Merge pull request #69 from snyk-tech-services/develop

minor: release changes

fixtures/results/jiraTicketWithCustomPriorityMapping.json

@@ -1 +1 @@
-{"fields":{"project":{"id":"123"},"summary":"snyk-playground/typescript:package.json - Remote Code Execution (RCE)","description":"*Impacted Paths:*\n\\- \"snyk\"@\"1.228.3\" =\u003e \"proxy\\-agent\"@\"3.1.0\" =\u003e \"pac\\-proxy\\-agent\"@\"3.0.0\" =\u003e \"pac\\-resolver\"@\"3.0.0\"\n\n[See this issue on Snyk|https://app.snyk.io/org/playground/project/12345678-1234-1234-1234-123456789012]\n\n[More About this issue|https://snyk.io/vuln/SNYK-JS-MINIMIST-559764]\n\n","issuetype":{"name":"Bug"},"priority":{"name":"not too bad"}}}
+{"fields":{"project":{"id":"123"},"summary":"snyk-playground/typescript:package.json - Remote Code Execution (RCE)","description":"\\*\\*\\*\\* Issue details: \\*\\*\\*\\*\n\r\n pkgName: pac\\-resolver\n\r\n pkgVersions: \\[3.0.0\\]\n\r\n cvssScore: 8.10\n\r\n exploitMaturity: proof\\-of\\-concept\n\r\n severity: medium\n\r\n*Impacted Paths:*\n\\- \"snyk\"@\"1.228.3\" =\u003e \"proxy\\-agent\"@\"3.1.0\" =\u003e \"pac\\-proxy\\-agent\"@\"3.0.0\" =\u003e \"pac\\-resolver\"@\"3.0.0\"\n\r\n[See this issue on Snyk|https://app.snyk.io/org/playground/project/12345678-1234-1234-1234-123456789012]\n\n[More About this issue|https://snyk.io/vuln/SNYK-JS-MINIMIST-559764]\n\n","issuetype":{"name":"Bug"},"priority":{"name":"not too bad"}}}

fixtures/results/jiraTicketWithLabels.json

@@ -1 +1 @@
-{"fields":{"project":{"id":"123"},"summary":"snyk-playground/typescript:package.json - Remote Code Execution (RCE)","description":"*Impacted Paths:*\n\\- \"snyk\"@\"1.228.3\" =\u003e \"proxy\\-agent\"@\"3.1.0\" =\u003e \"pac\\-proxy\\-agent\"@\"3.0.0\" =\u003e \"pac\\-resolver\"@\"3.0.0\"\n\n[See this issue on Snyk|https://app.snyk.io/org/playground/project/12345678-1234-1234-1234-123456789012]\n\n[More About this issue|https://snyk.io/vuln/SNYK-JS-MINIMIST-559764]\n\n","issuetype":{"name":"Bug"},"labels":["Label1","Label2"]}}
+{"fields":{"project":{"id":"123"},"summary":"snyk-playground/typescript:package.json - Remote Code Execution (RCE)","description":"\\*\\*\\*\\* Issue details: \\*\\*\\*\\*\n\r\n pkgName: pac\\-resolver\n\r\n pkgVersions: \\[3.0.0\\]\n\r\n cvssScore: 8.10\n\r\n exploitMaturity: proof\\-of\\-concept\n\r\n severity: medium\n\r\n*Impacted Paths:*\n\\- \"snyk\"@\"1.228.3\" =\u003e \"proxy\\-agent\"@\"3.1.0\" =\u003e \"pac\\-proxy\\-agent\"@\"3.0.0\" =\u003e \"pac\\-resolver\"@\"3.0.0\"\n\r\n[See this issue on Snyk|https://app.snyk.io/org/playground/project/12345678-1234-1234-1234-123456789012]\n\n[More About this issue|https://snyk.io/vuln/SNYK-JS-MINIMIST-559764]\n\n","issuetype":{"name":"Bug"},"labels":["Label1","Label2"]}}

