checkmarx-ts / checkmarx-cxflow-orb Goto Github PK

Is your feature request related to a problem? Please describe.
unable to override scanned file directory -f, defaulted to working directory

Describe the solution you'd like
Allow the '-f' parameter to be configured

Orb Version

checkmarx-ts/[email protected]

Describe the bug

During the checkout step, the error states:

Either git or ssh (required by git to clone through SSH) is not installed in the image

$ docker run --rm -it --entrypoint /bin/sh checkmarx/cx-flow:latest

/app # which git
# [no output; missing git]
/app # which ssh
# [no output; missing ssh]
/app # exit

$ docker run --rm -it --entrypoint /bin/sh cimg/base:stable

$ which git
/usr/bin/git
$ which ssh
/usr/bin/ssh
$ exit

To Reproduce

Checkout the Orb

Expected behavior

Successful checkout step

Additional context

image in question: https://hub.docker.com/r/checkmarx/cx-flow

Orb Version
Latest

Describe the bug
The default for apply-filters:

  apply-filters:
    type: string
    default: "--filter-severity=High --filter-severity=Medium --filter-severity=Low"
    description: "Select report filter criteria"

The option --filter-severity does not exist, so a default config yaml file in the jar defaults the filter to High. A customer was scanning a project that had 0 highs and trying to push results to Jira, so no results would be created in Jira causing confusion.

We used this workaround in the config.yml:

apply-filters: '--cx-flow.filter-severity=High,Medium,Low,Informational'

To Reproduce

Scan a project with 0 high results, note the are no reported results if trying to update Jira.

Expected behavior
High, Medium, Low results appear in the issue tracker by default.

Is your feature request related to a problem? Please describe.
The orb often times out when scans are queued. Circle CI times out at 10 minutes by default, and yes, I know about the no-output-timeout attribute added in 1.0.6

Describe the solution you'd like
However, the true solution should be to output some kind of logging to keep the job active and prevent Circle CI from timing it out. The SCA process does exactly that, can't the JSON and JIRA bug-tracker modes do that also?

Orb Version
1.0.4

Describe the bug
checkmax scan is expecting API version Information to be passed. The following error message is thrown

org.springframework.web.client.HttpClientErrorException$BadRequest: 400 Bad Request: [{
"error": {
"code": "ApiVersionUnspecified",
"message": "An API version is required, but was not specified."
}
}]

To Reproduce

Execute the work flow by running with the following circleci config

cx-scan:
executor: cxflow/default
steps:
- checkout
- cxflow/scan:
preset: 'Checkmarx Default'
report-file: checkmarx.json
team: '${CHECKMARX_TEAMID}'
project: '${CIRCLE_PROJECT_REPONAME}'
- store_artifacts:
path: checkmarx.json

Expected behavior

Workflow should complete successfully

Additional context

CheckMarx version: V8.9.0 HF24
The scan job exited with exit code 10