Skip to main content

VSCode Tutorial - Settings.json

Goals

This tutorial is designed to teach the following topics:

  • How to enable scanning any folder or file from the CxVSCode plugin

  • How to move to Quiet (silent) mode

  • How to exclude or include files or folders

  • How to change the report path

  • How to configure a proxy

Note

VSCode plugin only supports https SAST server when using a proxy.

Prerequisites

  • VSCode 1.44 or later

  • CxSAST 9.0 or higher with known user credentials

  • Source code available

  • Checkmarx VSCode extension installed and enabled.

  • The following tutorials completed:

    • Login

    • Scan & Reports

  • settings.json available in the active workspace inside the .vscode folder.

Procedure – Enabling Avoid Duplicate Project Scans In Queue

  1. On the Extension page, click the Extend icon. The CxVSCode plugin dialog appears.

    image013.png

  2. On the Checkmarx SAST 9.x plugin dialog, click Settings.png . A dropdown menu appears.

  3. From the dropdown menu, select Extension Settings.

    Extension_Settings.png

  4. Enable the Avoid Duplicate Project Scans In Queue option.

    image016.png

  5. Verify that the following has been added to the settings.json file: cx.avoidDuplicateProjectScansInQueue ": true.

    Note

    If you attempt to create a new project while a scan is either in progress or queued, creating a new scan will be prevented.

  6. Disable the Avoid Duplicate Project Scans In Queue option.

    image017.png

  7. Verify that the settings.json file has been updated and that cx.avoidDuplicateProjectScansInQueue has been removed.

Procedure – Enabling Scan any Folder or File

  1. On the Extension page, click the Extend icon. The CxVSCode plugin dialog appears.

    Checkmarx_ID.png

  2. On the Checkmarx SAST 9.x plugin dialog, click Settings.png. A dropdown menu appears.

  3. From the dropdown menu, select Extension Settings.

    Extension_Settings.png

  4. Enable the Enable Scan Buttons option.

    VS_73.png

  5. Verify that the following has been added to the settings.json file.

    cx.enableScanButtons": true

  6. In the CX PORTAL toolbar, click Scan Any File. You are asked to select a file for scanning.

    VS_74.png

  7. Select a file to scan and ensure the scan has completed successfully.

  8. Disable the Enable Scan Buttons option.

    VS_75.png

  9. Verify that the setting.json file has been updated and that cx.enableScanButtons has been removed.

To verify that the Enable Scan Buttons option is disabled:

  • In the CX PORTAL toolbar, click :Scan_any_file:. A warning appears indicating that this option is dsabled.

    VS_76.png

Procedure – Change to Quiet Mode

  1. Click the Extension button to open the Extensions page.

  2. Under Checkmarx SAST 9.x, click Settings.png. A dropdown menu appears.

    Checkmarx_ID.png

  3. From the dropdown menu, select Extension Settings.

    Extension_Settings.png

  4. Enable the Quiet mode.

  5. Verify that the following has been added to the settings.json file.

    cx.quiet": true

  6. From CX SCAN RESULT, generate a report. No popups appear.

  7. In the CX PORTAL toolbar, click Scan Any File. You are asked to select a file to scan.

  8. Click Extension to open the Extensions page.

  9. Under CxVSCode, click Settings. A dropdown menu appears.

    VS_79.png

  10. From the dropdown menu, select Extension Setting.

    VS_80.png

  11. Enable the Quiet mode option.

    VS_81.png

  12. Verify that the following has been added to the settings.json file.

    cx.quiet": true

  13. From CX SCAN RESULT generate a report. No popups appear.

  14. Disable the Quiet mode option.

    VS_82.png

  15. Verify that settings.json has been updated and the cx.quiet setting has been removed.

Procedure – Change Exclude/Include File or Folder Extensions

  1. Click Extension to open the Extensions page.

  2. Under Checkmarx SAST 9.x, click Settings.png. A dropdown menu appears.

    VS_83.png

  3. From the dropdown menu, select Extension Settings.

    VS_84.png

  4. Enable the Quiet mode option.

  5. Change the File Extensions and Folder Exclusions settings as follows:

    VS_85.png

  6. Verify that the changes are reflected in the settings.json file.

Notice

Strings starting with an exclamation mark (!) indicate that they must be excluded. Remove the exclamation mark to include the items.

