| Table of Contents |
|---|
...
WhiteSource Advise supports JavaScript projects using npm (package.json dependency files) that include a package-lock.json file.
NOTE: Yarn projects are not supported.
Prerequisites
Ensure the following:
A valid license for WhiteSource for Developers
A license key for WhiteSource Advise for IDE, available via one of the following options:
If you do not have direct access to the WhiteSource Application, obtain the license key from your WhiteSource Administrator.
If you have access to the WhiteSource Application, do as follows (NOTE: This option is only available when using version 20.12.1 or later of WhiteSource Advise):
Go to the WhiteSource Application.
Open the Profile page.
In the WhiteSource Advise - IDE Integration section at the bottom, select your organization.
Copy your personal license key to be used later in Activating WhiteSource Advise.
WebStorm is installed and you are familiar with its basic functionality
Ensure the NPM package manager is installed.
Supported Versions
The plugin supports the following WebStorm versions:
2021.1
2020.3
2020.2
2020.1
2019.3
2019.2
2019.1
2018.3
2018.2 (from version 2018.2.3)
Installing WhiteSource Advise
...
Start WebStorm.
From the menu bar, select File > Settings. The Settings screen is displayed.
From the left sidebar, click Plugins.
In the Search box, enter whitesource and then press Enter from your keyboard. The WhiteSource Advise plugin information is displayed.
Click Install and then click Restart IDE.
In the pop-up dialog box, click Restart.
Activating WhiteSource Advise
...
From the menu bar, select Tools > WhiteSource Advise
From the top toolbar, click the WhiteSource icon
Do as follows:
From the sidebar on the right, click WhiteSource.
From the top, click Advise.
Click Run WhiteSource Advise.
Developer Focus Mode
The developer focus mode will allow developers to see only vulnerability alerts that are new in their feature branches compared to a predefined base branch. This will promote the security shift left approach and will empower developers to fix newly introduced vulnerabilities immediately as part of their feature development efforts and prior to merging vulnerable code into production branches.
In order to enable focus mode:
In the WhiteSource Advise project-level configuration enable the “Diff operation to be performed on a base branch” checkbox.
Choose the base branch to which all other branch scans will be compared to
Make sure your base branch is checked out and trigger a WhiteSource Advise scan either manually or by building your project.
In case there was no scan on the predefined base branch after its initial configuration, all branches will show all the scan results, not just the newly created security alerts.
| Info |
|---|
Every time the base branch configuration changes, a WhiteSource Advise scan must be triggered on that branch prior to seeing new security results. |
Reviewing Scan Results
To review scan results, open one of the following windows:
...
To quickly locate the component referenced by a reported vulnerability in the project’s package.json view, double-click the component in the WhiteSource security check tab. The referenced component description in the package.json file will be displayed and highlighted in the main code view.
To quickly locate vulnerability analysis results for a component in the package.json view, click the WhiteSource Advise severity icon displayed to the left of that component reference in the package.json file. Note that the icon denotes the severity of the vulnerability (yellow: low severity; orange: medium severity; red: high severity). A tooltip featuring relevant analysis details including a dependency path from the proprietary code to the open-source component will be displayed. Vulnerability details are also displayed as part of the tooltip and include the vulnerability identifier (e.g., CVE), severity, and a fix suggestion if available. A Details link is displayed which leads to the WhiteSource Vulnerability Database, providing more information on the specific vulnerability.
To quickly display an analysis summary for a component in the package.json view, hover the mouse pointer over the code for the component in that view; a tooltip will be displayed, featuring a list of all vulnerabilities found within the particular component.
...
The About screen displays information about the Advise plugin's version, general information on your IDE, along with links for Privacy policy and Terms and Conditions.
Upgrading WhiteSource Advise
...