Comments (5)
@oallauddin Which version of Xray are you running? I am getting "All severities" from the API GET /xray/api/v2/policies
and GET /xray/api/v2/policies/{name}
with Xray 3.61.3
{
"name": "Alex-Sec-Test",
"type": "security",
"author": "alexh",
"rules": [
{
"name": "low-severity",
"priority": 1,
"actions": {
"block_download": {
"unscanned": false,
"active": false
}
},
"criteria": {
"fix_version_dependant": false,
"malicious_package": false,
"min_severity": "All severities"
}
}
],
"created": "2022-07-21T22:23:11.399Z",
"modified": "2022-11-18T23:49:02.046Z"
}
from terraform-provider-xray.
@alexhung
Using Xray 3.57.6. Also it is a project based policy.
jf xr curl api/v1/system/version
{"xray_version":"3.57.6","xray_revision":"e1bb4e8"}
jf xr curl api/v2/policies/test-policy?projectKey=test
{
"name": "test-policy",
"type": "security",
"author": "user",
"rules": [
{
"name": "test-rule",
"priority": 1,
"actions": {
"block_download": {
"unscanned": false,
"active": false
}
},
"criteria": {
"fix_version_dependant": false,
"min_severity": "Unknown"
}
}
],
"created": "2022-11-21T13:23:57.291Z",
"modified": "2022-11-21T13:26:13.919Z",
"project_key": "test"
}
from terraform-provider-xray.
@oallauddin Odd. I wonder if Xray API is doing some strange thing where it uses "Unknown" if the min severity was default to "All Severity" (i.e. user never explicitly set it). I'll poke around some more.
from terraform-provider-xray.
@oallauddin So I can see that 'unknown' is in the payload sent to Xray UI API (POST /ui/api/v1/xray/ui/policies
):
{
"name": "Alex",
"description": "",
"type": "security",
"rules": [
{
"name": "Alex",
"criteria": {
"malicious_package": false,
"fix_version_dependant": false,
"min_severity": "unknown"
},
"actions": {
"webhooks": [],
"mails": [],
"block_download": {
"active": false,
"unscanned": false
},
"block_release_bundle_distribution": false,
"fail_build": false,
"notify_watch_recipients": false,
"notify_deployer": false,
"create_ticket_enabled": false
},
"priority": 1
}
]
}
But when I use jf xr curl api/v2/policies/Alex
I get 'All severities':
{
"name": "Alex",
"type": "security",
"author": "alexh",
"rules": [
{
"name": "Alex",
"priority": 1,
"actions": {
"block_download": {
"unscanned": false,
"active": false
}
},
"criteria": {
"fix_version_dependant": false,
"malicious_package": false,
"min_severity": "All severities"
}
}
],
"created": "2022-11-21T21:09:12.413Z",
"modified": "2022-11-21T21:09:12.413Z"
}
Same with calling API directly.
from terraform-provider-xray.
@oallauddin Found the fix in the release note for 3.60.2.
XRAY-9271 | Fixed an issue whereby, Policy REST APIs returned the minimal severity criteria of all severities as "Unknown" instead of "All Severities".
from terraform-provider-xray.
Related Issues (20)
- Ignore Rules cant have policies and watches both HOT 2
- Crashes when importing xray_repository_config HOT 3
- Allow disabling specific risks in `xray_operational_risk_policy`'s `rule.criteria.op_risk_custom` block HOT 1
- plugin crash everytime on tf plan when upgrading to version >= 1.15.0 HOT 13
- Failed GRPCProvider requests and Xray provider crash HOT 2
- xray_ignore_rule error out when build and component is specifiy
- xray_ignore_rule error out when cves and vulnerabilities HOT 6
- TF plan shows deletion and recreation of policy rules on every run, even without changes to the configuration. HOT 2
- Error: Invalid string date type 'all-releaseBundles' is missing HOT 1
- xray_ignore_rule doesnt have an update resource function, causes error HOT 3
- Xray report resources don't support import HOT 4
- XRay security_policy & license_policy modules Plugin Crashing HOT 4
- xray_repository_config fails after JAS trial HOT 10
- Security filters do not support published date HOT 1
- New `xray_ignore_rule` resources or changes to existing ones should take effect immediately HOT 3
- add a data source to fetch xray scan results for an artifact HOT 5
- Creating project specific ignore rule with build filter fails HOT 2
- Indescript "Invalid Watch" error when applying despite watch definitions being in-spec HOT 1
- Add release bundles V2 indexing configuration HOT 1
- "Skip not applicable CVEs" option was not available in terraform xray_security_policy
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from terraform-provider-xray.