Initiating a Scan

A WhiteSource Mend scan is initiated via a valid GitLab push command. A valid push command meets at least one of the following requirements:

• One of the commits in the push command added/removed a source file(s) that has an extension supported by WhiteSourceMend.
  Refer to the WhiteSource Mend Languages page in order to find out whether or not a specific language and its extensions are supported. 

• One of the commits in the push command includes an addition/modification of the package manager dependency file(s).
  Refer to the list of supported dependency files to find out whether your dependency files are supported.

NOTE: a push command may consist of multiple commits.

Inventory post-scan

WhiteSource Mend continuously researches new vulnerabilities and updates its vulnerability database with these findings. In order that these newly-discovered vulnerabilities be reflected in projects a soon as possible, WhiteSource Mend initiates a post-scan process for all integrated projects at 01:00 UTC and opens new issues for vulnerabilities that were added to the database in the previous 24 hours.

This is an automated procedure, and no action from the user is required.

Viewing Details of the Scan

Results can be viewed in the following places:

• The Issues tab within the GitLab project.

• The WhiteSource Mend Security/License Check within the GitHub project's Commits tab.

• The WhiteSource Mend UI.

• Via email notifications.

• For GitLab Ultimate users:

  • The GitLab security dashboard

  • Pipeline reports

Viewing the Issues Tab

If you are performing Merge Requests or push commands via the Web browser, refresh your Web browser in order to view the issues that were generated by WhiteSourceMend. NOTE: It may take a number of minutes for the issues to be scanned and displayed after a valid push command is initiated.

The Issues tab displays all the issues that the WhiteSource the Mend Integration detected with the red security vulnerability label. This proprietary label indicates a security vulnerability was detected by WhiteSourceMend. 

As part of your workflow, you have the option to add a relevant label(s) to specific issues, and close issues that were resolved.

Issues that were manually closed will not be re-opened during future WhiteSource Mend scans unless their label and/or name have been manually changed or changed via the GitLab API.

Viewing Details of an Issue

See here for more information.

Viewing

...

Mend Security Checks

Commit Status indicators are displayed for each head commit on the Commits sub-tab of the Project tab.

...

Clicking a specific indicator will redirect you to the relevant Commit page, where you can find the WhiteSource Mend Security Check for the selected head commit in the Changes sub-tab, which contains a security report.

...

• CVE: A link to the related CVE page for the vulnerability. Displayed in a collapsible format (click the arrow to expand/collapse for more information regarding the vulnerability).

• Severity: Overall score of the severity (High, Medium or Low).

• CVSS Score

• Vulnerable Library

• Suggested Fix 

• Issue: A link to the WhiteSource Mend issue that was generated for the vulnerability.

Types of Indicators

The following commit status indicators are available as feedback on the head commits:

• Pending: The WhiteSource Mend scan has not begun and is scheduled to begin.

• Running: The WhiteSource Mend scan is in progress.

• Success: The WhiteSource Mend scan completed successfully and no vulnerabilities were detected. 

• Failed: The WhiteSource Mend scan did not complete successfully, this is the default for all completed scans. NOTE: a failed status may be shown due to security vulnerabilities, or due to an error that occurred during the scan.

Samples of Commit Status Indicators

Running

The following is a sample of a Running status, which indicates that the security check is currently scanning the head commit.

...

Success

When no vulnerabilities are found and no errors occurred during the scan, WhiteSource Mend will display the following commit status, and a security report indicating that no vulnerabilities were detected:

...

Failed

All head commits that fail the scan due to the security check detecting vulnerabilities or due to an error that occurred during the scan will display a failed commit status.
The following screenshot displays a failure indicator for a head commit

...

Viewing

...

Mend License Checks

In the Commits tab you can view the status and results of each scan. Click a specific build icon in order to view the Builds page.

Types of Indicators

The following commit status indicators are available as feedback on the head commits:

• Success: No license policy violations were detected. 

• Failed: One or more license policy violations were detected during the WhiteSource the Mend scan.

Viewing Details in the

...

Mend UI

• In the WhiteSource Mend UI, WhiteSource Mend projects will have the same name as the corresponding GitLab repository, with a "GL_" prefix, unless otherwise specified in the .whitesource file using a project token.

• The name of the WhiteSource the Mend product will be the same as that of the GitLab grouppreceded by a "GL_" prefix if the GitLab project is under a group. Otherwise, the name will be your GitLab username preceded by "GL_".

Viewing the Security Dashboard

GitLab Ultimate users have access to GitLab’s security dashboard.

Vulnerabilities detected by WhiteSource Mend for GitLab can be identified by their “ - Detected by WhiteSourceMend” suffix.

Viewing Details of a Vulnerability in the Security Dashboard

• Description: A description of the vulnerability.

• Project: The GitLab project the vulnerability exists in.

• File: The manifest file the vulnerable dependency is declared in.

• Identifiers: The original identifier of the vulnerability.

• Severity: The vulnerability’s severity. Possible values are:

  • High

  • Medium

  • Low

• Confidence: How reliable this vulnerability’s assessment is.

  • Vulnerabilities detected by WhiteSource Mend will always have “Confirmed”confidence.

• Report Type: The security report this vulnerability belongs to (SAST, DAST, dependency_scanning, etc.).

  • Vulnerabilities detected by WhiteSource Mend will always have the “dependency_scanning”report type.

• Links: Any references to external documentation pieces or articles that describe the vulnerability further.

• Solution: An explanation of how to fix the vulnerability.

Viewing the Pipeline Reports

Pipeline reports can be viewed from the following places:

...