aensley/sonar-teams-notifier

This SonarQube plugin notifies WebEx Teams of Scan Results.

Andrew Ensley

• 📫 How to reach me: https://andrewensley.com/
• ➕ How to support me: https://github.com/sponsors/aensley

sonar-teams-notifier's Issues

Update deprecated code

Several calls to SonarQube methods are deprecated. Replace with up-to-date implementations.

Add Debug messages

Fix missing scanner params

Add user mentions of commit authors

SonarQube has the ability to know the author of the commit being scanned.

WebEx Teams supports mentioning users by their email address using the format:

<@personEmail:[email protected]|Bobby>

Use this format to notify commit authors of analysis condition failures.

Add tests

Fix COMMIT_URL and CHANGE_AUTHOR params

Add "Accept All HTTPS" option

Allow user to "Accept All HTTPS Certificates" (bypass validation) for proxy connections.

Add proxy authentication.

sonar-teams-notifier/src/main/java/com/andrewensley/sonarteamsnotifier/extension/TeamsPostProjectAnalysisTask.java

Lines 106 to 111 in 1309a49

	// TODO: Add proxy authentication.
	return HttpClient.newBuilder()
	.version(HttpClient.Version.HTTP_2)
	.followRedirects(HttpClient.Redirect.ALWAYS)
	.proxy(ProxySelector.of(new InetSocketAddress(proxyIp.get(), proxyPort.get())))
	.build();

---

This issue was generated by todo based on a TODO comment in 1309a49. It's been assigned to @aensley because they committed the code.

Publish Javadoc automatically

WS-2009-0001 (Low) detected in commons-codec-1.11.jar

WS-2009-0001 - Low Severity Vulnerability

Vulnerable Library - commons-codec-1.11.jar

The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

Library home page: http://commons.apache.org/proper/commons-codec/

Path to dependency file: /tmp/ws-scm/sonar-teams-notifier/pom.xml

Path to vulnerable library: /root/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar

Dependency Hierarchy:

• httpclient-4.5.9.jar (Root Library)
  • ❌ commons-codec-1.11.jar (Vulnerable Library)

Found in HEAD commit: 2a9ceff94944a0cbcff0fef567afdc244c05f4a9

Vulnerability Details

Not all "business" method implementations of public API in Apache Commons Codec 1.x are thread safe, which might disclose the wrong data or allow an attacker to change non-private fields.Updated 2018-10-07 - an additional review by WhiteSource research team could not indicate on a clear security vulnerability.

Publish Date: 2007-10-07

URL: WS-2009-0001

CVSS 2 Score Details (0.0)

Base Score Metrics not available

---

Step up your Open Source Security Game with WhiteSource here

Fix NullPointer Exception

sonar-teams-notifier/src/main/java/com/andrewensley/sonarteamsnotifier/extension/TeamsHttpClient.java

Lines 290 to 294 in d9206a6

	if (!hook.getQuery().isEmpty()) {
	tempPath += "?" + hook.getQuery();
	}
	if (!hook.getRef().isEmpty()) {

Update message format

Java 1.8 Compatibility