Added changed to show or update SCA triage

Author: cx-rahul-pidde

checkmarx-ast-cli.version

@@ -1 +1 @@
-2.3.40
+2.3.40-sca-triage

src/main/wrapper/CxConstants.ts

@@ -1,4 +1,5 @@
 export enum CxConstants {
+    VULNERABILITIES = "--vulnerabilities",
     IGNORE__FILE_PATH = "--ignored-file-path",
     SOURCE = "-s",
     VERBOSE = "-v",

src/main/wrapper/CxWrapper.ts

@@ -298,6 +298,38 @@ export class CxWrapper {
         return await exec.executeCommands(this.config.pathToExecutable, commands, CxConstants.PREDICATE_TYPE);
     }
 
+    async triageSCAShow(projectId: string, vulnerabilities: string, scanType: string): Promise<CxCommandOutput> {
+        const commands: string[] = [
+            CxConstants.CMD_TRIAGE,
+            CxConstants.SUB_CMD_SHOW,
+            CxConstants.SCAN_TYPES_SUB_CMD, scanType,
+            CxConstants.VULNERABILITIES, vulnerabilities,
+            CxConstants.PROJECT_ID, projectId
+        ];
+        commands.push(...this.initializeCommands(true));
+        const exec = new ExecutionService();
+        return await exec.executeCommands(this.config.pathToExecutable, commands, CxConstants.PREDICATE_TYPE);
+    }
+
+    async triageSCAUpdate(projectId: string, vulnerabilities: string, scanType: string, state: string, comment: string,stateId: number | null = null): Promise<CxCommandOutput> {
+        const commands: string[] = [
+            CxConstants.CMD_TRIAGE,
+            CxConstants.SUB_CMD_UPDATE,
+            CxConstants.SCAN_TYPES_SUB_CMD, scanType,
+            CxConstants.VULNERABILITIES, vulnerabilities,
+            CxConstants.STATE, state,
+            CxConstants.COMMENT, comment,
+            CxConstants.PROJECT_ID, projectId
+        ];
+        if (stateId) {
+            commands.push(CxConstants.STATE_ID);
+            commands.push(stateId.toString());
+        }
+        commands.push(...this.initializeCommands(false));
+        const exec = new ExecutionService();
+        return await exec.executeCommands(this.config.pathToExecutable, commands);
+    }
+
     async triageUpdate(projectId: string, similarityId: string, scanType: string, state: string, comment: string, severity: string, stateId: number | null = null): Promise<CxCommandOutput> {
         const commands: string[] = [CxConstants.CMD_TRIAGE, CxConstants.SUB_CMD_UPDATE, CxConstants.PROJECT_ID, projectId, CxConstants.SIMILARITY_ID, similarityId, CxConstants.SCAN_TYPES_SUB_CMD, scanType, CxConstants.STATE, state, CxConstants.COMMENT, comment, CxConstants.SEVERITY, severity];
         if (stateId) {

src/tests/PredicateTest.test.ts

@@ -5,6 +5,120 @@ import CxResult from '../main/results/CxResult';
 import {CxConstants} from '../main/wrapper/CxConstants';
 
