Skip to content

Commit 9c6bd07

Browse files
nscuronscuro
authored
Merge pull request #295 from sahibamittal/snyk-integration-frontend
Snyk integration frontend
2 parents 1ff579f + 839f7de commit 9c6bd07

File tree

7 files changed

+156
-1
lines changed

7 files changed

+156
-1
lines changed

‎src/assets/scss/_custom.scss‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,10 @@
9292
background-color: #AFE4BF;
9393
border: 1px solid #73D08F;
9494
}
95+
.label-source-snyk {
96+
background-color: #afd2e4;
97+
border: 1px solid #73c1d0;
98+
}
9599
.label-source-vulndb {
96100
background-color: #FFC78B;
97101
border: 1px solid #FE9536;

‎src/i18n/locales/en.json‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,7 @@
151151
"cvss_attack_vector": "Attack Vector",
152152
"cvss_access_complexity": "Access Complexity",
153153
"cvss_attack_complexity": "Attack Complexity",
154+
"cvss_source": "Select source priority for CVSS",
154155
"cvss_privileges_required": "Privileges Required",
155156
"cvss_user_interaction": "User Interaction",
156157
"cvss_required": "Required",
@@ -395,6 +396,7 @@
395396
"internal_analyzer": "Internal",
396397
"oss_index": "Sonatype OSS Index",
397398
"vulndb": "VulnDB",
399+
"snyk": "Snyk (Beta)",
398400
"vuln_sources": "Vulnerability Sources",
399401
"nvd": "NVD",
400402
"national_vulnerability_database": "National Vulnerability Database",
@@ -459,6 +461,9 @@
459461
"analyzer_ossindex_desc": "OSS Index is a service provided by Sonatype which identifies vulnerabilities in third-party components. Dependency-Track integrates natively with the OSS Index service to provide highly accurate results. Use of this analyzer requires a valid PackageURL for the components being analyzed.",
460462
"analyzer_vulndb_enable": "Enable VulnDB analyzer",
461463
"analyzer_vulndb_desc": "VulnDB is a commercial service from Risk Based Security which identifies vulnerabilities in third-party components. Dependency-Track integrates natively with the VulnDB service to provide highly accurate results. Use of this analyzer requires a valid CPE for the components being analyzed.",
464+
"analyzer_snyk_enable": "Enable Snyk analyzer",
465+
"analyzer_snyk_desc": "New Snyk API allows users to query vulnerabilities for specific packages using purl.",
466+
"analyzer_snyk_why_multiple_cvss": "Why are there multiple CVSS Scores for the same vulnerability?",
462467
"vulnsource_nvd_enable": "Enable National Vulnerability Database mirroring",
463468
"vulnsource_nvd_desc": "The National Vulnerability Database (NVD) is the largest publicly available source of vulnerability intelligence. It is maintained by a group within the National Institute of Standards and Technology (NIST) and builds upon the work of MITRE and others. Vulnerabilities in the NVD are called Common Vulnerabilities and Exposures (CVE). There are over 100,000 CVEs documented in the NVD spanning from the 1990’s to the present.",
464469
"vulnsource_nvd_feeds_url": "NVD Feeds URL",
@@ -467,8 +472,12 @@
467472
"vulnsource_osv_advisories_enable": "Select ecosystem to enable Google OSV Advisory mirroring",
468473
"vulnsource_osv_advisories_desc": "Google OSV is a distributed vulnerability and triage infrastructure for open source projects aimed at helping both open source maintainers and consumers of open source. It serves as an aggregator of vulnerability databases that have adopted the OpenSSF Vulnerability format.",
469474
"vulnsource_osv_base_url": "OSV Base URL",
475+
"select_ecosystem": "Select Ecosystems",
470476
"registered_email_address": "Registered email address",
471477
"api_token": "API token",
478+
"org_id": "Organization ID",
479+
"api_version": "API Version",
480+
"api_version_warning": "Warning: Changing default version may break the integration. Refer the documentation.",
472481
"consumer_key": "Consumer key",
473482
"consumer_secret": "Consumer secret",
474483
"personal_access_token": "Personal Access Token",

