Versions Compared

Old Version 62

changes.mady.by.user Vital Batyr

Saved on

compared with

New Version 63

changes.mady.by.user Michelle Friedman

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Table of Contents
exclude.*beta.*

Overview

WhiteSource Mend Advise for Eclipse is a powerful software plug-in for the Eclipse IDE. It makes critical information available directly from within the IDE, and provides developers with information on security vulnerabilities reported for their open-source libraries in their projects. It leverages WhiteSource’s Mend’s vast database and analysis power, and its automatic vulnerability checking facilitates quick remediation.

WhiteSource Mend Advise for Eclipse's intuitive design provides the following:

  • Details on reported security vulnerabilities are featured in familiar Eclipse tabs

  • Expanded information is displayed on-demand by hovering a mouse pointer over a component with reported vulnerabilities

  • The reference in the pom.xml/build.gradle to a component reported to have a security vulnerability is automatically marked in the IDE

WhiteSource Mend Advise for Eclipse works quickly and unobtrusively in the background, enabling earlier vulnerability awareness, better vulnerability handling, and faster vulnerability remediation.

Support for Languages and Package Managers

WhiteSource Mend Advise for Eclipse supports Java with the Maven and/or Gradle package managers.

NOTE: Gradle Kotlin projects are not supported in WhiteSource Mend Advise.

Prerequisites

Ensure the following:

  • A valid license for WhiteSource Mend for Developers

  • A license key for WhiteSource Mend Advise for IDE, available via one of the following options:

    • If you do not have direct access to the WhiteSource Mend Application, obtain the license key from your WhiteSource Mend Administrator.

    • If you have access to the WhiteSource Mend Application, do as follows (NOTE: This option is only available when using version 20.11.1 or later of WhiteSource Mend Advise):

      1. Go to the WhiteSource Mend Application.

      2. Open the Profile page.

      3. In the WhiteSource Mend Advise - IDE Integration section at the bottom, select your organization.

      4. Copy your personal license key to be used later in Activating WhiteSource Mend Advise.

  • Java JDK 1.8 and up (see here for instructions) or OpenJDK 1.8 and up is installed

  • Either or both of the following:

    • Apache Maven Application is installed and the Maven path and all environment variables are set up (see here for instructions)

    • Gradle is installed

  • Eclipse is installed and you are familiar with its basic functionality.

  • When declaring a gradle.properties file, ensure it is declared in the project's top-level folder.

Proxy settings

WhiteSource Mend Advise for Eclipse supports proxy settings (Networks Connections sections of the setting). Note, that only HTTPS proxy is supported.

Supported Versions

The plugin supports Eclipse 2018-09 and above. The last tested version is 2021-12.

Installing

...

Mend Advise

To install WhiteSource Mend Advise, do as follows:

NOTE: If you previously installed the WhiteSource Mend Advise plugin using the dropin folder, you must delete the org.whitesource.eclipse.plugin jar file from the dropin folder before performing this procedure.

  1. Start Eclipse, specifying the preferred workspace.

  2. From the menu bar, select Help > Eclipse Marketplace. The Eclipse Marketplace screen is displayed.

  3. In the Search tab, in the Search box, enter whitesourceMend and press Enter from your keyboard. The WhiteSource Mend Advise plugin information is displayed.

  4. Click Install. 

  5. Read and accept the license agreement's terms, and click Finish.

  6. In the pop-up message, click Restart Now.

Activating

...

Mend Advise

To activate WhiteSource Mend Advise, do as follows:

  1. Start Eclipse, specifying the preferred workspace.

  2. From the menu bar, select WhiteSource > WhiteSource Mend > Mend Advise Login. The Welcome to WhiteSource Mend Advise dialog box is displayed.

  3. In email, enter your organizational email (the email domain must be licensed to use Advise).

  4. In License Key, enter your license key (See here for more information on how to obtain a license key). 

  5. Click Login.

NOTE: If you check Remember License Key, the login credentials will be stored in your Eclipse Secure Storage. Once stored, the WhiteSource Mend Advise login credentials will be used for all Eclipse workspaces and all instances of Eclipse running on your computer. If you want to log in to WhiteSource Mend Advise using a different set of credentials, select WhiteSourceMend> WhiteSource Mend Advise Login, click Login with Different Credentials.

