimport java.io.IOException;\nimport java.util.ArrayList;\nimport java.util.HashMap;\nimport java.util.List;\n\n/**\n * @author Tal Arian\n */\npublic class SecretsScannerExecutor extends ScanBinaryExecutor {\n private static final List SCANNER_ARGS = List.of(\"sec\");\n private static final String ISSUE_TITLE = \"Potential Secret\";\n\n public SecretsScannerExecutor(Log log) {\n super(SourceCodeScanType.SECRETS, log);\n }\n\n public List execute(ScanConfig.Builder inputFileBuilder, Runnable checkCanceled, ProgressIndicator indicator) throws IOException, InterruptedException {\n return super.execute(inputFileBuilder, SCANNER_ARGS, checkCanceled, indicator);\n }\n\n @Override\n List createSpecificFileIssueNodes(List warnings) {\n HashMap results = new HashMap<>();\n for (JFrogSecurityWarning warning : warnings) {\n // Create FileTreeNodes for files with found issues\n FileTreeNode fileNode = results.get(warning.getFilePath());\n if (fileNode == null) {\n fileNode = new FileTreeNode(warning.getFilePath());\n results.put(warning.getFilePath(), fileNode);\n }\n\n FileIssueNode issueNode = new FileIssueNode(ISSUE_TITLE,\n warning.getFilePath(), warning.getLineStart(), warning.getColStart(), warning.getLineEnd(), warning.getColEnd(),\n warning.getScannerSearchTarget(), warning.getLineSnippet(), warning.getReporter(), warning.getSeverity(), warning.getRuleID());\n fileNode.addIssue(issueNode);\n }\n return new ArrayList<>(results.values());\n }\n\n @Override\n public Feature getScannerFeatureName() {\n return Feature.SECRETS;\n }\n\n @Override\n protected boolean isPackageTypeSupported(PackageManagerType packageType) {\n return true;\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/SingleDescriptorScanner.java",
"content": "package com.jfrog.ide.idea.scan;\n\nimport com.intellij.openapi.project.Project;\nimport com.jfrog.ide.common.deptree.DepTree;\nimport com.jfrog.ide.common.deptree.DepTreeNode;\nimport com.jfrog.ide.common.nodes.DependencyNode;\nimport com.jfrog.ide.common.nodes.DescriptorFileTreeNode;\nimport com.jfrog.ide.common.nodes.FileTreeNode;\nimport com.jfrog.ide.common.scan.ComponentPrefix;\nimport com.jfrog.ide.common.scan.ScanLogic;\nimport com.jfrog.ide.idea.ui.ComponentsTree;\nimport com.jfrog.ide.idea.ui.menus.filtermanager.ConsistentFilterManager;\nimport org.jetbrains.annotations.NotNull;\nimport org.jfrog.build.extractor.scan.DependencyTree;\n\nimport java.util.*;\nimport java.util.concurrent.CopyOnWriteArrayList;\nimport java.util.concurrent.ExecutorService;\n\npublic abstract class SingleDescriptorScanner extends ScannerBase {\n protected String descriptorFilePath;\n\n /**\n * @param project currently opened IntelliJ project. We'll use this project to retrieve project based services\n * like {@link ConsistentFilterManager} and {@link ComponentsTree}\n * @param basePath project base path\n * @param prefix components prefix for xray scan, e.g. gav:// or npm://\n * @param executor an executor that should limit the number of running tasks to 3\n * @param descriptorFilePath path to the project's descriptor file\n * @param scanLogic the scan logic to use\n */\n SingleDescriptorScanner(@NotNull Project project, String basePath, ComponentPrefix prefix, ExecutorService executor,\n String descriptorFilePath, ScanLogic scanLogic) {\n super(project, basePath, prefix, executor, scanLogic);\n this.descriptorFilePath = descriptorFilePath;\n }\n\n /**\n * @param project currently opened IntelliJ project. We'll use this project to retrieve project based services\n * like {@link ConsistentFilterManager} and {@link ComponentsTree}\n * @param basePath project base path\n * @param prefix components prefix for xray scan, e.g. gav:// or npm://\n * @param executor an executor that should limit the number of running tasks to 3\n * @param scanLogic the scan logic to use\n */\n SingleDescriptorScanner(@NotNull Project project, String basePath, ComponentPrefix prefix, ExecutorService executor,\n ScanLogic scanLogic) {\n this(project, basePath, prefix, executor, \"\", scanLogic);\n }\n\n /**\n * Groups a collection of {@link DependencyNode}s by the descriptor files of the modules that depend on them.\n * The returned DependencyNodes inside the {@link FileTreeNode}s are references of the ones in depScanResults.\n *\n * @param depScanResults collection of DependencyNodes\n * @param depTree the project's dependency tree\n * @param parents a map of components by their IDs and their parents in the dependency tree\n * @return a list of FileTreeNodes (that are all DescriptorFileTreeNodes) having the DependencyNodes as their children\n */\n @Override\n protected List groupDependenciesToDescriptorNodes(Collection depScanResults, DepTree depTree, Map> parents) {\n DescriptorFileTreeNode fileTreeNode = new DescriptorFileTreeNode(descriptorFilePath);\n for (DependencyNode dependency : depScanResults) {\n dependency.setIndirect(!isDirectDependency(dependency, depTree, parents));\n fileTreeNode.addDependency(dependency);\n }\n return new CopyOnWriteArrayList<>(List.of(fileTreeNode));\n }\n\n private boolean isDirectDependency(DependencyNode dependency, DepTree depTree, Map> parents) {\n // Check if the component is the root node\n if (dependency.getComponentIdWithoutPrefix().equals(depTree.rootId())) {\n return true;\n }\n // Check if any of the parent's descriptor file path matches the current descriptor file path\n return parents.getOrDefault(dependency.getComponentIdWithoutPrefix(), Collections.emptySet())\n .stream()\n .map(depTree.nodes()::get)\n .anyMatch(parent -> descriptorFilePath.equals(parent.getDescriptorFilePath()));\n }\n}"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/SourceCodeScannerManager.java",
