search

mercedes-benz / sechub

SecHub provides a central API to test software with different security tools.
https://mercedes-benz.github.io/sechub/
MIT License
259 stars 58 forks source link

Developer Admin UI - integration test actions for webscan not working #121

Open de-jcup opened 4 years ago

de-jcup commented 4 years ago

Developer admin UI is currently not able to trigger integration tests for code scans:

image

will always result in a red finding, because no source code is uploaded by the used mechanism.

Here an example output on server side:

2019-12-16 10:23:43.687  INFO 8386 --- [c-job-launcher3] c.d.sechub.domain.scan.ScanService       : start scan for __[SECHUB-UID:db7b88f6-b300-490d-9e04-812dd2d5e464]__
2019-12-16 10:23:43.688 DEBUG 8386 --- [c-job-launcher3] .s.p.CodeScanProductExecutionServiceImpl : Code scan options found __[SECHUB-UID:db7b88f6-b300-490d-9e04-812dd2d5e464]__
2019-12-16 10:23:43.688  INFO 8386 --- [c-job-launcher3] .s.d.s.p.AbstractProductExecutionService : Start executor CHECKMARX and wait for result. __[SECHUB-UID:db7b88f6-b300-490d-9e04-812dd2d5e464]__
2019-12-16 10:23:43.688 DEBUG 8386 --- [c-job-launcher3] .s.p.AbstractInstallSetupProductExecutor : Executing __[SECHUB-UID:db7b88f6-b300-490d-9e04-812dd2d5e464]__
2019-12-16 10:23:43.688 DEBUG 8386 --- [c-job-launcher3] .s.d.s.p.AbstractCodeScanProductExecutor : __[SECHUB-UID:db7b88f6-b300-490d-9e04-812dd2d5e464]__ register scan target:Target [type=CODE_UPLOAD, id=code_upload://../sechub-doc/src/main/java, uri=null, inetAdress=null]
2019-12-16 10:23:43.688 DEBUG 8386 --- [c-job-launcher3] .s.p.AbstractInstallSetupProductExecutor : __[SECHUB-UID:db7b88f6-b300-490d-9e04-812dd2d5e464]__ Setup says its not able to scan target type INTRANET with CHECKMARX
2019-12-16 10:23:43.688 DEBUG 8386 --- [c-job-launcher3] .s.p.AbstractInstallSetupProductExecutor : __[SECHUB-UID:db7b88f6-b300-490d-9e04-812dd2d5e464]__ Setup says its not able to scan target type INTERNET with CHECKMARX
2019-12-16 10:23:43.688 DEBUG 8386 --- [c-job-launcher3] .s.p.AbstractInstallSetupProductExecutor : __[SECHUB-UID:db7b88f6-b300-490d-9e04-812dd2d5e464]__ Setup says it IS able to scan target type CODE_UPLOAD with CHECKMARX
2019-12-16 10:23:43.688 DEBUG 8386 --- [c-job-launcher3] c.d.s.d.s.p.c.CheckmarxProductExecutor   : Trigger checkmarx adapter execution
2019-12-16 10:23:43.688  INFO 8386 --- [c-job-launcher3] c.d.s.s.r.ResilientActionExecutor        : Handle exception of type:java.io.FileNotFoundException
2019-12-16 10:23:43.688  INFO 8386 --- [c-job-launcher3] .s.d.s.p.c.CheckmarxResilienceConsultant : Can't make proposal for exception with root cause:java.io.FileNotFoundException:/tmp/sechub-temp-sharedvolume66852469995343082/upload/scenario3_project1/db7b88f6-b300-490d-9e04-812dd2d5e464/sourcecode.zip (No such file or directory)
2019-12-16 10:23:43.688  INFO 8386 --- [c-job-launcher3] c.d.s.s.r.ResilientActionExecutor        : None of the consultants (1) gave any proposal, so rethrow exception java.io.FileNotFoundException:/tmp/sechub-temp-sharedvolume66852469995343082/upload/scenario3_project1/db7b88f6-b300-490d-9e04-812dd2d5e464/sourcecode.zip (No such file or directory)
2019-12-16 10:23:43.689 ERROR 8386 --- [c-job-launcher3] .s.d.s.p.AbstractProductExecutionService : Product executor failed:CHECKMARX __[SECHUB-UID:db7b88f6-b300-490d-9e04-812dd2d5e464]__