fixtures/results/jiraTicketWithPriorityMapping.json

@@ -1 +1 @@
-{"fields":{"project":{"id":"123"},"summary":"snyk-playground/typescript:package.json - Remote Code Execution (RCE)","description":"*Impacted Paths:*\n\\- \"snyk\"@\"1.228.3\" =\u003e \"proxy\\-agent\"@\"3.1.0\" =\u003e \"pac\\-proxy\\-agent\"@\"3.0.0\" =\u003e \"pac\\-resolver\"@\"3.0.0\"\n\n[See this issue on Snyk|https://app.snyk.io/org/playground/project/12345678-1234-1234-1234-123456789012]\n\n[More About this issue|https://snyk.io/vuln/SNYK-JS-MINIMIST-559764]\n\n","issuetype":{"name":"Bug"},"priority":{"name":"Medium"}}}
+{"fields":{"project":{"id":"123"},"summary":"snyk-playground/typescript:package.json - Remote Code Execution (RCE)","description":"\\*\\*\\*\\* Issue details: \\*\\*\\*\\*\n\r\n pkgName: pac\\-resolver\n\r\n pkgVersions: \\[3.0.0\\]\n\r\n cvssScore: 8.10\n\r\n exploitMaturity: proof\\-of\\-concept\n\r\n severity: medium\n\r\n*Impacted Paths:*\n\\- \"snyk\"@\"1.228.3\" =\u003e \"proxy\\-agent\"@\"3.1.0\" =\u003e \"pac\\-proxy\\-agent\"@\"3.0.0\" =\u003e \"pac\\-resolver\"@\"3.0.0\"\n\r\n[See this issue on Snyk|https://app.snyk.io/org/playground/project/12345678-1234-1234-1234-123456789012]\n\n[More About this issue|https://snyk.io/vuln/SNYK-JS-MINIMIST-559764]\n\n","issuetype":{"name":"Bug"},"priority":{"name":"Medium"}}}

fixtures/results/jiraTicketWithoutLabels.json

@@ -1 +1 @@
-{"fields":{"project":{"id":"123"},"summary":"snyk-playground/typescript:package.json - Remote Code Execution (RCE)","description":"*Impacted Paths:*\n\\- \"snyk\"@\"1.228.3\" =\u003e \"proxy\\-agent\"@\"3.1.0\" =\u003e \"pac\\-proxy\\-agent\"@\"3.0.0\" =\u003e \"pac\\-resolver\"@\"3.0.0\"\n\n[See this issue on Snyk|https://app.snyk.io/org/playground/project/12345678-1234-1234-1234-123456789012]\n\n[More About this issue|https://snyk.io/vuln/SNYK-JS-MINIMIST-559764]\n\n","issuetype":{"name":"Bug"}}}
+{"fields":{"project":{"id":"123"},"summary":"snyk-playground/typescript:package.json - Remote Code Execution (RCE)","description":"\\*\\*\\*\\* Issue details: \\*\\*\\*\\*\n\r\n pkgName: pac\\-resolver\n\r\n pkgVersions: \\[3.0.0\\]\n\r\n cvssScore: 8.10\n\r\n exploitMaturity: proof\\-of\\-concept\n\r\n severity: medium\n\r\n*Impacted Paths:*\n\\- \"snyk\"@\"1.228.3\" =\u003e \"proxy\\-agent\"@\"3.1.0\" =\u003e \"pac\\-proxy\\-agent\"@\"3.0.0\" =\u003e \"pac\\-resolver\"@\"3.0.0\"\n\r\n[See this issue on Snyk|https://app.snyk.io/org/playground/project/12345678-1234-1234-1234-123456789012]\n\n[More About this issue|https://snyk.io/vuln/SNYK-JS-MINIMIST-559764]\n\n","issuetype":{"name":"Bug"}}}