"content": "package com.jfrog.ide.idea.scan;\n\nimport com.fasterxml.jackson.databind.ObjectMapper;\nimport com.intellij.openapi.progress.ProgressManager;\nimport com.intellij.openapi.progress.Task;\nimport com.intellij.openapi.project.DumbService;\nimport com.intellij.openapi.project.Project;\nimport com.jfrog.ide.common.log.ProgressIndicator;\nimport com.jfrog.ide.common.nodes.DependencyNode;\nimport com.jfrog.ide.common.nodes.FileTreeNode;\nimport com.jfrog.ide.common.nodes.VulnerabilityNode;\nimport com.jfrog.ide.common.nodes.subentities.SourceCodeScanType;\nimport com.jfrog.ide.idea.configuration.GlobalSettings;\nimport com.jfrog.ide.idea.inspections.JFrogSecurityWarning;\nimport com.jfrog.ide.idea.log.Logger;\nimport com.jfrog.ide.idea.log.ProgressIndicatorImpl;\nimport com.jfrog.ide.idea.scan.data.PackageManagerType;\nimport com.jfrog.ide.idea.scan.data.ScanConfig;\nimport com.jfrog.ide.idea.scan.data.applications.JFrogApplicationsConfig;\nimport com.jfrog.ide.idea.scan.data.applications.ModuleConfig;\nimport com.jfrog.ide.idea.scan.data.applications.ScannerConfig;\nimport com.jfrog.ide.idea.ui.LocalComponentsTree;\nimport org.apache.commons.collections.CollectionUtils;\nimport org.apache.commons.lang3.StringUtils;\nimport org.apache.commons.lang3.exception.ExceptionUtils;\nimport org.jetbrains.annotations.NotNull;\n\nimport javax.swing.tree.TreeNode;\nimport java.io.File;\nimport java.io.IOException;\nimport java.net.URISyntaxException;\nimport java.nio.file.Path;\nimport java.nio.file.Paths;\nimport java.util.ArrayList;\nimport java.util.Collection;\nimport java.util.Collections;\nimport java.util.Enumeration;\nimport java.util.HashMap;\nimport java.util.List;\nimport java.util.Map;\nimport java.util.Set;\nimport java.util.concurrent.CountDownLatch;\nimport java.util.concurrent.ExecutorService;\nimport java.util.concurrent.atomic.AtomicBoolean;\nimport java.util.regex.Matcher;\n\nimport static com.jfrog.ide.common.log.Utils.logError;\nimport static com.jfrog.ide.common.utils.Utils.createYAMLMapper;\nimport static com.jfrog.ide.idea.scan.ScannerBase.createRunnable;\nimport static com.jfrog.ide.idea.scan.data.applications.JFrogApplicationsConfig.createApplicationConfigWithDefaultModule;\nimport static com.jfrog.ide.idea.ui.configuration.ConfigVerificationUtils.EXCLUSIONS_PREFIX;\nimport static com.jfrog.ide.idea.ui.configuration.ConfigVerificationUtils.EXCLUSIONS_REGEX_PATTERN;\nimport static com.jfrog.ide.idea.ui.configuration.ConfigVerificationUtils.EXCLUSIONS_SUFFIX;\nimport static com.jfrog.ide.idea.utils.Utils.getProjectBasePath;\nimport static org.apache.commons.lang3.StringUtils.defaultIfEmpty;\n\npublic class SourceCodeScannerManager {\n private final Path jfrogApplictionsConfigPath;\n private final AtomicBoolean scanInProgress = new AtomicBoolean(false);\n private final ApplicabilityScannerExecutor applicability = new ApplicabilityScannerExecutor(Logger.getInstance());\n private final Map scanners = initScannersCollection();\n protected Project project;\n protected PackageManagerType packageType;\n private static final String SKIP_FOLDERS_SUFFIX = \"*/**\";\n private com.intellij.openapi.progress.ProgressIndicator progressIndicator;\n\n public SourceCodeScannerManager(Project project) {\n this.project = project;\n this.jfrogApplictionsConfigPath = getProjectBasePath(project).resolve(\".jfrog\").resolve(\"jfrog-apps-config.yml\");\n }\n\n public SourceCodeScannerManager(Project project, PackageManagerType packageType) {\n this(project);\n this.packageType = packageType;\n }\n\n /**\n * Applicability source code scanning (Contextual Analysis).\n *\n * @param indicator the progress indicator.\n * @param fileTreeNodes collection of FileTreeNodes.\n * @return A list of FileTreeNodes having the source code issues as their children.\n */\n public List applicabilityScan(ProgressIndicator indicator, Collection fileTreeNodes, Runnable checkCanceled) {\n if (project.isDisposed()) {\n return Collections.emptyList();\n }\n // Prevent multiple simultaneous scans\n if (!scanInProgress.compareAndSet(false, true)) {\n return Collections.emptyList();\n }\n List scanResults = new ArrayList<>();\n Map> issuesMap = mapDirectIssuesByCve(fileTreeNodes);\n\n try {\n if (applicability.isPackageTypeSupported(packageType)) {\n indicator.setText(\"Running applicability scan\");\n indicator.setFraction(0.25);\n Set directIssuesCVEs = issuesMap.keySet();\n // If no direct dependencies with issues are found by Xray, the applicability scan is irrelevant.\n if (!directIssuesCVEs.isEmpty()) {\n List applicabilityResults = applicability.execute(createBasicScannerInput().cves(List.copyOf(directIssuesCVEs)), checkCanceled, indicator);\n scanResults.addAll(applicabilityResults);\n }\n }\n } catch (InterruptedException e) {\n logError(Logger.getInstance(), \"Scan canceled due to a user request or timeout.\", false);\n } catch (IOException | NullPointerException e) {\n logError(Logger.getInstance(), \"Failed to scan source code\", e, true);\n } finally {\n scanInProgress.set(false);\n indicator.setFraction(1);\n }\n return applicability.createSpecificFileIssueNodes(scanResults, issuesMap);\n }\n\n /**\n * Launch async source code scans.\n */\n void asyncScanAndUpdateResults(ExecutorService executor, Logger log) {\n // If intellij is still indexing the project, do not scan.\n if (DumbService.isDumb(project)) {\n return;\n }\n // The tasks run asynchronously. To make sure no more than 3 tasks are running concurrently,\n // we use a count-down latch that signals to that executor service that it can get more tasks.\n CountDownLatch latch = new CountDownLatch(1);\n Task.Backgroundable sourceCodeScanTask = new Task.Backgroundable(null, \"Advanced source code scanning\") {\n @Override\n public void run(@NotNull com.intellij.openapi.progress.ProgressIndicator indicator) {\n if (project.isDisposed()) {\n return;\n }\n // Prevent multiple simultaneous scans\n if (!scanInProgress.compareAndSet(false, true)) {\n log.info(\"Advanced source code scan is already in progress\");\n return;\n }\n try {\n progressIndicator = indicator;\n sourceCodeScanAndUpdate(new ProgressIndicatorImpl(indicator), ProgressManager::checkCanceled, log);\n } catch (IOException e) {\n logError(Logger.getInstance(), \"Failed to run advanced source code scanning.