Fixed dependency tree right click action #483

eyalk007 · 2024-09-17T10:57:52Z

All tests passed. If this feature is not already covered by the tests, I added new tests.

This PR fixes the right click action in the tree for dependencies with vulnerabilities.

Package json now works with scopes, and Maven and Gradle work now when inheriting version from parent.

The problem for gradle and maven mainly resided in the fact we sent the version(that was not needed) to the comparison with the impact tree.
In package json, the scope from the package name was removed and as a result, caused issues in identifying the package.

(pyton is not implemented)

src/main/java/com/jfrog/ide/idea/navigation/NavigationService.java

src/main/java/com/jfrog/ide/idea/scan/GradleScanner.java

src/main/java/com/jfrog/ide/idea/ui/LocalComponentsTree.java

hadarshjfrog · 2024-09-19T17:09:10Z

src/main/java/com/jfrog/ide/idea/ui/LocalComponentsTree.java

-            createNodePopupMenu((DependencyNode) selected);
+            DescriptorFileTreeNode descriptorFileTreeNode = (DescriptorFileTreeNode) selectedPath.getParentPath().getLastPathComponent();
+            String descriptorPath =  descriptorFileTreeNode.getSubtitle();
+            this.createNodePopupMenu((DependencyNode) selected, descriptorPath);
        } else if (selected instanceof VulnerabilityNode) {
            createIgnoreRuleOption((VulnerabilityNode) selected, e);
        } else if (selected instanceof ApplicableIssueNode) {
            createIgnoreRuleOption(((ApplicableIssueNode) selected).getIssue(), e);
        } else {


instead of removing the comment here - I suggest adding comments to all for cases of the if/else

okay tell me your opinion after my changes

src/main/java/com/jfrog/ide/idea/ui/LocalComponentsTree.java

hadarshjfrog

The code changes themselves are ok - but from what I read in the description - we're eliminating all version comparison.
How can that effect complex project with multiple packages from different types. should we identify them as vulnerabilities?

eyalk007 · 2024-09-22T12:45:21Z

@hadarshjfrog. what your saying about the versions is a dilema. I can try and keep it in cases it exists(meaning from parent) and not in cases it does not.
but you will always have the possibility of a case where there are two parents in the project. one has version lets say 1.0.0
and the other has version 1.2.0

they both will look the same as they both dont have a version(because they both inherit from their parents)
a possible solution is to use the maven and gradle apis(as they are the only supported multi module projects). but we didn't want to rely on them from the beginning.

github-actions · 2024-09-22T13:23:42Z

🐸 JFrog Frogbot

fixed for npm/yarn maven gradle and go

25f7f44

(pyton is not implemented)

eyalk007 had a problem deploying to frogbot September 17, 2024 10:57 — with GitHub Actions Failure

eyalk007 had a problem deploying to frogbot September 17, 2024 12:34 — with GitHub Actions Failure

refined code

27ca49f

eyalk007 force-pushed the bug-fix/dependnecy-link-in-tree branch from 14cafd3 to 27ca49f Compare September 17, 2024 12:34

eyalk007 had a problem deploying to frogbot September 17, 2024 12:34 — with GitHub Actions Failure

refined code

33369e6

eyalk007 had a problem deploying to frogbot September 17, 2024 12:37 — with GitHub Actions Failure

eyalk007 had a problem deploying to frogbot September 17, 2024 14:00 — with GitHub Actions Failure

eyalk007 changed the title ~~FIxed dependency tree right click action~~ Fixed dependency tree right click action Sep 17, 2024

eyalk007 self-assigned this Sep 17, 2024

eyalk007 temporarily deployed to frogbot September 18, 2024 06:34 — with GitHub Actions Inactive

fixed tests

b37a752

eyalk007 force-pushed the bug-fix/dependnecy-link-in-tree branch from bacf6d4 to b37a752 Compare September 18, 2024 08:21

eyalk007 temporarily deployed to frogbot September 18, 2024 08:21 — with GitHub Actions Inactive

eyalk007 marked this pull request as ready for review September 18, 2024 08:43

eyalk007 added bug Something isn't working safe to test Approve running integration tests on a pull request labels Sep 18, 2024

github-actions bot removed the safe to test Approve running integration tests on a pull request label Sep 18, 2024

eyalk007 requested a review from hadarshjfrog September 18, 2024 10:58

added a filter for multi-module

79cd857

eyalk007 had a problem deploying to frogbot September 19, 2024 09:22 — with GitHub Actions Failure

eyalk007 added the safe to test Approve running integration tests on a pull request label Sep 19, 2024

github-actions bot removed the safe to test Approve running integration tests on a pull request label Sep 19, 2024