fixtures/results/jiraTicketWithoutLabelsWithAssigneeID.json

@@ -1 +1 @@
-{"fields":{"project":{"id":"123"},"summary":"snyk-playground/typescript:package.json - Remote Code Execution (RCE)","description":"*Impacted Paths:*\n\\- \"snyk\"@\"1.228.3\" =\u003e \"proxy\\-agent\"@\"3.1.0\" =\u003e \"pac\\-proxy\\-agent\"@\"3.0.0\" =\u003e \"pac\\-resolver\"@\"3.0.0\"\n\n[See this issue on Snyk|https://app.snyk.io/org/playground/project/12345678-1234-1234-1234-123456789012]\n\n[More About this issue|https://snyk.io/vuln/SNYK-JS-MINIMIST-559764]\n\n","issuetype":{"name":"Bug"},"assignee":{"accountId":"12345"}}}
+{"fields":{"project":{"id":"123"},"summary":"snyk-playground/typescript:package.json - Remote Code Execution (RCE)","description":"\\*\\*\\*\\* Issue details: \\*\\*\\*\\*\n\r\n pkgName: pac\\-resolver\n\r\n pkgVersions: \\[3.0.0\\]\n\r\n cvssScore: 8.10\n\r\n exploitMaturity: proof\\-of\\-concept\n\r\n severity: medium\n\r\n*Impacted Paths:*\n\\- \"snyk\"@\"1.228.3\" =\u003e \"proxy\\-agent\"@\"3.1.0\" =\u003e \"pac\\-proxy\\-agent\"@\"3.0.0\" =\u003e \"pac\\-resolver\"@\"3.0.0\"\n\r\n[See this issue on Snyk|https://app.snyk.io/org/playground/project/12345678-1234-1234-1234-123456789012]\n\n[More About this issue|https://snyk.io/vuln/SNYK-JS-MINIMIST-559764]\n\n","issuetype":{"name":"Bug"},"assignee":{"accountId":"12345"}}}

fixtures/results/jiraTicketWithoutLabelsWithAssigneeName.json

@@ -1 +1 @@
-{"fields":{"project":{"id":"123"},"summary":"snyk-playground/typescript:package.json - Remote Code Execution (RCE)","description":"*Impacted Paths:*\n\\- \"snyk\"@\"1.228.3\" =\u003e \"proxy\\-agent\"@\"3.1.0\" =\u003e \"pac\\-proxy\\-agent\"@\"3.0.0\" =\u003e \"pac\\-resolver\"@\"3.0.0\"\n\n[See this issue on Snyk|https://app.snyk.io/org/playground/project/12345678-1234-1234-1234-123456789012]\n\n[More About this issue|https://snyk.io/vuln/SNYK-JS-MINIMIST-559764]\n\n","issuetype":{"name":"Bug"},"assignee":{"name":"admin"}}}
+{"fields":{"project":{"id":"123"},"summary":"snyk-playground/typescript:package.json - Remote Code Execution (RCE)","description":"\\*\\*\\*\\* Issue details: \\*\\*\\*\\*\n\r\n pkgName: pac\\-resolver\n\r\n pkgVersions: \\[3.0.0\\]\n\r\n cvssScore: 8.10\n\r\n exploitMaturity: proof\\-of\\-concept\n\r\n severity: medium\n\r\n*Impacted Paths:*\n\\- \"snyk\"@\"1.228.3\" =\u003e \"proxy\\-agent\"@\"3.1.0\" =\u003e \"pac\\-proxy\\-agent\"@\"3.0.0\" =\u003e \"pac\\-resolver\"@\"3.0.0\"\n\r\n[See this issue on Snyk|https://app.snyk.io/org/playground/project/12345678-1234-1234-1234-123456789012]\n\n[More About this issue|https://snyk.io/vuln/SNYK-JS-MINIMIST-559764]\n\n","issuetype":{"name":"Bug"},"assignee":{"name":"admin"}}}

fixtures/ticket.txt

@@ -1,4 +1,16 @@
-- Remote Code Execution (RCE) *Impacted Paths:*
+- Remote Code Execution (RCE) \*\*\*\* Issue details: \*\*\*\*
+
+ pkgName: pac\-resolver
+
+ pkgVersions: \[3.0.0\]
+
+ cvssScore: 8.10
+
+ exploitMaturity: proof\-of\-concept
+
+ severity: medium
+
+*Impacted Paths:*
 \- "snyk"@"1.228.3" => "proxy\-agent"@"3.1.0" => "pac\-proxy\-agent"@"3.0.0" => "pac\-resolver"@"3.0.0"
 
 [See this issue on Snyk|https://app.snyk.io/org/playground/project/12345678-1234-1234-1234-123456789012]

go.mod

@@ -11,7 +11,7 @@ require (
 	github.com/rogpeppe/godef v1.1.2 // indirect
 	github.com/russross/blackfriday/v2 v2.0.1
 	github.com/stretchr/testify v1.4.0
-	github.com/tidwall/pretty v1.1.0 // indirect
+	github.com/tidwall/gjson v1.10.1 // indirect
 	github.com/tidwall/sjson v1.1.5
 	github.com/zhsso/tchannel v0.0.0-20150829002443-a1a640bf2f10
 	golang.org/x/tools/gopls v0.7.1 // indirect