\", e, true);\n }\n }\n\n @Override\n public void onFinished() {\n latch.countDown();\n scanInProgress.set(false);\n }\n\n @Override\n public void onThrowable(@NotNull Throwable error) {\n log.error(ExceptionUtils.getRootCauseMessage(error));\n }\n\n };\n executor.submit(createRunnable(sourceCodeScanTask, latch, progressIndicator, log));\n }\n\n public void stopScan() {\n if (progressIndicator != null) {\n progressIndicator.cancel();\n }\n }\n\n private void sourceCodeScanAndUpdate(ProgressIndicator indicator, Runnable checkCanceled, Logger log) throws IOException {\n indicator.setText(\"Running advanced source code scanning\");\n JFrogApplicationsConfig projectConfig = parseJFrogApplicationsConfig();\n\n for (ModuleConfig moduleConfig : projectConfig.getModules()) {\n scan(moduleConfig, indicator, checkCanceled, log);\n }\n }\n\n private void scan(ModuleConfig moduleConfig, ProgressIndicator indicator, Runnable checkCanceled, Logger log) {\n double fraction = 0;\n for (SourceCodeScanType scannerType : scanners.keySet()) {\n checkCanceled.run();\n ScanBinaryExecutor scanner = scanners.get(scannerType);\n ScannerConfig scannerConfig = null;\n if (moduleConfig != null) {\n // Skip the scanner If requested.\n if (moduleConfig.getExcludeScanners() != null && moduleConfig.getExcludeScanners().contains(scannerType.toString().toLowerCase())) {\n log.debug(String.format(\"Skipping %s scanning\", scannerType.toString().toLowerCase()));\n continue;\n }\n // Use specific scanner config if exists.\n if (moduleConfig.getScanners() != null) {\n scannerConfig = moduleConfig.getScanners().get(scannerType.toString().toLowerCase());\n }\n }\n try {\n List scanResults = scanner.execute(createBasicScannerInput(moduleConfig, scannerConfig), checkCanceled, indicator);\n addSourceCodeScanResults(scanner.createSpecificFileIssueNodes(scanResults));\n } catch (IOException | URISyntaxException | InterruptedException e) {\n logError(log, \"\", e, true);\n }\n fraction += 1.0 / scanners.size();\n indicator.setFraction(fraction);\n }\n }\n\n private JFrogApplicationsConfig parseJFrogApplicationsConfig() throws IOException {\n ObjectMapper mapper = createYAMLMapper();\n File config = jfrogApplictionsConfigPath.toFile();\n if (config.exists()) {\n return mapper.readValue(config, JFrogApplicationsConfig.class);\n }\n return createApplicationConfigWithDefaultModule(project);\n }\n\n private void addSourceCodeScanResults(List fileTreeNodes) {\n if (fileTreeNodes.isEmpty()) {\n return;\n }\n LocalComponentsTree componentsTree = LocalComponentsTree.getInstance(project);\n componentsTree.addScanResults(fileTreeNodes);\n }\n\n private ScanConfig.Builder createBasicScannerInput() {\n String excludePattern = GlobalSettings.getInstance().getServerConfig().getExcludedPaths();\n return new ScanConfig.Builder().roots(List.of(getProjectBasePath(project).toAbsolutePath().toString())).skippedFolders(convertToSkippedFolders(excludePattern));\n }\n\n private ScanConfig.Builder createBasicScannerInput(ModuleConfig config, ScannerConfig scannerConfig) {\n if (config == null) {\n return createBasicScannerInput();\n }\n\n // Scanner's working dirs (roots)\n List workingDirs = new ArrayList<>();\n String projectBasePath = defaultIfEmpty(config.getSourceRoot(), getProjectBasePath(project).toAbsolutePath().toString());\n if (scannerConfig != null && !CollectionUtils.isEmpty(scannerConfig.getWorkingDirs())) {\n for (String workingDir : scannerConfig.getWorkingDirs()) {\n workingDirs.add(Paths.get(projectBasePath).resolve(workingDir).toString());\n }\n } else {\n // Default: \".\", the application's root directory.\n workingDirs.add(projectBasePath);\n }\n\n // Module exclude patterns\n List skippedFolders = new ArrayList<>();\n if (config.getExcludePatterns() != null) {\n skippedFolders.addAll(config.getExcludePatterns());\n }\n if (scannerConfig != null && scannerConfig.getExcludePatterns() != null) {\n // Adds scanner specific exclude patterns if exists\n skippedFolders.addAll(scannerConfig.getExcludePatterns());\n }\n String excludePattern = GlobalSettings.getInstance().getServerConfig().getExcludedPaths();\n // If exclude patterns was not provided, use the configured IDE patterns.\n skippedFolders = skippedFolders.isEmpty() ? convertToSkippedFolders(excludePattern) : skippedFolders;\n\n // Extra scanners params\n List excludeRules = null;\n String language = null;\n if (scannerConfig != null) {\n excludeRules = scannerConfig.getExcludedRules();\n language = scannerConfig.getLanguage();\n }\n\n return new ScanConfig.Builder().roots(workingDirs).skippedFolders(skippedFolders).excludedRules(excludeRules).language(language);\n }\n\n /**\n * Splits the users' configured ExcludedPaths glob pattern to a list\n * of simplified patterns by avoiding the use of \"{}\".\n *\n * @return a list of equivalent patterns without the use of \"{}\"\n */\n public static List convertToSkippedFolders(String excludePattern) {\n List skippedFoldersPatterns = new ArrayList<>();\n if (StringUtils.isNotBlank(excludePattern)) {\n Matcher matcher = EXCLUSIONS_REGEX_PATTERN.matcher(excludePattern);\n if (!matcher.find()) {\n // Convert pattern form shape \"**/*a*\" to \"**/*a*/**\"\n return List.of(StringUtils.removeEnd(excludePattern, EXCLUSIONS_SUFFIX) + SKIP_FOLDERS_SUFFIX);\n }\n String[] dirsNames = matcher.group(1).split(\",\");\n for (String dirName : dirsNames) {\n skippedFoldersPatterns.add(EXCLUSIONS_PREFIX + dirName.strip() + SKIP_FOLDERS_SUFFIX);\n }\n }\n return skippedFoldersPatterns;\n }\n\n /**\n * Maps direct dependencies issues (vulnerabilities and security violations) by their CVE IDs.\n * Issues without a CVE ID are ignored.\n *\n * @param fileTreeNodes collection of FileTreeNodes.\n * @return a map of CVE IDs to lists of issues with them.\n */\n private Map> mapDirectIssuesByCve(Collection fileTreeNodes) {\n Map> issues = new HashMap<>();\n for (FileTreeNode fileTreeNode : fileTreeNodes) {\n for (TreeNode treeNode : fileTreeNode.getChildren()) {\n DependencyNode dep = (DependencyNode) treeNode;\n if (dep.isIndirect()) {\n continue;\n }\n Enumeration treeNodeEnumeration = dep.children();\n while (treeNodeEnumeration.hasMoreElements()) {\n TreeNode node = treeNodeEnumeration.nextElement();\n if (!