| Table of Contents |
|---|
...
WhiteSource Advise for IntelliJ IDEA supports Java, Kotlin and Scala projects using Maven (pom.xml dependency files), and supports Java projects using Gradle (build.gradle dependency files).
NOTES:
Gradle Kotlin projects are not supported in WhiteSource Advise.
When using the "apply from" script plugin in Gradle projects, remote script location is not supported.
...
The plugin supports the following IntelliJ IDEA versions:
2021.2
2021.1
2020.3
2020.2
2020.1
2019.3
2019.2
2019.1
...
Start IntelliJ IDEA.
From the menu bar, select File > Settings. The Settings screen is displayed.
From the left sidebar, click Plugins.
In the Search box, enter whitesource and then press Enter from your keyboard. The WhiteSource Advise plugin information is displayed.
Click Install and then click Restart IDE.
In the pop-up dialog box, click Restart.
Activating WhiteSource Advise
...
From the menu bar, select Tools > WhiteSource Advise
From the top toolbar, click the WhiteSource icon
Do as follows:
From the sidebar on the right, click WhiteSource.
From the top, click Advise.
Click Run WhiteSource Advise.
Developer Focus Mode
The developer focus mode will allow Developer Focus Mode allows developers to see only vulnerability alerts that are new in their feature branches compared to a predefined base branch. This will promote promotes the security shift left approach and will empower empowers developers to fix newly introduced vulnerabilities immediately, as part of their feature development efforts and prior to merging vulnerable code into production branches.
In order to enable focus modeTo enable Focus Mode, do as follows::
In the WhiteSource Advise project-level configuration, enable the “Diff Diff operation to be performed on a base branch” branch checkbox.
Choose the base branch to which all other branch scans will be compared to.
Make sure your base branch is checked out and , then trigger a WhiteSource Advise scan either manually or by building your project.
...
An alert can be enabled to notify about newly added vulnerabilities when committing the code inside the IntelliJ. This alert will appear only if the committed feature branches have new vulnerabilities compared to a preconfigured base branch.
To enable a Vulnerable Commit Alert, do as follows:
Enable the Focus Mode (enable the Diff operation, choose the base branch, and trigger a WhiteSource Advise scan).
Go to Setting > Version Control > Commit > Before Commit and make sure that “Notify Notify on new OS vulnerabilities” vulnerabilities is enabled.
In case the feature branch contains new vulnerabilities (that were not presented in the base branch), a pop up will suggest to review the found vulnerabilities or commit anyway.
...