Configuring

...

Mend Advise

Info

Changes made to the WhiteSource Mend settings will only apply after running the next scan.

To configure WhiteSource Mend Advise, do as follows:

  1. From the menu bar, select Window > Preferences.The Preferences screen is displayed.

  2. Select WhiteSource Mend.

  3. In the WhiteSource Mend screen, review the options and modify if necessary. See here for a list of all options.

  4. Click Apply and Close.

Options Table

Option

Description

Default Setting

Only show issues for direct dependencies

When enabled, WhiteSource Mend Advise will only return vulnerabilities for direct dependencies defined in your dependency file.

Unselected (not checked)

Minimum vulnerability severity level

Alert only on detected vulnerabilities satisfying a Low/Medium/High minimum severity level.

  • Low - Vulnerability alerts for all severities (Low, Medium, High) are displayed.

  • Medium- Vulnerability alerts only for Medium or High severities are displayed.

  • High - Vulnerability alerts only for High severities are displayed.

Low

Scanning Projects for Security Vulnerabilities

Automatically Scanning Projects

Once you have activated WhiteSource AdviseMend Advise, it automatically scans Maven/Gradle projects for open source security vulnerabilities whenever such projects are opened or built. The scan results are displayed in the Markers tab and a dedicated WhiteSourceMend tab. There is no way of disabling automatic scanning.

Manually Scanning Projects 

To manually scan a project, do as follows:

  1. Select one or multiple projects in Eclipse.

  2. Do one of the following options:

    • From the menu bar, select WhiteSource Mend > Scan Project with WhiteSource Mend Advise

    • From your keyboard, click Ctrl + 6 (Windows Only)

    • From the top toolbar, click the WhiteSourceMend icon

    • From the Project Explorer pane, right-click a project (or a selection of projects) and select Scan Project With WhiteSource Mend Advise from the context menu

Reviewing Scan Results

Scan results are displayed in the following areas:

  • The Eclipse Marker tab, displaying important analysis information

  • The WhiteSourceMend tab, displaying extended scan results information

Refer to the following sections.

Reviewing Analysis Results in the Markers Tab

The Markers tab lists information regarding Eclipse projects including problems and tasks, and important details on WhiteSource Mend vulnerability scan results. Those results are categorized and grouped according to their severity (High, Medium and Low) under designated rows (e.g., WhiteSource Mend Scan – High Severity) that can be expanded and collapsed to display more information on each vulnerability.

...

 NOTE: Additional security vulnerability details are found in the WhiteSource Mend tab, in the Description column.

Reviewing Analysis Results in the

...

Mend tab

The WhiteSourceMend tab expands on the vulnerability details listed in the Markers tab. The tab features the following columns:

  • Project - The scanned project where a vulnerability was found

  • Component - The scanned component reported to have a vulnerability

  • Version - The version of the scanned component reported to contain a vulnerability

  • Vulnerability - The identifier of the vulnerability. Clicking the identifier (link) opens the WhiteSource the Mend Vulnerability Lab providing more information.

  • CVSS 2 - The security vulnerability's Common Vulnerability Scoring System (CVSS) 2 score

  • CVSS 3 - The security vulnerability's Common Vulnerability Scoring System (CVSS) 3 score

  • Severity - Reported severity for the vulnerability: High, Medium, Low

  • Dependency type - Whether the vulnerable component is a Direct dependency (as defined directly in the pom.xml/build.gradle file) or a Transitive dependency

  • Description - The description of the security vulnerability

To sort the displayed WhiteSource Mend Advise results based on a preferred column, click the corresponding column header.

...

  • Scanned projects - The total count of projects scanned

  • Last scan timestamp - The time the scan began

  • Security vulnerability scan summary - The number of High, Medium, and Low severity vulnerabilities in the scan, plus the total number of vulnerabilities

Displaying Vulnerability Information for a Scanned Component

WhiteSource Mend Advise enables you to view valuable information on open source security vulnerabilities and enables you to easily highlight code regarding such vulnerabilities. This section describes how WhiteSource Mend Advise can be used to display security vulnerability details for a project, in Eclipse's main code view.