(node instanceof VulnerabilityNode vulnerabilityNode)) {\n continue;\n }\n if (vulnerabilityNode.getCve() == null || StringUtils.isBlank(vulnerabilityNode.getCve().getCveId())) {\n continue;\n }\n String cveId = vulnerabilityNode.getCve().getCveId();\n issues.putIfAbsent(cveId, new ArrayList<>());\n issues.get(cveId).add(vulnerabilityNode);\n }\n }\n }\n return issues;\n }\n\n private Map initScannersCollection() {\n Map scanners = new HashMap<>();\n scanners.put(SourceCodeScanType.SECRETS, new SecretsScannerExecutor(Logger.getInstance()));\n scanners.put(SourceCodeScanType.IAC, new IACScannerExecutor(Logger.getInstance()));\n scanners.put(SourceCodeScanType.SAST, new SastScannerExecutor(Logger.getInstance()));\n return scanners;\n }\n\n public boolean isScanInProgress() {\n return this.scanInProgress.get();\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/YarnScanner.java",
"content": "package com.jfrog.ide.idea.scan;\n\nimport com.intellij.openapi.project.Project;\nimport com.intellij.openapi.vfs.LocalFileSystem;\nimport com.intellij.openapi.vfs.VirtualFile;\nimport com.intellij.psi.PsiFile;\nimport com.intellij.psi.PsiManager;\nimport com.intellij.util.EnvironmentUtil;\nimport com.jfrog.ide.common.deptree.DepTree;\nimport com.jfrog.ide.common.nodes.DependencyNode;\nimport com.jfrog.ide.common.nodes.DescriptorFileTreeNode;\nimport com.jfrog.ide.common.nodes.FileTreeNode;\nimport com.jfrog.ide.common.scan.ComponentPrefix;\nimport com.jfrog.ide.common.scan.ScanLogic;\nimport com.jfrog.ide.common.yarn.YarnTreeBuilder;\nimport com.jfrog.ide.idea.inspections.AbstractInspection;\nimport com.jfrog.ide.idea.inspections.YarnInspection;\nimport com.jfrog.ide.idea.scan.data.PackageManagerType;\nimport com.jfrog.ide.idea.scan.utils.ImpactTreeBuilder;\nimport com.jfrog.ide.idea.ui.ComponentsTree;\nimport com.jfrog.ide.idea.ui.menus.filtermanager.ConsistentFilterManager;\nimport org.apache.commons.collections4.CollectionUtils;\nimport org.apache.commons.lang3.StringUtils;\n\nimport java.io.IOException;\nimport java.nio.file.Paths;\nimport java.util.*;\nimport java.util.concurrent.CopyOnWriteArrayList;\nimport java.util.concurrent.ExecutorService;\n\n/**\n * Created by Yahav Itzhak on 13 Dec 2017.\n */\npublic class YarnScanner extends SingleDescriptorScanner {\n\n private final YarnTreeBuilder yarnTreeBuilder;\n\n /**\n * @param project currently opened IntelliJ project. We'll use this project to retrieve project based services\n * like {@link ConsistentFilterManager} and {@link ComponentsTree}.\n * @param basePath the package.json directory\n * @param executor an executor that should limit the number of running tasks to 3\n * @param scanLogic the scan logic to use\n */\n YarnScanner(Project project, String basePath, ExecutorService executor, ScanLogic scanLogic) {\n super(project, basePath, ComponentPrefix.NPM, executor, Paths.get(basePath, \"package.json\").toString(), scanLogic);\n getLog().info(\"Found yarn project: \" + getProjectPath());\n yarnTreeBuilder = new YarnTreeBuilder(Paths.get(basePath), descriptorFilePath, EnvironmentUtil.getEnvironmentMap(), getLog());\n }\n\n @Override\n protected DepTree buildTree() throws IOException {\n return yarnTreeBuilder.buildTree();\n }\n\n @Override\n protected PsiFile[] getProjectDescriptors() {\n VirtualFile file = LocalFileSystem.getInstance().findFileByPath(descriptorFilePath);\n if (file == null) {\n return null;\n }\n PsiFile psiFile = PsiManager.getInstance(project).findFile(file);\n return new PsiFile[]{psiFile};\n }\n\n @Override\n protected AbstractInspection getInspectionTool() {\n return new YarnInspection();\n }\n\n @Override\n protected PackageManagerType getPackageManagerType() {\n return PackageManagerType.YARN;\n }\n\n /**\n * Builds a map of package name to versions out of a set of : Strings.\n *\n * @param packages - A set of packages in the format of 'package-name:version'.\n * @return - A map of package name to a set of versions.\n */\n Map> getPackageNameToVersionsMap(Set packages) {\n Map> packageNameToVersions = new HashMap<>();\n for (String fullNamePackage : CollectionUtils.emptyIfNull(packages)) {\n String[] packageSplit = StringUtils.split(fullNamePackage, \":\");\n if (packageSplit.length != 2) {\n this.getLog().error(\"Illegal package name: \" + fullNamePackage + \". Skipping package, the dependency tree may be incomplete.\");\n continue;\n }\n String packageName = packageSplit[0];\n String packageVersion = packageSplit[1];\n packageNameToVersions.putIfAbsent(packageName, new HashSet<>());\n packageNameToVersions.get(packageName).add(packageVersion);\n }\n return packageNameToVersions;\n }\n\n private void buildImpactGraphFromPaths(DescriptorFileTreeNode descriptorNode, Map vulnerableDependencies, Map>> packageVersionsImpactPaths) {\n for (Map.Entry>> aPackageVersionImpactPaths : packageVersionsImpactPaths.entrySet()) {\n String packageFullName = aPackageVersionImpactPaths.getKey();\n List> impactPaths = aPackageVersionImpactPaths.getValue();\n DependencyNode dependencyNode = vulnerableDependencies.get(packageFullName);\n\n // build the impact graph for each vulnerable dependency out of its impact paths\n for (List impactPath : impactPaths) {\n ImpactTreeBuilder.addImpactPathToDependencyNode(dependencyNode, impactPath);\n }\n\n boolean direct = impactPaths.stream().map(List::size).anyMatch(size -> size == 2);\n\n dependencyNode.setIndirect(!direct);\n descriptorNode.addDependency(dependencyNode);\n }\n }\n\n /**\n * Builds the impact graph for each given vulnerable dependencies.\n * The impact graph is built by running 'yarn why ' command, making it different from other package managers.\n *\n * @param vulnerableDependencies - The vulnerable dependencies to build the impact graph for.\n * The key is the package name and version, and the value is the dependency node.\n * @param depTree - The whole dependency tree (not just vulnerable dependencies) that was generated earlier.