Page Comparison

General Information

WhiteSource Mend Advise allows your developers to view a snapshot of a component’s details before they download it to their repository, and incorporate it in the codebase. It is delivered as a Chrome or Microsoft Edge (from version 83) extension.

WhiteSource Mend Advise quickly identifies open source component installation references on Web pages such as StackOverflow, Maven Central, and RubyGems. See also Supported Repositories.

When in the page, a simple click on the icon enables developers to view important details to help them decide whether or not to add a new component. Details include known vulnerabilities, quality scores, and whether the component is currently in use within your organization.

...

Installing Mend Advise as an External User

Inviting an External User (for

...

Mend Administrators Only)

The WhiteSource Mend account administrator has the option to invite users to download and use WhiteSource Mend Advise by doing the following:

1. From the WhiteSource Mend application, click Admin > Advise for Chrome Management. The Advise for Chrome Management screen is displayed.
2. In Add Users by Email pane, in Emails, add the email addresses of all the users for whom you want to receive an invitation via email.
   Note: Ensure each email address is entered on a separate line.

...

Installing Mend Advise (for Invited Users)

Invited (external) users will receive a link via an email invitation in order to complete the installation.

1. When the user receives the invitation email, click on the "download" button in Chrome and install the plugin.
2. If the WhiteSource Mend instance is not hosted on saas.whitesourcesoftware.com, complete these steps:
     I. click on the configuration icon in the lower right corner of the plugin:

...

5. Enter the user's email and submit. A verification email will be sent.
6. Open the verification email and click on the "verify link."

Activating

...

Mend Advise via the Profile Page (

...

Mend Users Only)

Existing WhiteSource Mend users can activate the WhiteSource Mend Advise from their 'Profile' page without having an administrator send an invitation. This option is done via the following steps:

1. Go to your Profile Page.
   
2. Navigate to the 'Advise for Chrome' panel on this page.
   
3. Click Advise for Chrome to generate an activation link. An activation link is be generated. If you are a member of multiple organizations, click the link for the relevant organization.
4. Add the WhiteSource Mend Advise extension to your browser.  
5. Click Activation Link in order to complete the activation process. 

NOTE: You have the option to deactivate WhiteSource Mend Advise on your organization by clicking Deactivate. 

...

Using

...

Mend Advise

The following are the methods used for maximizing the WhiteSource Mend Advise functionality. For a list of repositories and platforms supported by each of these methods, refer to the table in Supported Repositories and Platforms.

1. Browse for a specific library version page by URL

For example, go here for a MVN repository library.

You can view the WhiteSource Mend selection plugin red mark when a library is identified.

2. Browse any Web page via a text pattern search

You can scan any Web page for open source component installation references, by clicking on the WhiteSource Mend Advise extension icon.

It will scan the page and detect all package references where/when available.

...

Any open source component installation reference (such as "pypi install", "gem install", etc.) will be highlighted.

WhiteSource Mend Advise searches for the following text patterns in these languages:

Python (pip)

pip install {package name}=={version}

Ruby (bundler)

One of the following

gem install {package name}={version}

...

gem install {package name}:{version}

JavaScript (NPM)

npm install {package name}@{version}

.NET (NuGet)

One of the following:

install-package {package name} –package {version}

...

nuget update {package name} –package {version}

Java (Maven)

One of the following:

<dependency>

      <groupId>{group}</groupId>

      <artifactId>{artifact}</artifactId>

      <versionId>{version}</versionId>

   </dependency>

...

<parent>

                …

   </parent>

Go

import (

                “github.com/{owner1}/{repository1}”

                “github.com/{owner2}/{repository2}”

                ...

)

PHP (Composer)

One of the following:

"require": {

                “{group}/{artifact}”: “{version}”

}

...

"require-dev": {

                “{group}/{artifact}”: “{version}”

}

Scala (SBT)

One of the following:

librarydependencies += "{group}" % "{artifact}" % "{version}"

...

libraryDependencies ++= Seq(

    "{group-1}" % "{artifact-1}" % "{version-1}",

    "{group-2}" % "{artifact-2}" % "{version-2}" % "test"

)

Rust (Cargo)

One of the following:

cargo install --version {version} {package name}

...

cargo update --package {package name} --precise {version}

Haskell (Cabal)

One of the following:

Legacy:

...

cabal v2-install {package name}-{version}

OCaml (Opam)

One of the following:

opam install {package name}

...

opam pin add {package name}

3. Code snippet highlighting on any Web page

Scan any of the supported code references from the previous section by highlighting it, right-clicking, and then selecting Scan with WhiteSource Mend Advise option. 

The WhiteSource Mend Advise searches for the same patterns that were displayed in the previous section and provides a single result:

Displayed Information after the Scan

WhiteSource Mend Advise displays the following information:

...

In the following sample screenshot, WhiteSource Mend Advise found two vulnerabilities with a high score. Clicking on the 'Take me to the first component' link forwards you to the first icon of the vulnerability.

Selecting the Interface Language 

WhiteSource Mend Advise provides you with the option to select a language:

1. Click on the 'About' icon .
   
   
   
   
2. The 'About' panel is displayed. Click on 'Language' and select the language for the interface:
   
   

Supported Repositories and Platforms

WhiteSource Mend Advise currently supports the following repositories:

...

Supported Languages

WhiteSource Mend Advise supports the detection of open source components installation references in the following programming languages:

...