‎src/shared/common.js‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,8 @@ $common.formatAnalyzerLabel = function formatAnalyzerLabel(analyzer, vulnSource,
108108
analyzerUrl = "https://github.com/advisories/" + vulnId;
109109
} else if(vulnSource === "OSV") {
110110
analyzerUrl = "https://osv.dev/vulnerability/" + vulnId;
111+
} else if(vulnSource === "SNYK") {
112+
analyzerUrl = "https://security.snyk.io/vuln/" + vulnId;
111113
}
112114
break;
113115
case 'OSSINDEX_ANALYZER':
@@ -118,6 +120,10 @@ $common.formatAnalyzerLabel = function formatAnalyzerLabel(analyzer, vulnSource,
118120
analyzerLabel = "VulnDB";
119121
analyzerUrl = "https://vulndb.cyberriskanalytics.com/vulnerabilities/" + vulnId;
120122
break;
123+
case 'SNYK_ANALYZER':
124+
analyzerLabel = "Snyk";
125+
analyzerUrl = "https://security.snyk.io/vuln/" + vulnId;
126+
break;
121127
}
122128
if (analyzerUrl) {
123129
analyzerLabel = `<a href="${analyzerUrl}" target="_blank">${analyzerLabel} <i class="fa fa-external-link"></i></a>`;

‎src/views/administration/AdminMenu.vue‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,11 @@
8585
component: "VulnDbAnalyzer",
8686
name: this.$t('admin.vulndb'),
8787
href: "#scannerVulnDbTab"
88+
},
89+
{
90+
component: "SnykAnalyzer",
91+
name: this.$t('admin.snyk'),
92+
href: "#scannerSnykTab"
8893
}
8994
]
9095
},

‎src/views/administration/Administration.vue‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
import InternalAnalyzer from "./analyzers/InternalAnalyzer";
2929
import OssIndexAnalyzer from "./analyzers/OssIndexAnalyzer";
3030
import VulnDbAnalyzer from "./analyzers/VulnDbAnalyzer";
31+
import SnykAnalyzer from "./analyzers/SnykAnalyzer";
3132
// Vulnerability sources
3233
import VulnSourceNvd from "./vuln-sources/VulnSourceNvd";
3334
import VulnSourceGitHubAdvisories from "./vuln-sources/VulnSourceGitHubAdvisories";
@@ -63,7 +64,7 @@
6364
EventBus,
6465
AdminMenu,
6566
General, BomFormats, Email, InternalComponents, TaskScheduler,
66-
InternalAnalyzer, OssIndexAnalyzer, VulnDbAnalyzer,
67+
InternalAnalyzer, OssIndexAnalyzer, VulnDbAnalyzer, SnykAnalyzer,
6768
VulnSourceNvd, VulnSourceGitHubAdvisories, VulnSourceOSVAdvisories,
6869
Cargo, Composer, Gem, GoModules, Hex, Maven, Npm, Nuget, Python,
6970
Alerts, Templates,