\n * @return - The impact graph attached to package.json DescriptorFileTreeNode\n */\n @Override\n protected List buildImpactGraph(Map vulnerableDependencies, DepTree depTree) throws IOException {\n DescriptorFileTreeNode descriptorNode = new DescriptorFileTreeNode(depTree.getRootNodeDescriptorFilePath());\n // Build a map of package name to versions, to avoid running 'yarn why' multiple times for the same package.\n Map> packageNameToVersions = this.getPackageNameToVersionsMap(vulnerableDependencies.keySet());\n\n for (Map.Entry> entry : packageNameToVersions.entrySet()) {\n // Find the impact paths for each package for all its vulnerable versions\n Map>> packageVersionsImpactPaths = yarnTreeBuilder.findDependencyImpactPaths(depTree.rootId(), entry.getKey(), entry.getValue());\n // Build the impact graph for each vulnerable dependency out of its impact paths, set Indirect flag and add it to the descriptor node\n buildImpactGraphFromPaths(descriptorNode, vulnerableDependencies, packageVersionsImpactPaths);\n }\n\n // Return a list of one element - the descriptor node for package.json\n // COW list is used to avoid ConcurrentModificationException in SourceCodeScannerManager\n return new CopyOnWriteArrayList<>(Collections.singletonList(descriptorNode));\n }\n}\n\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/data/AnalyzeSuppression.java",
"content": "package com.jfrog.ide.idea.scan.data;\n\nimport com.fasterxml.jackson.annotation.JsonProperty;\nimport lombok.Getter;\nimport lombok.Setter;\n\n@Getter\n@Setter\npublic class AnalyzeSuppression {\n @JsonProperty(\"kind\")\n private String kind;\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/data/ArtifactLocation.java",
"content": "package com.jfrog.ide.idea.scan.data;\n\nimport com.fasterxml.jackson.annotation.JsonProperty;\n\nimport java.util.Objects;\n\npublic class ArtifactLocation {\n\n @JsonProperty(\"uri\")\n private String uri;\n\n public String getUri() {\n return uri;\n }\n\n @SuppressWarnings(\"unused\")\n public void setUri(String uri) {\n this.uri = uri;\n }\n\n @Override\n public int hashCode() {\n return Objects.hash(uri);\n }\n\n @Override\n public boolean equals(Object other) {\n if (other == this) {\n return true;\n }\n if (!(other instanceof ArtifactLocation)) {\n return false;\n }\n ArtifactLocation rhs = ((ArtifactLocation) other);\n return (Objects.equals(this.uri, rhs.uri));\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/data/CodeFlow.java",
"content": "package com.jfrog.ide.idea.scan.data;\n\nimport com.fasterxml.jackson.annotation.JsonProperty;\nimport org.apache.commons.collections4.CollectionUtils;\n\nimport java.util.ArrayList;\nimport java.util.List;\nimport java.util.Objects;\n\npublic class CodeFlow {\n\n @JsonProperty(\"threadFlows\")\n private List threadFlows = new ArrayList<>();\n\n @SuppressWarnings(\"unused\")\n public List getThreadFlows() {\n return threadFlows;\n }\n\n @SuppressWarnings(\"unused\")\n public void setThreadFlows(List threadFlows) {\n this.threadFlows = threadFlows;\n }\n\n @Override\n public int hashCode() {\n return Objects.hash(threadFlows);\n }\n\n @Override\n public boolean equals(Object other) {\n if (other == this) {\n return true;\n }\n if (!(other instanceof CodeFlow)) {\n return false;\n }\n CodeFlow rhs = ((CodeFlow) other);\n return (CollectionUtils.isEqualCollection(this.threadFlows, rhs.threadFlows));\n }\n\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/data/Driver.java",
"content": "package com.jfrog.ide.idea.scan.data;\n\nimport com.fasterxml.jackson.annotation.JsonProperty;\nimport org.apache.commons.collections4.CollectionUtils;\n\nimport java.util.List;\nimport java.util.Objects;\n\npublic class Driver {\n\n @JsonProperty(\"name\")\n private String name;\n\n @JsonProperty(\"rules\")\n private List rules;\n\n public String getName() {\n return name;\n }\n\n public void setName(String name) {\n this.name = name;\n }\n @SuppressWarnings({\"unused\"})\n public List getRules() {\n return rules;\n }\n\n @SuppressWarnings({\"unused\"})\n public void setLocations( List rules) {\n this.rules = rules;\n }\n\n @Override\n public int hashCode() {\n return Objects.hash(name, rules);\n }\n\n @Override\n public boolean equals(Object other) {\n if (other == this) {\n return true;\n }\n if (!(other instanceof Driver)) {\n return false;\n }\n Driver rhs = ((Driver) other);\n return (Objects.equals(this.name, rhs.name) && (CollectionUtils.isEqualCollection(this.rules, rhs.rules)));\n }\n\n public Rule getRuleById(String ruleId) throws IndexOutOfBoundsException {\n return rules.stream()\n .filter(rule -> rule.getId().equals(ruleId))\n .findFirst()\n .orElseThrow(() -> new IndexOutOfBoundsException(\"Rule not found\"));\n }\n\n\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/data/Invocation.java",
"content": "package com.jfrog.ide.idea.scan.data;\n\nimport com.fasterxml.jackson.annotation.JsonProperty;\nimport com.fasterxml.jackson.annotation.JsonPropertyOrder;\nimport org.apache.commons.collections4.CollectionUtils;\n\nimport java.util.ArrayList;\nimport java.util.List;\nimport java.util.Objects;\n\n@JsonPropertyOrder({\"executionSuccessful\", \"arguments\", \"workingDirectory\"})\npublic class Invocation {\n\n @JsonProperty(\"executionSuccessful\")\n private Boolean executionSuccessful;\n @JsonProperty(\"arguments\")\n private List arguments = new ArrayList<>();\n @JsonProperty(\"workingDirectory\")\n private WorkingDirectory workingDirectory;\n\n @SuppressWarnings(\"unused\")\n public Boolean getExecutionSuccessful() {\n return executionSuccessful;\n }\n\n @SuppressWarnings(\"unused\")\n public void setExecutionSuccessful(Boolean executionSuccessful) {\n this.executionSuccessful = executionSuccessful;\n }\n\n @SuppressWarnings(\"unused\")\n public List getArguments() {\n return arguments;\n }\n\n @SuppressWarnings(\"unused\")\n public void setArguments(List arguments) {\n this.arguments = arguments;\n }\n\n @SuppressWarnings(\"unused\")\n public WorkingDirectory getWorkingDirectory() {\n return workingDirectory;\n }\n\n @SuppressWarnings(\"unused\")\n public void setWorkingDirectory(WorkingDirectory workingDirectory) {\n this.workingDirectory = workingDirectory;\n }\n\n @Override\n public int hashCode() {\n return Objects.hash(arguments, executionSuccessful, workingDirectory);\n }\n\n @Override\n public boolean equals(Object other) {\n if (other == this) {\n return true;\n }\n if (!(other instanceof Invocation)) {\n return false;\n }\n Invocation rhs = ((Invocation) other);\n return (((CollectionUtils.isEqualCollection(this.arguments, rhs.arguments)) && (Objects.equals(this.executionSuccessful, rhs.executionSuccessful))) && (Objects.equals(this.workingDirectory, rhs.workingDirectory)));\n }\n\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/data/Location.java",
