Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Table of Contents

Overview

WhiteSource Advise is a plug-in for the PyCharm Integrated Development Environment (IDE) that is designed to empower developers with important, valuable information on security vulnerabilities concerning open-source components employed in their development projects.

...

  • A valid license for WhiteSource for Developers

  • A license key for WhiteSource Advise for IDE, available via one of the following options:

    • If you do not have direct access to the WhiteSource Application, obtain the license key from your WhiteSource Administrator.

    • If you have access to the WhiteSource Application, do as follows (NOTE: This option is only available when using version 20.12.1 or later of WhiteSource Advise):

      1. Go to the WhiteSource Application.

      2. Open the Profile page.

      3. In the WhiteSource Advise - IDE Integration section at the bottom, select your organization.

      4. Copy your personal license key to be used later in Activating WhiteSource Advise.

  • PyCharm is installed and you are familiar with its basic functionality

  • Ensure the relevant package manager (Poetry/Pip/Pipenv) is installed depending on the project type. 

  • Ensure the pipdeptree package version 0.12.0 or later is installed in your Python environment.

    • In case this package is missing, WhiteSource Advise will automatically try to install it before a triggered scan occurs and remove it after a triggered scan completes (thereby slowing down the scanning process).

    • If you have configured a proxy, you must allow access to the PyPi public repository. Alternatively, if you are using a private registry, you must add to it this package so that it can be successfully installed.

  • If you are using the Requirements or Toml plugin for PyCharm, ensure you perform one of the following before installing WhiteSource Advise.:

    • Uninstall the plugin(s) from PyCharm. 

    • From the Project sidebar, right-click your project dependency file (requirements.txt, Pipfile, or pyproject.toml) and click Mark as Plain Text.

Supported Versions

The plugin supports the following PyCharm versions:

  • 2020.3

  • 2020.2

  • 2020.1

  • 2019.3

  • 2019.2

  • 2019.1

    2018.3

Installing WhiteSource Advise

...

Option

Description

Default Setting

Only show issues for direct dependencies

When enabled, WhiteSource Advise will only return vulnerabilities for direct dependencies defined in your dependency file.

Unselected (not checked)

Minimum vulnerability severity level

Alert only on detected vulnerabilities satisfying a Low/Medium/High minimum severity level.

  • Low - Vulnerability alerts for all severities (Low, Medium, High) are displayed.

  • Medium- Vulnerability alerts only for Medium or High severities are displayed.

  • High - Vulnerability alerts only for High severities are displayed.

Low

Include dev dependencies

Whether to alert on vulnerabilities detected in dev dependencies.

Unselected (not checked)

Diff operation to be performed on a base branch

Enables developer focus mode functionality. 

  • The dropdown will include all locally available git branches for this project. 

  • It will allow to choose the base branch which will be the base for comparing security alerts from feature branches. 

Unselected (not checked)

Scanning a Project for Security Vulnerabilities

...

  • From the menu bar, select Tools > WhiteSource Advise

  • From the top toolbar, click the WhiteSource icon

  • Do as follows:

    1. From the sidebar on the right, click WhiteSource.

    2. From the top, click Advise.

    3. Click Run WhiteSource Advise.

Developer Focus Mode

The developer focus mode will allow developers to see only vulnerability alerts that are new in their feature branches compared to a predefined base branch. This will promote the security shift left approach and will empower developers to fix newly introduced vulnerabilities immediately as part of their feature development efforts and prior to merging vulnerable code into production branches.

In order to enable focus mode:

...

  • Choose the base branch to which all other branch scans will be compared to

  • Make sure your base branch is checked out and trigger a WhiteSource Advise scan either manually or by building your project.

In case there was no scan on the predefined base branch after its initial configuration, all branches will show all the scan results, not just the newly created security alerts. 

Info

Every time the base branch configuration changes, a WhiteSource Advise scan must be triggered on that branch prior to seeing new security results.   

Reviewing Scan Results

To review scan results, open one of the following windows:

...