go.sum

@@ -51,10 +51,14 @@ github.com/tidwall/gjson v1.6.0 h1:9VEQWz6LLMUsUl6PueE49ir4Ka6CzLymOAZDxpFsTDc=
 github.com/tidwall/gjson v1.6.0/go.mod h1:P256ACg0Mn+j1RXIDXoss50DeIABTYK1PULOJHhxOls=
 github.com/tidwall/gjson v1.6.8 h1:CTmXMClGYPAmln7652e69B7OLXfTi5ABcPPwjIWUv7w=
 github.com/tidwall/gjson v1.6.8/go.mod h1:zeFuBCIqD4sN/gmqBzZ4j7Jd6UcA2Fc56x7QFsv+8fI=
+github.com/tidwall/gjson v1.10.1 h1:Midn39zaqkz9SPTBDuEe0RdW9T4T+MpBOAC10e9/qFE=
+github.com/tidwall/gjson v1.10.1/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
 github.com/tidwall/match v1.0.1 h1:PnKP62LPNxHKTwvHHZZzdOAOCtsJTjo6dZLCwpKm5xc=
 github.com/tidwall/match v1.0.1/go.mod h1:LujAq0jyVjBy028G1WhWfIzbpQfMO8bBZ6Tyb0+pL9E=
 github.com/tidwall/match v1.0.3 h1:FQUVvBImDutD8wJLN6c5eMzWtjgONK9MwIBCOrUJKeE=
 github.com/tidwall/match v1.0.3/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
+github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
+github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
 github.com/tidwall/pretty v1.0.0 h1:HsD+QiTn7sK6flMKIvNmpqz1qrpP3Ps6jOKIKMooyg4=
 github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
 github.com/tidwall/pretty v1.0.1 h1:WE4RBSZ1x6McVVC8S/Md+Qse8YUv6HRObAx6ke00NY8=
@@ -63,6 +67,8 @@ github.com/tidwall/pretty v1.0.2 h1:Z7S3cePv9Jwm1KwS0513MRaoUe3S01WPbLNV40pwWZU=
 github.com/tidwall/pretty v1.0.2/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
 github.com/tidwall/pretty v1.1.0 h1:K3hMW5epkdAVwibsQEfR/7Zj0Qgt4DxtNumTq/VloO8=
 github.com/tidwall/pretty v1.1.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
+github.com/tidwall/pretty v1.2.0 h1:RWIZEg2iJ8/g6fDDYzMpobmaoGh5OLl4AXtGUGPcqCs=
+github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
 github.com/tidwall/sjson v1.0.4 h1:UcdIRXff12Lpnu3OLtZvnc03g4vH2suXDXhBwBqmzYg=
 github.com/tidwall/sjson v1.0.4/go.mod h1:bURseu1nuBkFpIES5cz6zBtjmYeOQmEESshn7VpF15Y=
 github.com/tidwall/sjson v1.1.5 h1:wsUceI/XDyZk3J1FUvuuYlK62zJv2HO2Pzb8A5EWdUE=

jira.go

@@ -131,6 +131,9 @@ func openJiraTicket(endpointAPI string, orgID string, token string, jiraProjectI
 		return nil, errors.New("Failure, Failure to create ticket(s)")
 	}
 
+	// TODO: this needs to be a debug
+	//fmt.Println("ticket to be send: ", string(ticket))
+
 	if len(vulnID) != 0 {
 		var er error
 		responseData, er := makeSnykAPIRequest("POST", endpointAPI+"/v1/org/"+orgID+"/project/"+projectInfoId+"/issue/"+vulnID+"/jira-issue", token, ticket)

jira_utils.go

@@ -18,8 +18,8 @@ func formatJiraTicket(jsonVuln jsn.Json, projectInfo jsn.Json) *JiraIssue {
 	for count, e := range jsonVuln.K("from").Array().Elements() {
 
 		newPathArray := make([]string, len(e.Array().Elements()))
-		for count_, j := range e.Array().Elements() {
 
