...

WhiteSource Advise for IntelliJ IDEA supports Java, Kotlin and Scala projects using Maven (pom.xml dependency files), and supports Java projects using Gradle (build.gradle dependency files).

NOTES: 

• Gradle Kotlin projects are not supported in WhiteSource Advise.

• When using the the "apply from" script plugin in Gradle projects, remote script location is not supported.

...

• A valid license for WhiteSource for Developers

• A license key for WhiteSource Advise for IDE, available via one of the following options:

  • If you do not have direct access to the WhiteSource Application, obtain the license key from your WhiteSource Administrator.

  • If you have access to the WhiteSource Application, do as follows (NOTE: This option is only available when using version 20.11.1 or later of WhiteSource Advise):

    1. Go to the WhiteSource Application.

    2. Open the Profile page.

    3. In the WhiteSource Advise - IDE Integration section at the bottom, select your organization.

    4. Copy your personal license key to be used later in Activating WhiteSource Advise.

• Java JDK 1.8 and up (see here for instructions) or OpenJDK 1.8 and up is installed

• Depending on whether scanning Maven or Gradle applications, note the following guidelines:

  • Apache Maven application is installed and the Maven path and all environment variables are set up (see here for instructions).

  • Gradle application is installed and the Gradle path and all environment variables are set up. NOTE: Gradle version 4.8 or above must be installed.

• IntelliJ IDEA is installed and you are familiar with its basic functionality

Supported Versions

The plugin supports the following IntelliJ IDEA versions:

• 2021.1

• 2020.3

• 2020.2

• 2020.1

• 2019.3

• 2019.2

• 2019.1

• 2018.3

• 2018.2

• 2018.1

• 2017.3

• 2017.2

Limitation - Gradle support for the following IntelliJ IDEA versions are not supported on macOS: 

• 2019

  .1

• 2018.3

• 2018.2

2018

.1

2017.3

• 2017.2

Installing WhiteSource Advise

...

1. Start IntelliJ IDEA.

2. From the menu bar, select File > Settings. The Settings screen is displayed.

3. From the left sidebar, click Plugins.

4. In the Search box, enter whitesource and then press Enter from your keyboard. The WhiteSource Advise plugin information is displayed.

5. Click Install and then click Restart IDE.

6. In the pop-up dialog box, click Restart.

Activating WhiteSource Advise

...

1. Start IntelliJ IDEA, specifying the preferred project.

2. From the sidebar on the right, click WhiteSource (if you do not see the sidebar, select View >Tool Windows > WhiteSource). The Welcome screen is displayed.

3. In Email, enter your organizational email (the email domain must be licensed to use Advise).

4. In License Key, enter your license key (See here for more information on how to obtain a license key). 

5. Click Connect.

...

• From the menu bar, select Tools > WhiteSource Advise

• From the top toolbar, click the WhiteSource icon

• Do as follows:

  1. From the sidebar on the right, click WhiteSource.

  2. From the top, click Advise.

  3. Click Run WhiteSource Advise.

Developer Focus Mode

The developer focus mode will allow developers to see only vulnerability alerts that are new in their feature branches compared to a predefined base branch. This will promote the security shift left approach and will empower developers to fix newly introduced vulnerabilities immediately as part of their feature development efforts and prior to merging vulnerable code into production branches.

In order to enable focus mode:

• In the WhiteSource Advise project-level configuration enable the “Diff operation to be performed on a base branch” checkbox.

• Choose the base branch to which all other branch scans will be compared to

• Make sure your base branch is checked out and trigger a WhiteSource Advise scan either manually or by building your project.

In case there was no scan on the predefined base branch after its initial configuration, all branches will show all the scan results, not just the newly created security alerts. 

Reviewing Scan Results

To view scan results, do as follows:

...