ziyi-bear
commented
2 weeks ago Hi we also facing the same issue but our scan only use sast, and we have try upgrade gitlab and cx-flow to latest not working
Reproduction
Detail the steps taken to reproduce the issue
Where applicable, please include (exclude sensitive information):
- Code of Files to reproduce the issue
- Log files
2024-10-17 11:18:22.629 DEBUG 15 --- [ main] o.s.w.HttpLogging [agEmyYpd] : HTTP GET https://gitlab.dgbas.gov.tw/api/v4/projects?search=sfund&pagination=keyset&per_page=100&order_by=id&sort=asc&id_after=0 2024-10-17 11:18:22.630 DEBUG 15 --- [ main] o.s.w.HttpLogging [agEmyYpd] : Accept=[text/plain, application/json, application/*+json, */*] 2024-10-17 11:18:26.516 DEBUG 15 --- [ main] o.s.w.HttpLogging [agEmyYpd] : Response 200 OK 2024-10-17 11:18:26.517 DEBUG 15 --- [ main] o.s.w.HttpLogging [agEmyYpd] : Reading to [java.lang.String] as "application/json" 2024-10-17 11:18:26.521 INFO 15 --- [ main] c.c.f.s.IssueService [agEmyYpd] : Processing Issues with custom bean GitLab 2024-10-17 11:18:26.522 INFO 15 --- [ main] c.c.f.c.GitLabIssueTracker [agEmyYpd] : Executing getIssues GitLab API call 2024-10-17 11:18:26.523 DEBUG 15 --- [ main] o.s.w.HttpLogging [agEmyYpd] : HTTP GET https://gitlab.dgbas.gov.tw/api/v4/projects/1/issues?per_page=100 2024-10-17 11:18:26.524 DEBUG 15 --- [ main] o.s.w.HttpLogging [agEmyYpd] : Accept=[application/json, application/*+json] 2024-10-17 11:18:27.415 DEBUG 15 --- [ main] o.s.w.HttpLogging [agEmyYpd] : Response 200 OK 2024-10-17 11:18:27.416 DEBUG 15 --- [ main] o.s.w.HttpLogging [agEmyYpd] : Reading to [com.checkmarx.flow.dto.gitlab.Issue[]] 2024-10-17 11:18:27.444 INFO 15 --- [ main] c.c.f.c.GitLabIssueTracker [agEmyYpd] : Finalizing GitLab Processing 2024-10-17 11:18:27.444 INFO 15 --- [ main] c.c.f.s.ResultsService [agEmyYpd] : ######## Checkmarx Scan Results Summary ######## 2024-10-17 11:18:27.445 INFO 15 --- [ main] c.c.f.s.ResultsService [agEmyYpd] : Team: /CxServer/SP/Company/XBA 2024-10-17 11:18:27.445 INFO 15 --- [ main] c.c.f.s.ResultsService [agEmyYpd] : Project: sfund-main 2024-10-17 11:18:27.445 INFO 15 --- [ main] c.c.f.s.ResultsService [agEmyYpd] : Scan-Id: 1034975 2024-10-17 11:18:27.445 INFO 15 --- [ main] c.c.f.s.ResultsService [agEmyYpd] : High vulnerabilities: 57 2024-10-17 11:18:27.445 INFO 15 --- [ main] c.c.f.s.ResultsService [agEmyYpd] : Medium vulnerabilities: 10670 2024-10-17 11:18:27.445 INFO 15 --- [ main] c.c.f.s.ResultsService [agEmyYpd] : Low vulnerabilities: 96373 2024-10-17 11:18:27.445 INFO 15 --- [ main] c.c.f.s.ResultsService [agEmyYpd] : Info vulnerabilities: 7000 2024-10-17 11:18:27.445 INFO 15 --- [ main] c.c.f.s.ResultsService [agEmyYpd] : To view results use following link: http://172.16.250.21/CxWebClient/ViewerMain.aspx?scanid=1034975&projectid=292 2024-10-17 11:18:27.445 INFO 15 --- [ main] c.c.f.s.ResultsService [agEmyYpd] : ################################################ 2024-10-17 11:18:27.446 INFO 15 --- [ main] c.c.f.s.ThresholdValidatorImpl [agEmyYpd] : Checking Thresholds exists. sast thresholds: true. sca thresholds: false 2024-10-17 11:18:27.447 TRACE 15 --- [ main] o.s.b.f.s.DefaultListableBeanFactory [agEmyYpd] : Returning cached instance of singleton bean 'sastScanner' 2024-10-17 11:18:27.454 INFO 15 --- [ main] c.c.f.s.ThresholdValidatorImpl [agEmyYpd] : Using CxSAST thresholds: {"HIGH":10,"MEDIUM":10,"LOW":10} 2024-10-17 11:18:27.457 INFO 15 --- [ main] c.c.f.s.ThresholdValidatorImpl [agEmyYpd] : Finding counts: {} 2024-10-17 11:18:27.458 INFO 15 --- [ main] c.c.f.s.ThresholdValidatorImpl [agEmyYpd] : No thresholds were exceeded. 