 describe("Triage cases", () => {
+
+    it('SCA Triage Show and Update Successful case', async () => {
+        const projectId = "d4d7f382-8dee-48c7-ac8f-67fab2c313a8";
+        const vulnerabilities = "packagename=Maven-org.apache.tomcat.embed:tomcat-embed-core,packageversion=9.0.14,vulnerabilityId=CVE-2024-56337,packagemanager=maven";
+        const scanType = "sca";
+        const state = "To_verify";
+        const comment = "comment1";
+        await handleTriageSCAShow(projectId, vulnerabilities, scanType);
+        await handleTriageSCAUpdate(projectId, vulnerabilities, scanType, state, comment);
+    });
+
+    // SCA Triage Update with stateId
+    it('SCA Triage Update with stateId', async () => {
+        const projectId = "d4d7f382-8dee-48c7-ac8f-67fab2c313a8";
+        const vulnerabilities = "packagename=Maven-org.apache.tomcat.embed:tomcat-embed-core,packageversion=9.0.14,vulnerabilityId=CVE-2024-56337,packagemanager=maven";
+        const scanType = "sca";
+        const state = "To_verify";
+        const comment = "comment1";
+        const stateId = 123;
+        await handleTriageSCAUpdate(projectId, vulnerabilities, scanType, state, comment, stateId);
+    });
+
+    // SCA Triage Show and Update - Failure
+    it('SCA Triage Show and Update Failure case', async () => {
+        const projectId = "invalid-project-id";
+        const vulnerabilities = "invalid-vulnerability-string";
+        const scanType = "invalid";
+        const state = "invalid_state";
+        const comment = "invalid_comment";
+        let errorShow = false;
+        let errorUpdate = false;
+        try {
+            const cxShow: CxCommandOutput = await auth.triageSCAShow(projectId, vulnerabilities, scanType);
+            expect(cxShow.exitCode).not.toEqual(0);
+        } catch (e) {
+            errorShow = true;
+        }
+        try {
+            const cxUpdate: CxCommandOutput = await auth.triageSCAUpdate(projectId, vulnerabilities, scanType, state, comment);
+            expect(cxUpdate.exitCode).not.toEqual(0);
+        } catch (e) {
+            errorUpdate = true;
+        }
+        expect(errorShow || errorUpdate).toBe(true);
+    });
+
+    // SCA Triage Show and Update - Edge case: empty vulnerabilities
+    it('SCA Triage Show and Update with empty vulnerabilities', async () => {
+        const projectId = "d4d7f382-8dee-48c7-ac8f-67fab2c313a8";
+        const vulnerabilities = "";
+        const scanType = "sca";
+        const state = "To_verify";
+        const comment = "comment1";
+        let errorShow = false;
+        let errorUpdate = false;
+        try {
+            const cxShow: CxCommandOutput = await auth.triageSCAShow(projectId, vulnerabilities, scanType);
+            expect(cxShow.exitCode).not.toEqual(0);
+        } catch (e) {
+            errorShow = true;
+        }
+        try {
+            const cxUpdate: CxCommandOutput = await auth.triageSCAUpdate(projectId, vulnerabilities, scanType, state, comment);
+            expect(cxUpdate.exitCode).not.toEqual(0);
+        } catch (e) {
+            errorUpdate = true;
+        }
+        expect(errorShow || errorUpdate).toBe(true);
+    });
+
+    // SCA Triage Show and Update - Edge case: null/undefined arguments
+    it('SCA Triage Show and Update with null/undefined arguments', async () => {
+        let errorShow = false;
+        let errorUpdate = false;
+        try {
+            // @ts-ignore
+            const cxShow: CxCommandOutput = await auth.triageSCAShow(undefined, undefined, undefined);
+            expect(cxShow.exitCode).not.toEqual(0);
+        } catch (e) {
+            errorShow = true;
+        }
+        try {
+            // @ts-ignore
+            const cxUpdate: CxCommandOutput = await auth.triageSCAUpdate(undefined, undefined, undefined, undefined, undefined);
+            expect(cxUpdate.exitCode).not.toEqual(0);
+        } catch (e) {
+            errorUpdate = true;
+        }
+        expect(errorShow || errorUpdate).toBe(true);
+    });
+
+        it('SCA Triage Show and Update Failure case', async () => {
+            // Example values for SCA triage (simulate failure)
+            const projectId = "invalid-project-id";
+            const vulnerabilities = "invalid-vulnerability-string";
+            const scanType = "invalid";
+            const state = "invalid_state";
+            const comment = "invalid_comment";
+            let errorShow = false;
+            let errorUpdate = false;
+            try {
+                const cxShow: CxCommandOutput = await auth.triageSCAShow(projectId, vulnerabilities, scanType);
+                expect(cxShow.exitCode).not.toEqual(0);
+            } catch (e) {
+                errorShow = true;
+            }
+            try {
+                const cxUpdate: CxCommandOutput = await auth.triageSCAUpdate(projectId, vulnerabilities, scanType, state, comment);
+                expect(cxUpdate.exitCode).not.toEqual(0);
+            } catch (e) {
+                errorUpdate = true;
+            }
+            expect(errorShow || errorUpdate).toBe(true);
+        });
     const cxScanConfig = new BaseTest();
     const auth = new CxWrapper(cxScanConfig);
     const getScanAndResult = async (): Promise<{ scan: any, result: CxResult }> => {
@@ -39,6 +153,19 @@ describe("Triage cases", () => {
         );
         expect(cxUpdate.exitCode).toEqual(0);
     };
+
+    // Helper for SCA triage show
+    const handleTriageSCAShow = async (projectId: string, vulnerabilities: string, scanType: string) => {
+        const cxShow: CxCommandOutput = await auth.triageSCAShow(projectId, vulnerabilities, scanType);
+        expect(cxShow.exitCode).toEqual(0);
+    };
+
+    // Helper for SCA triage update
+    const handleTriageSCAUpdate = async (projectId: string, vulnerabilities: string, scanType: string, state: string, comment: string, stateId: number | null = null) => {
+        const cxUpdate: CxCommandOutput = await auth.triageSCAUpdate(projectId, vulnerabilities, scanType, state, comment, stateId);
+        expect(cxUpdate.exitCode).toEqual(0);
+    };
+    
     const handlegetStates = async () => {
         const cxCommandOutput: CxCommandOutput = await auth.triageGetStates(false);
         console.log("Json object from states successful case: " + JSON.stringify(cxCommandOutput));
@@ -47,12 +174,23 @@ describe("Triage cases", () => {
         return cxCommandOutput
     };
 
+    it('SCA Triage Show and Update Successful case', async () => {
+        const projectId = "d4d7f382-8dee-48c7-ac8f-67fab2c313a8";
+        const vulnerabilities = "packagename=Maven-org.apache.tomcat.embed:tomcat-embed-core,packageversion=9.0.14,vulnerabilityId=CVE-2024-56337,packagemanager=maven";
+        const scanType = "sca";
+        const state = "To_verify";
+        const comment = "comment1";
+        await handleTriageSCAShow(projectId, vulnerabilities, scanType);
+        await handleTriageSCAUpdate(projectId, vulnerabilities, scanType, state, comment);
+    });
+    
     it('Triage Successful case', async () => {
         const { scan, result } = await getScanAndResult();
         await handleTriageShow(scan, result);
         await handleTriageUpdate(scan, result, result.state, result.severity.toLowerCase() === "high" ? CxConstants.SEVERITY_MEDIUM : CxConstants.SEVERITY_HIGH);
     });
 
+    
     it.skip('Triage with custom state Successful case', async () => {
         const { scan, result } = await getScanAndResult();