A valid license for WhiteSource for Developers
A license key for WhiteSource Advise for IDE, available via one of the following options:
If you do not have direct access to the WhiteSource Application, obtain the license key from your WhiteSource Administrator.
If you have access to the WhiteSource Application, do as follows (NOTE: This option is only available when using version 20.11.1 or later of WhiteSource Advise):
Go to the WhiteSource Application.
Open the Profile page.
In the WhiteSource Advise - IDE Integration section at the bottom, select your organization.
Copy your personal license key to be used later in Activating WhiteSource Advise.
Java JDK 1.8 and up (see here for instructions) or OpenJDK 1.8 and up is installed
Depending on whether scanning Maven or Gradle applications, note the following guidelines:
Apache Maven application is installed and the Maven path and all environment variables are set up (see here for instructions).
Gradle application is installed and the Gradle path and all environment variables are set up. NOTE: Gradle version 4.8 or above must be installed.
IntelliJ IDEA is installed and you are familiar with its basic functionality
The plugin supports the following IntelliJ IDEA versions:
Limitation - Gradle support for the following IntelliJ IDEA versions are notsupported on macOS:
Start IntelliJ IDEA, specifying the preferred project.
From the sidebar on the right, click WhiteSource (if you do not see the sidebar, select View >Tool Windows > WhiteSource). The Welcome screen is displayed.
In Email, enter your organizational email (the email domain must be licensed to use Advise).
In License Key, enter your license key (See here for more information on how to obtain a license key).
To quickly locate the component referenced by a reported vulnerability in the project’s pom.xml or build.gradle view, double-click the component in the WhiteSource security check tab. The referenced component description in the pom.xml or build.gradle file will be displayed and highlighted in the main code view.
To quickly locate vulnerability analysis results for a component in the pom.xml or build.gradle view, click the WhiteSource Advise severity icon displayed to the left of that component reference in the pom.xml. Note that the icon denotes the severity of the vulnerability (yellow: low severity; orange: medium severity; red: high severity). A tooltip featuring relevant analysis details including a dependency path from the proprietary code to the open-source component will be displayed. Vulnerability details are also displayed as part of the tooltip and include the vulnerability identifier (e.g., CVE), severity, and a fix suggestion if available. A Details link is displayed which leads to the WhiteSource Vulnerability Database, providing more information on the specific vulnerability.
To quickly display an analysis summary for a component in the pom.xml or build.gradle view, hover the mouse pointer over the code for the component in that view; a tooltip will be displayed, featuring a list of all vulnerabilities found within the particular component.
Generating Debug Logs for WhiteSource Support
To generate debug logs, do as follows:
From the menubar, click Help. A menu is displayed.
Select Diagnostic Tools > Debug Log Settings. The Custom Debug Log Configuration dialog box is displayed.
Enter this text: #org.whitesource.intellij.plugin
Debug logs will now be generated for the integration.
Upgrading WhiteSource Advise