Merge pull request #42 from Qualys/develop

QINT-16843: Github for WAS | Build is failing when SEVERITY_CHECK is false or DISCOVERY scan is enabled when timeout is reached after scan is launched
Qualys · Jan 15, 2024 · 302551e · 302551e
2 parents 20dd338 + daf21e9
commit 302551e
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 10 deletions.
diff --git a/src/main/java/com/example/GitHubActionsQWas/service/QualysWASScanBuilder.java b/src/main/java/com/example/GitHubActionsQWas/service/QualysWASScanBuilder.java
@@ -270,9 +270,11 @@ public void launchWebApplicationScan() {
                         if (result.has("ServiceResponse") && result.get("ServiceResponse").getAsJsonObject().has("responseCode") && result.get("ServiceResponse").getAsJsonObject().get("responseCode").getAsString().equalsIgnoreCase("SUCCESS")) {
                             data.get("ServiceResponse").getAsJsonObject().getAsJsonArray("data").get(0).getAsJsonObject().get("WasScan").getAsJsonObject().remove("igs").getAsJsonObject();
                             data.get("ServiceResponse").getAsJsonObject().getAsJsonArray("data").get(0).getAsJsonObject().get("WasScan").getAsJsonObject().addProperty("ScanId", scanId);
-                            if (!status.equalsIgnoreCase("error") && !status.equalsIgnoreCase("canceled") && !status.equalsIgnoreCase("finished") && isFailOnScanError) {
-                                Helper.dumpDataIntoFile(gson.toJson(data), fileName);
-                                System.exit(1);
+                            if (status != null) {
+                                if (!status.equalsIgnoreCase("error") && !status.equalsIgnoreCase("canceled") && !status.equalsIgnoreCase("finished") && isFailOnScanError) {
+                                    Helper.dumpDataIntoFile(gson.toJson(data), fileName);
+                                    System.exit(1);
+                                }
                             }
                             if (isFailConditionConfigured) {
                                 JsonObject failurePolicyEvaluationResult = evaluateFailurePolicy(result);
@@ -339,7 +341,7 @@ public JsonObject evaluateFailurePolicy(JsonObject result) throws Exception {
      */
     private String getScanFinishedStatus(String scanId) {
         QualysWASScanStatusService statusService = new QualysWASScanStatusService(client);
-        String status = statusService.fetchScanStatus(scanId, portalServer, interval, timeout);
+        String status = statusService.fetchScanStatus(scanId, this.scanType, this.severityCheck, this.portalServer, this.interval, this.timeout);
         logger.info(status);
         return status;
     }

diff --git a/src/main/java/com/example/GitHubActionsQWas/service/QualysWASScanStatusService.java b/src/main/java/com/example/GitHubActionsQWas/service/QualysWASScanStatusService.java
@@ -19,26 +19,32 @@ public QualysWASScanStatusService(WASClient client) {
      * @param scanId
      * @return
      */
-    public String fetchScanStatus(String scanId, String portalUrl, int INTERVAL, int TIMEOUT) {
+    public String fetchScanStatus(String scanId, String scanType, boolean severityCheck, String portalUrl, int INTERVAL, int TIMEOUT) {
         long startTime = System.currentTimeMillis();
         long timeoutInMillis = TimeUnit.MINUTES.toMillis(TIMEOUT);
         long intervalInMillis = TimeUnit.MINUTES.toMillis(INTERVAL);
-        String status = null;
+        String status = "";
+        boolean failed = false;
 
         try {
             while ((status = client.getScanFinishedStatus(scanId)) == null) {
                 long endTime = System.currentTimeMillis();
                 if ((endTime - startTime) > timeoutInMillis) {
-                    logger.info("Failed to get scan result; timeout of " + TIMEOUT + " minutes reached.");
                     String message1 = "Failed to get scan result; timeout of " + TIMEOUT + " minutes reached.";
                     String message2 = "Please switch to WAS Classic UI and Check for report...";
                     String message3 = "To check scan result, please follow the url: " + portalUrl + "/portal-front/module/was/#forward=/module/was/&scan-report=" + scanId;
                     logger.info(message1);
                     logger.info(message2);
                     logger.info(message3);
-                    String message = message1 + "\n" + message2 + "\n" + message3;
-                    Helper.dumpDataIntoFile(message, "Qualys_Wasscan_" + scanId + ".txt");
-                    System.exit(1);
+                    if (scanType.equalsIgnoreCase("vulnerability") && severityCheck) {
+                        failed = true;
+                    }
+                    if (failed) {
+                        String message = message1 + "\n" + message2 + "\n" + message3;
+                        Helper.dumpDataIntoFile(message, "Qualys_Wasscan_" + scanId + ".txt");
+                        System.exit(1);
+                    }
+                    break;
                 } else {
                     try {
                         logger.info("Waiting for " + INTERVAL + " minute(s) before making next attempt for scanResult of scanId:" + scanId + "...");