+		for count_, j := range e.Array().Elements() {
 			name := fmt.Sprintf("%s@%s", j.K("name").Stringify(), j.K("version").Stringify())
 
 			newPathArray[count_] = name
@@ -35,14 +35,27 @@ func formatJiraTicket(jsonVuln jsn.Json, projectInfo jsn.Json) *JiraIssue {
 
 	snykBreadcrumbs := "\n[See this issue on Snyk](" + projectInfo.K("browseUrl").String().Value + ")\n"
 	moreAboutThisIssue := "\n\n[More About this issue](" + issueData.K("url").String().Value + ")\n"
+	vulnCvssScore := "\n cvssScore: " + fmt.Sprintf("%.2f", issueData.K("cvssScore").Float64().Value) + "\n"
+	exploitMaturity := "\n exploitMaturity: " + issueData.K("exploitMaturity").String().Value + "\n"
+	severity := "\n severity: " + issueData.K("severity").String().Value + "\n"
+	pkgName := "\n pkgName: " + jsonVuln.K("pkgName").String().Value + "\n"
+	pkgVersions := "\n pkgVersions: ["
+	for count, e := range jsonVuln.K("pkgVersions").Array().Elements() {
+		pkgVersions += fmt.Sprintf(e.String().Value)
+		if count < len(jsonVuln.K("pkgVersions").Array().Elements())-1 {
+			pkgVersions += ","
+		}
+	}
+	pkgVersions += "]\n"
+
 	descriptionFromIssue := ""
 
 	if issueData.K("type").String().Value == "license" {
 		descriptionFromIssue = `This dependency is infriguing your organization license policy. 
 								Refer to the Reporting tab for possible instructions from your legal team.`
 	}
 
-	descriptionBody := markdownToConfluenceWiki(paths + "\n" + snykBreadcrumbs + "\n" + descriptionFromIssue + "\n" + moreAboutThisIssue)
+	descriptionBody := markdownToConfluenceWiki("\n **** Issue details: ****\n" + "\r" + pkgName + "\r" + pkgVersions + "\r" + vulnCvssScore + "\r" + exploitMaturity + "\r" + severity + "\r" + paths + "\r" + snykBreadcrumbs + "\n" + descriptionFromIssue + "\n" + moreAboutThisIssue)
 	descriptionBody = strings.ReplaceAll(descriptionBody, "{{", "{code}")
 	descriptionBody = strings.ReplaceAll(descriptionBody, "}}", "{code}")
 

main.go

@@ -97,6 +97,7 @@ Open Source, so feel free to contribute !
 
 		fmt.Println("2/4 - Getting Existing JIRA tickets")
 		tickets := getJiraTickets(endpointAPI, orgID, project, apiToken)
+		//fmt.Println(tickets)
 
 		fmt.Println("3/4 - Getting vulns")
 		vulnsPerPath := getVulnsWithoutTicket(endpointAPI, orgID, project, apiToken, severity, maturityFilter, priorityScoreThreshold, issueType, tickets)

snyk_utils.go

@@ -21,6 +21,7 @@ func makeSnykAPIRequest(verb string, endpointURL string, snykToken string, body
 
 	request.Header.Add("Content-Type", "application/json")
 	request.Header.Add("Authorization", "token "+snykToken)
+	request.Header.Add("userAgentPrefix", "snyk-jira-tickets-for-new-vulns")
 
 	client := &http.Client{}
 	response, err := client.Do(request)

vulns.go

@@ -106,7 +106,7 @@ func getVulnsWithoutTicket(endpointAPI string, orgID string, projectID string, t
 					fmt.Printf("Json creation failed\n")
 					log.Fatalln(er)
 				}
-				vulnsPerPath["from"] = ProjectIssuePathDataJson.K("paths").Stringify()
+				vulnsPerPath["from"] = ProjectIssuePathDataJson.K("paths")
 				marshalledvulnsPerPath, err := json.Marshal(vulnsPerPath)
 				vulnsWithAllPaths[issueId], err = jsn.NewJson(marshalledvulnsPerPath)
 				if er != nil {
@@ -137,7 +137,7 @@ func getVulnsWithoutTicket(endpointAPI string, orgID string, projectID string, t
 					fmt.Printf("Json creation failed\n")
 					log.Fatalln(er)
 				}
-				vulnsPerPath["from"] = ProjectIssuePathDataJson.K("paths").Stringify()
+				vulnsPerPath["from"] = ProjectIssuePathDataJson.K("paths")
 				marshalledvulnsPerPath, err := json.Marshal(vulnsPerPath)
 				vulnsWithAllPaths[issueId], err = jsn.NewJson(marshalledvulnsPerPath)
 				if er != nil {