2024-10-17 11:18:27.458 TRACE 15 --- [ main] o.s.b.f.s.DefaultListableBeanFactory [agEmyYpd] : Returning cached instance of singleton bean 'SCAScanner' 2024-10-17 11:18:27.458 TRACE 15 --- [ main] o.s.b.f.s.DefaultListableBeanFactory [agEmyYpd] : Returning cached instance of singleton bean 'cxGoScanner' 2024-10-17 11:18:27.458 INFO 15 --- [ main] c.c.f.CxFlowRunner [agEmyYpd] : Build succeeded. all checks passed 2024-10-17 11:18:27.458 INFO 15 --- [ main] c.c.f.CxFlowRunner [agEmyYpd] : Completed Successfully 2024-10-17 11:18:27.459 INFO 15 --- [ main] c.c.f.CxFlowRunner [agEmyYpd] : Finished with exit code: 0 2024-10-17 11:18:27.461 DEBUG 15 --- [ionShutdownHook] s.c.a.AnnotationConfigApplicationContext [] : Closing- Application settings .gitlab-ci.yml
variables: GITLAB_URL: "${CI_SERVER_URL}" GITLAB_API_URL: "${CI_API_V4_URL}" CHECKMARX_DOCKER_IMAGE: "cx-flow" CX_FLOW_BUG_TRACKER: "GitLab" CX_FLOW_BUG_TRACKER_IMPL: ${CX_FLOW_BUG_TRACKER} CX_FLOW_EXE: "java -jar /app/cx-flow.jar" CX_PROJECT: "$CI_PROJECT_NAME-$CI_COMMIT_REF_NAME" CHECKMARX_VERSION: "9.0" CHECKMARX_SETTINGS_OVERRIDE: "true" # CHECKMARX_EXCLUDE_FILES: "*.gif,*.jpg,*.jpeg,*.ttf,*.xls,*.xlsx,*.jar,*.doc,*.docx,*.7z,*.zip,*.jasper,*.jrxml,*.exe,*.py" # CHECKMARX_EXCLUDE_FOLDERS: "" CHECKMARX_CONFIGURATION: "Default Configuration" CHECKMARX_SCAN_PRESET: "OWASP TOP 10 - 2021" CX_FLOW_FILTER_SEVERITY: "High" CX_FLOW_FILTER_CATEGORY: "" CX_FLOW_FILTER_CWE: "" CX_FLOW_FILTER_STATUS: "" CX_FLOW_FILTER_STATE: "" CX_FLOW_ENABLED_VULNERABILITY_SCANNERS: sast CX_FLOW_ZIP_EXCLUDE: '\.git/.*, .*\.png, .*\.ttf, .*\.jasper, .*\.jrxml, .*\.zip, .*\.exe, .*\.py, .*\.xlsx, .*\.xls, .*\.7z' # CX_FLOW_ZIP_EXCLUDE: '.jar,^.*\.(jpg|jpeg|ttf|xls|xlsx|jar|doc|docx|7z|zip|jasper|jrxml|exe|py|gif|)$' CX_FLOW_BREAK_BUILD: "true" GITLAB_BLOCK_MERGE: "false" GITLAB_ERROR_MERGE: "false" SECURITY_DASHBOARD_ON_MR: "false" PARAMS: ""
checkmarx-scan: stage: test rules:
- if: '$CX_FLOW_BUG_TRACKER != "GitLabDashboard" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH' image: name: checkmarx/${CHECKMARX_DOCKER_IMAGE} entrypoint: [""] needs: [] variables: CHECKMARX_INCREMENTAL: "true" CXFLOW_THRESHOLDS_HIGH: 10 CXFLOW_THRESHOLDS_LOW: 10 CXFLOW_THRESHOLDS_MEDIUM: 10 timeout: 24h script:
- ${CX_FLOW_EXE}
--scan
--app="${CI_PROJECT_NAME}"
--namespace="${CI_PROJECT_NAMESPACE}"
--repo-name="${CI_PROJECT_NAME}"
--repo-url="${CI_REPOSITORY_URL}"
--cx-team="${CX_TEAM}"
--cx-project="${CX_PROJECT}"
--branch="${CI_COMMIT_BRANCH}"
--spring.profiles.active="${CX_FLOW_ENABLED_VULNERABILITY_SCANNERS}"
--logging.level.org.springframework.web.client.RestTemplate=INFO
--logging.level.com.checkmarx.flow.service=INFO
--logging.level.org.apache.http.wire=INFO
--checkmarx.scan-queuing=true
--checkmarx.scan-resubmit=true
--checkmarx.scan-timeout=920
--checkmarx.report-timeout=40000000
--f=.
${PARAMS}
artifacts:
paths:
- "*.zip"
when: always
> - Screenshots
- "*.zip"
when: always
Environment Details
CxSAST 9.5.5.1007 HF14 CxFlow 1.7.04 GitLab runner 17.4.1
Kiri487
Description
I've configured the thresholds on medium and low with gitlab issue tracker in gitlab pipeline, but only scans were executed. what am I missing in my config?
Expected Behavior
from my understanding, with "bug-tracker", "break-build" configured, scan result should be presented by gitlab issue, also with thresholds set, the build would also failed if exceeded.
Actual Behavior
it seems like theres only the scan being executed, no issue being opened, no build failed, just the scan happend. the ThresholdValidatorImpl picked up the thresholds settings but no finding counts, even though ResultsService actually shows the scan results exceeded.
Reproduction
gitlab-ci.yml file
Environment Details
CxSAST 9.6.5 CxFlow 1.7.03 JDK 17.0.12 GitLab runner 17.3.1