"content": "package com.jfrog.ide.idea.scan.data;\n\nimport com.fasterxml.jackson.annotation.JsonProperty;\n\nimport java.util.Objects;\n\npublic class Location {\n\n @JsonProperty(\"physicalLocation\")\n private PhysicalLocation physicalLocation;\n\n public PhysicalLocation getPhysicalLocation() {\n return physicalLocation;\n }\n\n @SuppressWarnings(\"unused\")\n public void setPhysicalLocation(PhysicalLocation physicalLocation) {\n this.physicalLocation = physicalLocation;\n }\n\n @Override\n public int hashCode() {\n return Objects.hash(physicalLocation);\n }\n\n @Override\n public boolean equals(Object other) {\n if (other == this) {\n return true;\n }\n if (!(other instanceof Location)) {\n return false;\n }\n Location rhs = ((Location) other);\n return (Objects.equals(this.physicalLocation, rhs.physicalLocation));\n }\n\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/data/Message.java",
"content": "package com.jfrog.ide.idea.scan.data;\n\nimport com.fasterxml.jackson.annotation.JsonProperty;\n\nimport java.util.Objects;\n\npublic class Message {\n\n @JsonProperty(\"text\")\n private String text;\n\n @JsonProperty(\"markdown\")\n private String markdown;\n\n public String getText() {\n return text;\n }\n\n public void setText(String text) {\n this.text = text;\n }\n\n @Override\n public int hashCode() {\n return Objects.hash(text);\n }\n\n @Override\n public boolean equals(Object other) {\n if (other == this) {\n return true;\n }\n if (!(other instanceof Message)) {\n return false;\n }\n Message rhs = ((Message) other);\n return (Objects.equals(this.text, rhs.text));\n }\n\n @SuppressWarnings({\"unused\"})\n public String getMarkdown() {\n return markdown;\n }\n\n @SuppressWarnings({\"unused\"})\n public void setMarkdown(String markdown) {\n this.markdown = markdown;\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/data/NewScanConfig.java",
"content": "package com.jfrog.ide.idea.scan.data;\n\nimport com.fasterxml.jackson.annotation.JsonProperty;\nimport com.jfrog.ide.common.nodes.subentities.SourceCodeScanType;\nimport lombok.AllArgsConstructor;\nimport lombok.Getter;\nimport lombok.NoArgsConstructor;\n\nimport java.util.List;\n\n@Getter\n@NoArgsConstructor\n@AllArgsConstructor\npublic class NewScanConfig {\n @JsonProperty(\"type\")\n private SourceCodeScanType scanType;\n @JsonProperty(\"roots\")\n private List roots;\n @JsonProperty(\"language\")\n private String language;\n @JsonProperty(\"output\")\n private String output;\n @JsonProperty(\"exclude_patterns\")\n private List excludePatterns;\n @JsonProperty(\"excluded-rules\")\n private List excludedRules;\n\n public NewScanConfig(ScanConfig inputParams) {\n this(inputParams.getScanType(),\n inputParams.getRoots(),\n inputParams.getLanguage(),\n inputParams.getOutput(),\n inputParams.getSkippedFolders(),\n inputParams.getExcludedRules());\n }\n}"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/data/NewScansConfig.java",
"content": "package com.jfrog.ide.idea.scan.data;\n\nimport com.fasterxml.jackson.annotation.JsonProperty;\nimport lombok.Getter;\nimport lombok.NoArgsConstructor;\n\nimport java.util.List;\n\n@Getter\n@NoArgsConstructor\npublic class NewScansConfig {\n @JsonProperty(\"scans\")\n private List scans;\n\n public NewScansConfig(NewScanConfig scan) {\n this.scans = List.of(scan);\n }\n}"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/data/Output.java",
"content": "package com.jfrog.ide.idea.scan.data;\n\nimport com.fasterxml.jackson.annotation.JsonProperty;\nimport org.apache.commons.collections4.CollectionUtils;\n\nimport java.util.ArrayList;\nimport java.util.List;\nimport java.util.Objects;\n\npublic class Output {\n\n @JsonProperty(\"runs\")\n private List runs = new ArrayList<>();\n @JsonProperty(\"version\")\n private String version;\n\n public List getRuns() {\n return runs;\n }\n @SuppressWarnings(\"unused\")\n public void setRuns(List runs) {\n this.runs = runs;\n }\n\n public String getVersion() {\n return version;\n }\n\n public void setVersion(String version) {\n this.version = version;\n }\n\n @Override\n public int hashCode() {\n return Objects.hash(runs, version);\n }\n\n @Override\n public boolean equals(Object other) {\n if (other == this) {\n return true;\n }\n if (!(other instanceof Output)) {\n return false;\n }\n Output rhs = ((Output) other);\n return ((CollectionUtils.isEqualCollection(this.runs, rhs.runs))) && (Objects.equals(this.version, rhs.version));\n }\n\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/data/PackageManagerType.java",
"content": "package com.jfrog.ide.idea.scan.data;\n\nimport lombok.Getter;\n\n@Getter\npublic enum PackageManagerType {\n PYPI(\"pypi\"),\n NPM(\"npm\"),\n YARN(\"yarn\"),\n MAVEN(\"maven\"),\n GRADLE(\"gradle\"),\n GO(\"go\");\n\n private final String name;\n\n PackageManagerType(String name) {\n this.name = name;\n }\n\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/data/PhysicalLocation.java",
