| Table of Contents |
|---|
...
It facilitates workflows by making critical component vulnerability information available to the software developer from within the IDE, preventing the need to use a separate application for such purpose.
It implements automatic vulnerability checking in the background that allows for immediate feedback to the user as she types. For example, a new component reference that is being typed into a project's requirements.txt, Pipfile, or pyproject.toml file will be automatically analyzed for security vulnerabilities.
It offers a transparent UX for developers, by seamlessly integrating with the IDE environment: it highlights project open source components found to have reported security vulnerabilities (CVEs), displays information on such vulnerabilities, and offers recommendations for fixing them.
Support for
...
Package Managers
WhiteSource Advise supports Python projects using the following package managers:
Pip (requirements.txt dependency files only)
...
Pipenv (Pipfile dependency files)
...
Poetry (project.toml dependency files).
Prerequisites
Ensure the following:
...
Start PyCharm.
From the menu bar, select File > Settings. The Settings screen is displayed.
From the left sidebar, click Plugins.
In the Search box, enter whitesource and then press Enter from your keyboard. The WhiteSource Advise plugin information is displayed.
Click Install and then click Restart IDE.
In the pop-up dialog box, click Restart.
Activating WhiteSource Advise
...
Configuring WhiteSource Advise
To configure WhiteSource Advise, do as follows:
| Info |
|---|
Changes made to the WhiteSource settings will only apply after running the next scan. |
You can configure the WhiteSource settings on a global or a project level. See the following sections.
Global-Level Configuration
To configure WhiteSource Advise on a global level, do as follows:
From the menu bar, select File > Settings. The Settings screen is displayed.
Select Tools > WhiteSource.
In Scan Results Settings, review the options and modify if necessary. See here for a list of all options.
Click OK.
Project-Level Configuration
To configure WhiteSource Advise on a project-level, do as follows:
From the menu bar, select File > Settings. The Settings screen is displayed.
Select Tools > WhiteSource > Project Settings. The Project Settings screen is displayed.
In Scan Results Settings, review the options and modify if necessary. See here for a list of all options.
By default, all settings are inherited from the global-level configuration. To override the specific configuration on project level, clear the Inherit from global settings checkbox.
Click OK.
Options Table
Option | Description | Default Setting |
|---|---|---|
Only show issues for direct dependencies | When enabled, WhiteSource Advise will only return vulnerabilities for direct dependencies defined in your dependency file. | Unselected (not checked) |
...