com.daimler.sechub.sharedkernel.execution.SecHubExecutionException: CHECKMARX execution failed.__[SECHUB-UID:db7b88f6-b300-490d-9e04-812dd2d5e464]__
    at com.daimler.sechub.domain.scan.product.AbstractInstallSetupProductExecutor.execute(AbstractInstallSetupProductExecutor.java:74)
    at com.daimler.sechub.domain.scan.product.AbstractProductExecutionService.execute(AbstractProductExecutionService.java:77)
    at com.daimler.sechub.domain.scan.product.AbstractProductExecutionService.executeAndPersistResults(AbstractProductExecutionService.java:111)
    at com.daimler.sechub.domain.scan.product.AbstractProductExecutionService.executeProductsAndStoreResults(AbstractProductExecutionService.java:64)
    at com.daimler.sechub.domain.scan.product.AbstractProductExecutionService$$FastClassBySpringCGLIB$$2ec9ff9d.invoke(<generated>)
    at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:218)
    at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:685)
    at com.daimler.sechub.domain.scan.product.CodeScanProductExecutionServiceImpl$$EnhancerBySpringCGLIB$$f45abfa2.executeProductsAndStoreResults(<generated>)
    at com.daimler.sechub.domain.scan.ScanService.executeScan(ScanService.java:106)
    at com.daimler.sechub.domain.scan.ScanService.startScan(ScanService.java:75)
    at com.daimler.sechub.domain.scan.ScanService.receiveSynchronMessage(ScanService.java:159)
    at com.daimler.sechub.sharedkernel.messaging.DomainMessageService.sendSynchron(DomainMessageService.java:138)
    at com.daimler.sechub.domain.schedule.batch.ScanExecutionTasklet.executeSafe(ScanExecutionTasklet.java:67)
    at com.daimler.sechub.domain.schedule.batch.ScanExecutionTasklet.execute(ScanExecutionTasklet.java:43)
    at org.springframework.batch.core.step.tasklet.TaskletStep$ChunkTransactionCallback.doInTransaction(TaskletStep.java:407)
    at org.springframework.batch.core.step.tasklet.TaskletStep$ChunkTransactionCallback.doInTransaction(TaskletStep.java:331)
    at org.springframework.transaction.support.TransactionTemplate.execute(TransactionTemplate.java:140)
    at org.springframework.batch.core.step.tasklet.TaskletStep$2.doInChunkContext(TaskletStep.java:273)
    at org.springframework.batch.core.scope.context.StepContextRepeatCallback.doInIteration(StepContextRepeatCallback.java:82)
    at org.springframework.batch.repeat.support.RepeatTemplate.getNextResult(RepeatTemplate.java:375)
    at org.springframework.batch.repeat.support.RepeatTemplate.executeInternal(RepeatTemplate.java:215)
    at org.springframework.batch.repeat.support.RepeatTemplate.iterate(RepeatTemplate.java:145)
    at org.springframework.batch.core.step.tasklet.TaskletStep.doExecute(TaskletStep.java:258)
    at org.springframework.batch.core.step.AbstractStep.execute(AbstractStep.java:208)
    at org.springframework.batch.core.job.SimpleStepHandler.handleStep(SimpleStepHandler.java:148)
    at org.springframework.batch.core.job.flow.JobFlowExecutor.executeStep(JobFlowExecutor.java:68)
    at org.springframework.batch.core.job.flow.support.state.StepState.handle(StepState.java:68)
    at org.springframework.batch.core.job.flow.support.SimpleFlow.resume(SimpleFlow.java:169)
    at org.springframework.batch.core.job.flow.support.SimpleFlow.start(SimpleFlow.java:144)
    at org.springframework.batch.core.job.flow.FlowJob.doExecute(FlowJob.java:137)
    at org.springframework.batch.core.job.AbstractJob.execute(AbstractJob.java:319)
    at org.springframework.batch.core.launch.support.SimpleJobLauncher$1.run(SimpleJobLauncher.java:147)
    at java.lang.Thread.run(Thread.java:748)
Caused by: java.io.FileNotFoundException: /tmp/sechub-temp-sharedvolume66852469995343082/upload/scenario3_project1/db7b88f6-b300-490d-9e04-812dd2d5e464/sourcecode.zip (No such file or directory)
    at java.io.FileInputStream.open0(Native Method)
    at java.io.FileInputStream.open(FileInputStream.java:195)
    at java.io.FileInputStream.<init>(FileInputStream.java:138)
    at com.daimler.sechub.sharedkernel.storage.filesystem.SharedVolumeJobStorage.fetch(SharedVolumeJobStorage.java:46)
    at com.daimler.sechub.domain.scan.product.checkmarx.CheckmarxProductExecutor.lambda$0(CheckmarxProductExecutor.java:80)
    at com.daimler.sechub.sharedkernel.resilience.ResilientActionExecutor.executeResilient(ResilientActionExecutor.java:44)
    at com.daimler.sechub.domain.scan.product.checkmarx.CheckmarxProductExecutor.executeWithAdapter(CheckmarxProductExecutor.java:78)
    at com.daimler.sechub.domain.scan.product.checkmarx.CheckmarxProductExecutor.executeWithAdapter(CheckmarxProductExecutor.java:1)
    at com.daimler.sechub.domain.scan.product.AbstractInstallSetupProductExecutor.executeAdapterWhenTargetTypeSupported(AbstractInstallSetupProductExecutor.java:180)
    at com.daimler.sechub.domain.scan.product.AbstractInstallSetupProductExecutor.execute(AbstractInstallSetupProductExecutor.java:154)
    at com.daimler.sechub.domain.scan.product.AbstractInstallSetupProductExecutor.execute(AbstractInstallSetupProductExecutor.java:66)
    ... 32 common frames omitted
de-jcup commented 4 years ago

The normal integration tests do work correctly with same setup, so we should lookup for the (pseudo/empty) source zip file upload there and adopt.