"content": "package com.jfrog.ide.idea.scan.data;\n\nimport com.fasterxml.jackson.annotation.JsonProperty;\n\nimport java.util.Objects;\npublic class PhysicalLocation {\n\n @JsonProperty(\"artifactLocation\")\n private ArtifactLocation artifactLocation;\n @JsonProperty(\"region\")\n private Region region;\n\n public ArtifactLocation getArtifactLocation() {\n return artifactLocation;\n }\n\n @SuppressWarnings(\"unused\")\n public void setArtifactLocation(ArtifactLocation artifactLocation) {\n this.artifactLocation = artifactLocation;\n }\n\n public Region getRegion() {\n return region;\n }\n\n @SuppressWarnings(\"unused\")\n public void setRegion(Region region) {\n this.region = region;\n }\n\n @Override\n public int hashCode() {\n return Objects.hash(region, artifactLocation);\n }\n\n @Override\n public boolean equals(Object other) {\n if (other == this) {\n return true;\n }\n if (!(other instanceof PhysicalLocation)) {\n return false;\n }\n PhysicalLocation rhs = ((PhysicalLocation) other);\n return ((Objects.equals(this.region, rhs.region)) && (Objects.equals(this.artifactLocation, rhs.artifactLocation)));\n }\n\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/data/Region.java",
"content": "package com.jfrog.ide.idea.scan.data;\n\nimport com.fasterxml.jackson.annotation.JsonProperty;\n\nimport java.util.Objects;\n\npublic class Region {\n\n @JsonProperty(\"endColumn\")\n private int endColumn;\n @JsonProperty(\"endLine\")\n private int endLine;\n @JsonProperty(\"startColumn\")\n private int startColumn;\n @JsonProperty(\"startLine\")\n private int startLine;\n @JsonProperty(\"snippet\")\n\n private Message snippet;\n\n public int getEndColumn() {\n return endColumn;\n }\n\n @SuppressWarnings(\"unused\")\n public void setEndColumn(int endColumn) {\n this.endColumn = endColumn;\n }\n\n public int getEndLine() {\n return endLine;\n }\n\n @SuppressWarnings(\"unused\")\n public void setEndLine(int endLine) {\n this.endLine = endLine;\n }\n\n public int getStartColumn() {\n return startColumn;\n }\n\n @SuppressWarnings(\"unused\")\n public void setStartColumn(int startColumn) {\n this.startColumn = startColumn;\n }\n\n public int getStartLine() {\n return startLine;\n }\n\n @SuppressWarnings(\"unused\")\n public void setStartLine(int startLine) {\n this.startLine = startLine;\n }\n\n public Message getSnippet() {\n return snippet;\n }\n\n @SuppressWarnings(\"unused\")\n public void setSnippet(Message snippet) {\n this.snippet = snippet;\n }\n\n @Override\n public int hashCode() {\n return Objects.hash(endLine, endColumn, startColumn, startLine, snippet);\n }\n\n @Override\n public boolean equals(Object other) {\n if (other == this) {\n return true;\n }\n if (!(other instanceof Region)) {\n return false;\n }\n Region rhs = ((Region) other);\n return ((((Objects.equals(this.endLine, rhs.endLine)) && (Objects.equals(this.endColumn, rhs.endColumn))) && (Objects.equals(this.startColumn, rhs.startColumn))) && (Objects.equals(this.startLine, rhs.startLine)) && (Objects.equals(this.snippet, rhs.snippet)));\n }\n\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/data/Rule.java",
"content": "package com.jfrog.ide.idea.scan.data;\n\nimport com.fasterxml.jackson.annotation.JsonProperty;\nimport java.util.Objects;\nimport java.util.Optional;\n\npublic class Rule {\n\n @JsonProperty(\"id\")\n private String id;\n\n @JsonProperty(\"name\")\n private String name;\n\n @JsonProperty(\"shortDescription\")\n private Message shortDescription;\n\n @JsonProperty(\"fullDescription\")\n private Message fullDescription;\n\n @JsonProperty(\"properties\")\n private RuleProperties properties;\n\n public String getId() {\n return id;\n }\n\n public void setId(String id) {\n this.id = id;\n }\n\n @SuppressWarnings({\"unused\"})\n public Message getShortDescription() {\n return shortDescription;\n }\n\n @SuppressWarnings({\"unused\"})\n public void setShortDescription(Message shortDescription) {\n this.shortDescription = shortDescription;\n }\n\n @SuppressWarnings({\"unused\"})\n public Message getFullDescription() {\n return fullDescription;\n }\n\n @SuppressWarnings({\"unused\"})\n public void setFullDescription(Message fullDescription) {\n this.fullDescription = fullDescription;\n }\n\n public Optional getRuleProperties() {\n return Optional.ofNullable(properties);\n }\n\n @Override\n public int hashCode() {\n return Objects.hash(id);\n }\n\n\n @Override\n public boolean equals(Object other) {\n if (other == this) {\n return true;\n }\n if (!(other instanceof Rule)) {\n return false;\n }\n Rule rhs = ((Rule) other);\n return Objects.equals(this.id, rhs.id);\n }\n}\n\n\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/data/RuleProperties.java",
"content": "package com.jfrog.ide.idea.scan.data;\n\nimport com.fasterxml.jackson.annotation.JsonProperty;\nimport lombok.Getter;\n\n@Getter\npublic class RuleProperties {\n\n @JsonProperty(\"conclusion\")\n private String conclusion;\n\n @JsonProperty(\"applicability\")\n private String applicability;\n\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/data/Run.java",
"content": "package com.jfrog.ide.idea.scan.data;\n\nimport com.fasterxml.jackson.annotation.JsonProperty;\nimport org.apache.commons.collections4.CollectionUtils;\n\nimport java.util.ArrayList;\nimport java.util.List;\nimport java.util.Objects;\n\npublic class Run {\n\n @JsonProperty(\"tool\")\n private Tool tool;\n @JsonProperty(\"invocations\")\n private List invocations = new ArrayList<>();\n @JsonProperty(\"results\")\n private List results = new ArrayList<>();\n\n public Tool getTool() {\n return tool;\n }\n\n @SuppressWarnings({\"unused\"})\n public void setTool(Tool tool) {\n this.tool = tool;\n }\n\n @SuppressWarnings({\"unused\"})\n public List getInvocations() {\n return invocations;\n }\n\n @SuppressWarnings({\"unused\"})\n public void setInvocations(List invocations) {\n this.invocations = invocations;\n }\n\n public List getResults() {\n return results;\n }\n\n public Rule getRuleFromRunById(String ruleId) {\n return this.getTool().getDriver().getRuleById(ruleId);\n }\n\n public void setResults(List results) {\n this.results = results;\n }\n\n @Override\n public int hashCode() {\n return Objects.hash(results, tool, invocations);\n }\n\n @Override\n public boolean equals(Object other) {\n if (other == this) {\n return true;\n }\n if (!(other instanceof Run)) {\n return false;\n }\n Run rhs = ((Run) other);\n return (((CollectionUtils.isEqualCollection(this.results, rhs.results)) && (Objects.equals(this.tool, rhs.tool))) && (CollectionUtils.isEqualCollection(this.invocations, rhs.invocations)));\n }\n\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/data/SarifResult.java",