Procedure – Change Report Path

  1. Click Extension to open the Extensions page.

  2. Under Checkmarx SAST 9.x, click Settings.png. A dropdown menu appears.

    Checkmarx_ID.png

  3. From the dropdown menu, select Extension Settings.

    Extension_Settings.png

  4. Edit the Report Path setting as follows:

    VS_87.png

  5. Check that the edited report path is reflected in the setting.json file in the cx.reportPath variable as follows:

    cx.reportPath": "C:\\Users\\xxxxxx\\OneDrive - yyyyyy\\Documents\\CxFlow\\Report1.json"

  6. Generate a new report and verify that it is available in the correct path.

Procedure – Change the SSL Certificate Path

  1. Click Extension to open the Extensions page.

  2. Under Checkmarx SAST 9.x, click Settings.png. A dropdown menu appears.

    Checkmarx_ID.png

  3. From the dropdown menu, select Extension Settings.

    Extension_Settings.png

  4. Edit the SSL certificate Path setting as follows:

    VS_89.png

  5. Check that the SSL certificate path is reflected in the setting.json file in the cx.sslCertificatePath variable as follows:

    cx.sslCertificatePath : "d:\certificates\cacert_chain.crt"

  6. Enter the path into the certificate chain file that contains all intermediate and root CA certificates for https connections.

Procedure - Enable User Credentials Login

  1. Click Extension to open the Extensions page.

  2. Under Checkmarx SAST 9.x, click Settings.png. A dropdown menu appears.

    Checkmarx_ID.png

  3. From the dropdown menu, select Extension Settings.

    Extension_Settings.png

  4. Enable the User Credentials Login setting as follows:

    VS_91.png

  5. Verify that the modified report path is reflected in the setting.json file in the cx.enableUserCredentialsLogin variable as follows:

    cx.enableUserCredentialsLogin: " true"

  6. Select this option for user credentials login.

Procedure – Enabling Workspace Only Scan

  1. Click Extension to open the Extensions page.

  2. Under Checkmarx SAST 9.x, click Settings.png. A dropdown menu appears.

    Checkmarx_ID.png

  3. From the dropdown menu, select Extension Settings.

    Extension_Settings.png

  4. Select Enable Workspace Only Scan.

    VS_92.png

  5. Verify in the settings.json file that the following line was added.

    cx.enableWorkspaceOnlyScan ": true

  6. In the CX PORTAL, click Scan Any File.

    VS_93.png

  7. Select a file/folder/workspace to scan and right-click on it. You can scan only on the workspace level, not any file or folder.

Configuring a Proxy

  1. Navigate to File > Preferences > Settings > Application > Proxy. The proxy dialog appears.

    VS_94.png

  2. Under Proxy, enter the URL of the proxy server, for example http://proxyhost:port.

  3. Under Proxy Support, select Override. All http requests from VSCode Extension are routed via the proxy server.

Assigning Users

You can assign users to vulnerabilities, as explained below.

  1. Open the Result table from the Settings menu.

  2. Select the vulnerability to which you want to assign the user.

    VS_95.png

  3. Select Assign User and enter the new user's username. The user appears in the Assigned User column of the selected vulnerability.

    VS_96.png

Working with Comments

You can add and edit comments for one or multiple vulnerabilities. Adding a comment to multiple vulnerabilities is referred to as a bulk comment from this point on.

To add a comment to one or several vulnerabilities (bulk comment):

  1. In the Result table, select at least one vulnerability and click Edit_icon.png. The Add Comment dialog appears.

    Add_Comment_1.png

  2. Enter the comment and then click <Submit>. The comment for the selected vulnerabilities is added under Comments. Hover over the edit icon to see all of the existing comments.

    Add_Comment_2.png

To make adding comments mandatory:

  1. There are 3 different types and methods to make comments mandatory while updating the result state. Each type and method follows the same procedure.

    • MandatoryCommentOnChangeResultState - In the CxSAST database, the CxComponentConfiguration table MandatoryCommentOnChangeResultState = true, and then comments are mandatory for all result state updates.

    • MandatoryCommentOnChangeResultStateToNE - In the CxSAST database CxComponentConfiguration table MandatoryCommentOnChangeResultStateToNE = true, then comments are mandatory while updating the query result state as not exploitable.

    • MandatoryCommentOnChangeResultStateToPNE - In the CxSAST database CxComponentConfiguration table MandatoryCommentOnChangeResultStateToPNE = true, then comments are mandatory while updating query result state as proposed not exploitable.

  2. If MandatoryCommentOnChangeResultState is enabled at the CxSAST side, updating any result state will get a first-time error message.

    Mandatory_Comment.png

  3. Try again, and the Add Comment dialog appears, and you are asked to add a comment.

    image027.png

  4. Once added, the result state and the associated vulnerability are checked in the Results State column and saved, and the comment is viewable by hovering over the edit icon.

    image025__1_.png
In this section: