jenkinsci / ibm-security-appscansource-scanner-plugin

Jenkins plugin for executing AppScan Source
https://plugins.jenkins.io/ibm-security-appscansource-scanner/
GNU General Public License v3.0
5 stars 7 forks source link

Known issue using system32 as Jenkins Home #2

Open kevinfealey opened 8 years ago

kevinfealey commented 8 years ago

By default, when Jenkins is installed as a service, it attempts to put files here: C:\Windows\system32\config\systemprofile.jenkins\

However, in many cases, Jenkins will be blindly redirected by Windows to use another folder instead: C:\Windows\SysWOW64\config\systemprofile.jenkins This function is described here: https://msdn.microsoft.com/en-us/library/windows/desktop/aa384187(v=vs.85).aspx

Windows does not alert Jenkins of the redirect - instead, files are just stored in the SysWOW64 directory. Jenkins seems to be able to handle this change, but the AppScan plugin is not. When attempting to access Jenkins Home (via C:\Windows\system32\config\systemprofile.jenkins), the plugin receives a file not found error from Windows, since Windows does not redirect the plugin when attempting file access.

In these cases, Jenkins output will be similar to the following:

Scanning C:\file.paf with AppScan Source
[workspace] $ "C:\Program Files (x86)\IBM\AppScanSource\bin\AppScanSrcCli.exe" script "C:\Windows\system32\config\systemprofile\.jenkins\jobs\Scan \workspace\temp_cli_script_1992116858118644391.txt"
>> Welcome to IBM Security AppScan Source!

Login successful.

CRWSA1653E Error: CRWSA1697E Invalid Usage.

----------------------------------------------------------------------
|   Run a scan on the current object.
|
|   Optional Arguments:
|      path -  the full path of the file in which
|              to save the assessment results
|      -name - name for the generated assessment
|      -scanconfig - name of a scan configuration to
|                    use for the scan
|
|   Notes:
|      If no path is specified, the assessment file is
|      saved to the working directory using the name.
----------------------------------------------------------------------

Logged out.
>> Exiting the IBM Security AppScan Source Command Line Interface...
ERROR: AppScan Source execution failed
Finished: FAILURE

This is because the file: C:\Windows\system32\config\systemprofile.jenkins\jobs\Scan Eightball\workspace\temp_cli_script_1992116858118644391.txt does not exist at that location. In fact, it is located at: C:\Windows\SysWOW64\config\systemprofile.jenkins\jobs\Scan Eightball\workspace\temp_cli_script_1992116858118644391.txt Alerting the plugin of the actual file location is not trivial, and since this is an edge case, no fix is expected. Instead, the recommended solution is to update the Jenkins Home location outside of the system32 folder.

praveensatti commented 5 years ago

Thanks