"content": "package com.jfrog.ide.idea.scan.data;\n\nimport com.fasterxml.jackson.annotation.JsonProperty;\nimport lombok.Getter;\nimport org.apache.commons.collections4.CollectionUtils;\nimport org.apache.commons.lang3.ArrayUtils;\nimport org.apache.commons.lang3.StringUtils;\n\nimport java.util.ArrayList;\nimport java.util.List;\nimport java.util.Objects;\n\n@Getter\npublic class SarifResult {\n @JsonProperty(\"message\")\n private Message message;\n @JsonProperty(\"locations\")\n private List locations = new ArrayList<>();\n @JsonProperty(\"ruleId\")\n private String ruleId;\n @JsonProperty(\"codeFlows\")\n private List codeFlows = new ArrayList<>();\n @JsonProperty(\"kind\")\n private String kind;\n @JsonProperty(\"level\")\n private String severity;\n @JsonProperty(\"suppressions\")\n private AnalyzeSuppression[] suppressions;\n\n public void setKind(String kind) {\n this.kind = kind;\n }\n\n public void setSeverity(String severity) {\n this.severity = severity;\n }\n\n public void setSuppressions(AnalyzeSuppression[] suppressions) {\n this.suppressions = suppressions;\n }\n\n public String getKind() {\n return StringUtils.defaultString(kind);\n }\n\n public String getSeverity() {\n return StringUtils.defaultString(severity, \"warning\");\n }\n\n public void setMessage(Message message) {\n this.message = message;\n }\n\n @SuppressWarnings({\"unused\"})\n public void setLocations(List locations) {\n this.locations = locations;\n }\n\n @SuppressWarnings({\"unused\"})\n public void setRuleId(String ruleId) {\n this.ruleId = ruleId;\n }\n\n @SuppressWarnings({\"unused\"})\n public List getCodeFlows() {\n return codeFlows;\n }\n\n @SuppressWarnings({\"unused\"})\n public void setCodeFlows(List codeFlows) {\n this.codeFlows = codeFlows;\n }\n\n @Override\n public int hashCode() {\n return Objects.hash(locations, message, ruleId, codeFlows);\n }\n\n @Override\n public boolean equals(Object other) {\n if (other == this) {\n return true;\n }\n if (!(other instanceof SarifResult)) {\n return false;\n }\n SarifResult rhs = ((SarifResult) other);\n return ((((CollectionUtils.isEqualCollection(this.locations, rhs.locations)) && (Objects.equals(this.message, rhs.message))) && (Objects.equals(this.ruleId, rhs.ruleId))) && (CollectionUtils.isEqualCollection(this.codeFlows, rhs.codeFlows)));\n }\n\n public boolean isNotSuppressed() {\n return ArrayUtils.isEmpty(suppressions);\n }\n}\n"
},
{
"path": "src/main/java/com/jfrog/ide/idea/scan/data/ScanConfig.java",
"content": "package com.jfrog.ide.idea.scan.data;\n\nimport com.fasterxml.jackson.annotation.JsonProperty;\nimport com.jfrog.ide.common.nodes.subentities.SourceCodeScanType;\nimport lombok.Getter;\nimport lombok.ToString;\n\nimport java.util.ArrayList;\nimport java.util.List;\n\n@Getter\n@ToString\npublic class ScanConfig {\n @JsonProperty(\"type\")\n private SourceCodeScanType scanType;\n @JsonProperty(\"language\")\n private String language;\n @JsonProperty(\"roots\")\n private List roots;\n @JsonProperty(\"output\")\n private String output;\n @JsonProperty(\"grep-disable\")\n private Boolean grepDisable;\n @JsonProperty(\"cve-whitelist\")\n private List cves;\n @JsonProperty(\"skipped-folders\")\n private List skippedFolders;\n @JsonProperty(\"excluded-rules\")\n private List excludedRules;\n\n @SuppressWarnings(\"unused\")\n ScanConfig() {\n }\n\n ScanConfig(Builder builder) {\n this.scanType = builder.scanType;\n this.language = builder.language;\n this.roots = builder.roots;\n this.output = builder.output;\n this.cves = builder.cves;\n this.grepDisable = builder.grepDisable;\n this.skippedFolders = builder.skippedFolders;\n this.excludedRules = builder.excludedRules;\n }\n\n @SuppressWarnings(\"unused\")\n public SourceCodeScanType getScanType() {\n return scanType;\n }\n\n @SuppressWarnings(\"unused\")\n public void setScanType(SourceCodeScanType scanType) {\n this.scanType = scanType;\n }\n\n public void setLanguage(String language) {\n this.language = language;\n }\n\n @SuppressWarnings(\"unused\")\n public void setRoots(List roots) {\n this.roots = roots;\n }\n\n @SuppressWarnings(\"unused\")\n public void setOutput(String output) {\n this.output = output;\n }\n\n @SuppressWarnings(\"unused\")\n public Boolean getGrepDisable() {\n return grepDisable;\n }\n\n @SuppressWarnings(\"unused\")\n public void setGrepDisable(Boolean grepDisable) {\n this.grepDisable = grepDisable;\n }\n\n @SuppressWarnings(\"unused\")\n public List getCves() {\n return cves;\n }\n\n @SuppressWarnings(\"unused\")\n public void setCves(List cves) {\n this.cves = cves;\n }\n\n @SuppressWarnings(\"unused\")\n public List getSkippedFolders() {\n return skippedFolders;\n }\n\n @SuppressWarnings(\"unused\")\n public void setSkippedFolders(List skippedFolders) {\n this.skippedFolders = skippedFolders;\n }\n\n public static class Builder {\n private SourceCodeScanType scanType;\n private String language;\n private List roots;\n private String output;\n private Boolean grepDisable;\n private List cves;\n private List skippedFolders;\n private List excludedRules;\n\n public Builder() {\n roots = new ArrayList<>();\n cves = new ArrayList<>();\n skippedFolders = new ArrayList<>();\n excludedRules = new ArrayList<>();\n }\n\n @SuppressWarnings(\"UnusedReturnValue\")\n public Builder scanType(SourceCodeScanType scanType) {\n this.scanType = scanType;\n return this;\n }\n\n public Builder language(String language) {\n this.language = language;\n return this;\n }\n\n public Builder roots(List roots) {\n this.roots = roots;\n return this;\n }\n\n @SuppressWarnings(\"UnusedReturnValue\")\n public Builder output(String output) {\n this.output = output;\n return this;\n }\n\n @SuppressWarnings(\"unused\")\n public Builder grepDisable(Boolean grepDisable) {\n this.grepDisable = grepDisable;\n return this;\n }\n\n public Builder cves(List