Using the Checkmarx One Eclipse Plugin
Once you have run a Checkmarx One scan on the source code of your Eclipse project, you can import the scan results into your Eclipse IDE. The results are integrated within the IDE in a manner that makes it easy to identify the vulnerable code, triage the results, and take the required remediation actions.
First you need to import the results from the latest scan of your Eclipse project. Then you can view the results in your Eclipse IDE.
Notice
Alternatively, you can run a new can on an existing Checkmarx One project from your IDE and load the results.
Loading your Checkmarx One Results
To load results from a scan:
In your Eclipse project, click on Window > Show View > Other.
The Show View window opens.
Select Checkmarx > Checkmarx One Scan from the list to open the Checkmarx View (or search for Checkmarx One Scan in the search box) and click Open.
The Checkmarx panel opens at the bottom of the screen.
Notice
If you haven’t done the initial setup, the Open Settings button is shown in the Checkmarx panel. Click on the button and then configure the integration as described in Installing and Setting up the Checkmarx One Eclipse Plugin.
Enter the Scan ID of the scan for which you want to show results (i.e., the most recent scan of your Eclipse project). Use one of the following methods to enter the Scan ID:
Warning
Only scans that completed successfully are shown in the IDE. Scans with only partial results aren't shown.
Running Scans from Eclipse
You can run a new Checkmarx One scan on the project that is open in your Eclipse workspace.
You must first create a Checkmarx project and run the initial scan using some other method, e.g., web portal, API, CLI etc. and load the scan results in the Eclipse console. Then, you are able to run subsequent scans on that project from Eclipse. The scan applies the scan configuration that was used for the previous scan of this project. For example, if the last time you scanned this project you excluded certain files, those files will be excluded also from the current scan.
Notice
Scans initiated via the IDE are "Incremental" scans. Learn more about incremental scans here.
Warning
This feature needs to be enabled for your organization's account by a Checkmarx admin user under Settings > Global Settings > Plugins in the Checkmarx One web portal. Before enabling this feature, you should consider the ramifications; since there is a limitation to the number of concurrent scans that you can run based on your license, enabling IDE scans may cause scans triggered by CI/CD pipelines and SCM integrations to be added to the scan queue (run on a "first in first out" basis), causing major delays for those scans.
To run a scan:
In the Checkmarx panel in your IDE, open the existing Checkmarx project under which your current workspace has already been scanned.
In the header bar of the Checkmarx panel, click on the "play" button.
Notice
Checkmarx runs a sanity check to verify that your current workspace matches the files that were previously scanned under this Checkmarx project. If a mismatch is detected, a warning is shown. You are given the option to run the scan despite the mismatch.
When the scan is completed, a dialog appears, asking if you would like to load the results from the new scan. Click Yes to show the new scan results in the Checkmarx panel.
Viewing Checkmarx One Scan Results in the Checkmarx View
You can open the Checkmarx panel below your project and navigate the tree display to view details about a specific vulnerability.
Notice
In order to show the source code for a specified attack vector, you need to have the relevant project open in your Eclipse console.
To view the Checkmarx One results in the Checkmarx panel:
After you import the scan results, and the results are shown in the Checkmarx panel, click on an arrow to expand that node in the tree.
You can use the Checkmarx Toolbar (on the right) to adjust the display, see actions below.
Click on a vulnerability.
The details panel is shown on the right, including a summary of the vulnerability info, a brief description and the Attack Vector (for SAST vulnerabilities).
Click on a node in the Attack Vector.
An editor opens containing the source code in the respective file and location for the selected node.
Checkmarx Toolbar
Icon | Item | Description |
---|---|---|
Filter High | Show/hide high severity vulnerabilities. | |
Filter Medium | Show/hide medium severity vulnerabilities. | |
Filter Low | Show/hide low severity vulnerabilities. | |
Filter Info | Show/hide info severity vulnerabilities. | |
Run scan | Runs a new scan on the project that is open in your workspace | |
Cancel scan | Cancels the scan that is running. | |
Filter by state | Filter results by state (multi-select, by default all are selected except for Not Exploitable and Proposed Not Exploitable) | |
More options |
|
Managing (Triaging) Results
Checkmarx One tracks specific vulnerability instances throughout your SDLC. Each vulnerability instance has a ‘Predicate’ associated with it, which is comprised of the following attributes: ‘state’, ‘severity’ and ‘comments’. After reviewing the results of a scan, you have the ability to triage the results and modify these predicates accordingly. For more info about triaging results in Checkmarx One, see Managing (Triaging) Vulnerabilities.
You can manage the results directly in the Eclipse console.
Warning
Only users with the Checkmarx One role update-result (e.g., a risk-manager) are authorized to make changes to the predicate. Only users with the role update-result-not-exploitable (e.g., an admin) are authorized to mark a vulnerability as ‘Not Exploitable’.
To edit the result predicate:
Navigate to the vulnerability that you would like to edit.
To adjust the severity, click on the Severity field, and select from the dropdown list the severity that you would like to assign. Options are: High, Medium, Low or Info.
To adjust the state, click on the State field, and select from the dropdown list the state that you would like to assign. For SAST and KICS, options are: To Verify, Not Exploitable, Proposed Not Exploitable, Confirmed or Urgent. For SCA, options are: Not Ignored or Ignored.
Notice
If you mark a vulnerability as Not Exploitable or Ignored it will not be shown in the results in the web app for this scan or for subsequent scans of this Project.
To add a comment, click on the Enter comment field and enter your comment.
In order to apply your changes, click Update.
The new predicate is applied to the vulnerability instance in this scan as well as to recurring instances of the vulnerability in subsequent scans of the Project. The changes made to the predicate are shown in the Changes tab.
Codebashing Links
Codebashing is an interactive AppSec training platform built by developers for developers. Codebashing sharpens the skills that developers need to avoid security issues, fix vulnerabilities, and write secure code in the first place. See Codebashing documentation here.
When you select a SAST vulnerability for which a Codebashing lesson exists, a link to the relevant lesson is shown. Click on the link to open the lesson in a new browser.
Warning
In order to access these links, you need to have a Codebashing account that has been linked to your Checkmarx One account. Please contact your Checkmarx support representative for assistance. For users that don't have a linked Codebashing account, a dialog opens with a link to begin a free trial.