‎src/views/administration/analyzers/SnykAnalyzer.vue‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
<template>
2+
<b-card no-body :header="header">
3+
<b-card-body>
4+
<c-switch id="scannerEnabled" color="primary" v-model="scannerEnabled" label v-bind="labelIcon" />{{$t('admin.analyzer_snyk_enable')}}
5+
<hr/>
6+
<b-validated-input-group-form-input
7+
id="snyk-baseUrl"
8+
:label="$t('admin.base_url')"
9+
input-group-size="mb-3"
10+
rules="required"
11+
v-model="baseUrl"
12+
lazy="true"
13+
/>
14+
<b-validated-input-group-form-input
15+
id="snyk-orgId"
16+
:label="$t('admin.org_id')"
17+
input-group-size="mb-3"
18+
rules="required"
19+
v-model="orgId"
20+
lazy="true"
21+
/>
22+
<b-validated-input-group-form-input
23+
id="snyk-apitoken"
24+
:label="$t('admin.api_token')"
25+
input-group-size="mb-3"
26+
rules="required"
27+
type="password"
28+
v-model="apitoken"
29+
lazy="true"
30+
/>
31+
<b-validated-input-group-form-input
32+
id="snyk-apiVersion"
33+
:label="$t('admin.api_version')"
34+
input-group-size="mb-3"
35+
rules="required"
36+
v-model="apiVersion"
37+
lazy="true"
38+
/>
39+
<i>{{ $t('admin.api_version_warning') }}</i>
40+
<b-row style="margin-top:2rem;">
41+
<b-col sm="6">
42+
<b-form-group :label="$t('message.cvss_source')" v-slot="{ cvssSource }">
43+
<b-form-radio-group v-model="cvssSourceSelected" :options="cvssOptions"
44+
:aria-describedby="cvssSource" name="radios-btn-default"
45+
v-on:change="generateCvssV2Vector" button-variant="outline-primary"
46+
class="cvss-calc cvss-calc-3-btn" buttons />
47+
</b-form-group>
48+
</b-col>
49+
</b-row>
50+
<a :href="apiDocUrl">{{$t('admin.analyzer_snyk_why_multiple_cvss')}}</a>
51+
<hr/>
52+
{{ $t('admin.analyzer_snyk_desc') }}
53+
</b-card-body>
54+
<b-card-footer>
55+
<b-button variant="outline-primary" class="px-4" @click="saveChanges">{{ $t('message.update') }}</b-button>
56+
</b-card-footer>
57+
</b-card>
58+
</template>
59+
60+
<script>
61+
import { Switch as cSwitch } from '@coreui/vue';
62+
import BValidatedInputGroupFormInput from '../../../forms/BValidatedInputGroupFormInput';
63+
import common from "../../../shared/common";
64+
import configPropertyMixin from "../mixins/configPropertyMixin";
65+
export default {
66+
mixins: [configPropertyMixin],
67+
props: {
68+
header: String
69+
},
70+
components: {
71+
cSwitch,
72+
BValidatedInputGroupFormInput
73+
},
74+
data() {
75+
return {
76+
scannerEnabled: false,
77+
apitoken: '',
78+
apiVersion: '',
79+
baseUrl: '',
80+
orgId: '',
81+
cvssOptions: [
82+
'NVD',
83+
'SNYK'
84+
],
85+
cvssSourceSelected: '',
86+
apiDocUrl: 'https://docs.snyk.io/features/fixing-and-prioritizing-issues/issue-management/severity-levels#understanding-snyks-vulnerability-analysis',
87+
labelIcon: {
88+
dataOn: '\u2713',
89+
dataOff: '\u2715'
90+
},
91+
}
92+
},
93+
methods: {
94+
saveChanges: function() {
95+
this.updateConfigProperties([
96+
{groupName: 'scanner', propertyName: 'snyk.enabled', propertyValue: this.scannerEnabled},
97+
{groupName: 'scanner', propertyName: 'snyk.api.token', propertyValue: this.apitoken},
98+
{groupName: 'scanner', propertyName: 'snyk.org.id', propertyValue: this.orgId},
99+
{groupName: 'scanner', propertyName: 'snyk.base.url', propertyValue: this.baseUrl},
100+
{groupName: 'scanner', propertyName: 'snyk.cvss.source', propertyValue: this.cvssSourceSelected},
101+
{groupName: 'scanner', propertyName: 'snyk.api.version', propertyValue: this.apiVersion}
102+
]);
103+
}
104+
},
105+
created () {
106+
this.axios.get(this.configUrl).then((response) => {
107+
let configItems = response.data.filter(function (item) { return item.groupName === "scanner" });
108+
for (let i=0; i<configItems.length; i++) {
109+
let item = configItems[i];
110+
switch (item.propertyName) {
111+
case "snyk.enabled":
112+
this.scannerEnabled = common.toBoolean(item.propertyValue); break;
113+
case "snyk.api.token":
114+
this.apitoken = item.propertyValue; break;
115+
case "snyk.org.id":
116+
this.orgId = item.propertyValue; break;
117+
case "snyk.base.url":
118+
this.baseUrl = item.propertyValue; break;
119+
case "snyk.cvss.source":
120+
this.cvssSourceSelected = item.propertyValue; break;
121+
case "snyk.api.version":
122+
this.apiVersion = item.propertyValue; break;
123+
}
124+
}
125+
});
126+
}
127+
}
128+
</script>

‎src/views/portfolio/vulnerabilities/Vulnerability.vue‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -174,6 +174,8 @@
174174
return "Sonatype OSS Index";
175175
case 'VULNDB':
176176
return "VulnDB (Risk Based Security)";
177+
case 'SNYK':
178+
return "Snyk";
177179
default:
178180
return "";
179181
}

0 commit comments

Comments
 (0)