Click the WhiteSourceMend tab and do as follows:

  • To quickly locate the component referenced by a reported vulnerability in the project’s pom.xml/build.gradle, double-click the security vulnerability in the WhiteSourceMend tab. The referenced component description in the pom.xml/build.gradle will be displayed and highlighted in a window view. 

  • To quickly locate vulnerability analysis resultsfor a component in the pom.xml/build.gradle view, click the WhiteSource Mend Advise severity icon displayed to the left of that component reference in the pom.xml/build.gradle; analysis details for the corresponding component will be displayed and highlighted in the WhiteSource Mend tab. Also, a tooltip featuring relevant analysis details including a dependency path from proprietary code to the component will be displayed.

  • To quickly review the list of vulnerabilities reported for a component in the pom.xml/build.gradle view, hover the mouse pointer over the WhiteSource Mend Advice severity icon displayed to the left of a component. A tooltip will be displayed, featuring details (per vulnerability) including identifier (e.g., CVE), severity, and a fix suggestion if available.

  • (For Maven projects only) To quickly display an analysis summary for a component in the pom.xml view, hover the mouse pointer over the code for the component in that view; a tooltip will be displayed, featuring both information and (depending on vulnerability attributes) links for applicable options, as follows:

    • Jump to location: Changes the display to a view featuring the component’s definition

    • Fix for: (applicable only to vulnerabilities in direct dependencies) Updates the component’s version pom.xml field with the number of the earliest version that according to WhiteSource Mend features a fix to the security vulnerability. 

Restoring the

...

Mend Tab

If the WhiteSource Mend tab is closed, you can re-open it as follows:

  1. From the menu bar, select Window > Show View > Other. The Show View dialog box is displayed.

  2. Open the WhiteSource Mend folder, and select WhiteSourceMend. 

Viewing General Plugin Information 

To view version information about WhiteSource about Mend Advise, do as follows:

  • From the menu bar, select WhiteSource Mend > About WhiteSource About Mend Advise.

The WhiteSource Mend Advise screen displays information about the Advise plugin's version and copyright, along with links for Privacy policy and Terms and Conditions.

Upgrading

...

Mend Advise 

To upgrade the WhiteSource Mend Advise plugin, do as follows:

  1. Start Eclipse, specifying the preferred workspace.

  2. From the menu bar, select Help > Eclipse Marketplace. The Eclipse Marketplace screen is displayed.

  3. Click the Installed tab.

  4. Scroll for the WhiteSource Mend Advise plugin.

  5. Click Update.

  6. Read and accept the license agreement's terms, and click Finish.

  7. In the popup message, click Restart Now.

...

Uninstalling Mend Advise

Uninstalling WhiteSource Mend Advise will remove the plugin and its components only from the current workspace. 

...

  1. From the menu bar, select Help > About Eclipse IDE > Installation Details. The Eclipse IDE Installation Details dialog box is displayed.

  2. In the filter text field at the top, enter whitesource Mend, and click Enter.

  3. Select WhiteSource Mend Advise.

  4. At the bottom, click Uninstall. The Uninstall Details dialog box is displayed. 

  5. Review and click Finish.

  6. If you are prompted to restart, do so.

In order to remove WhiteSource Mend Advise from additional workspaces, do as follows per workspace:

  1. In Eclipse, open the workspace.

  2. Install WhiteSource Mend Advise for that workspace, as per the instructions above. 

  3. Uninstall WhiteSource Mend Advise for that workspace, as per the instructions above. This will remove all the relevant WhiteSource Mend components from that workspace.

Known Issues

Installing the Plugin on Multiple Eclipse Versions

The Eclipse plugin will not work for users who first installed it on a 2019-xx version of the Eclipse IDE, and who then installed the plugin on a 2018-xx (or earlier) version of the Eclipse IDE. This problem exists due to the following circumstances:

...