Enquiry ???? {post /api/v3/releases/{releaseId}/open-source-scans/start-scan}

[jaiswals007]

Question

Hello Team,

We would like to check, if there is an equivalent element, option or parameter in the FCLI to run test scan.

post /api/v3/releases/{releaseId}/open-source-scans/start-scan

If not, can you please consider this as an enhancement request.

Please do not hesitate to update this ticket if you have further clarifications in line with my enquiry.

Thank You,
Sourabh Jaiswal
OpenText Core Application Security

[jaiswals007]

Hello Team,

Could you please review and ack my question ? As we are working on customer urgent ticket.

Your quick response would be highly appreciated.

Thank You,
Sourabh Jaiswal

[rsenden]

Hi, we provide the fcli fod oss-scan start command, which I think under the hoods uses the endpoint that you mentioned (you can verify exact endpoint and request parameters/contents by running the command with fcli debug/trace logging enabled).

If this doesn't meet customer requirements, please raise an enhancement request that describes requirements in detail, i.e., what functionality they need that's not currently supported by this fcli command.

[jaiswals007]

Thanks Rudd for your swift response.

While running the fcli fod oss-scan start command, getting the below file upload error (both zip and without zip). I believe, fcli file upload is not supporting.

We will submit the enhancement request with customer requirements.

C:\Windows\System32>fcli fod oss-scan start --release=xxxxxxxx --file="C:\Users\xxxxxxxx\Downloads\fcli-oss-scan\payload-cyclonedx.json"
FcliSimpleException: Error uploading file
at com.fortify.cli.fod._common.rest.helper.FoDFileTransferHelper.uploadChunked(FoDFileTransferHelper.java:99)
Caused by: com.fortify.cli.common.rest.unirest.UnexpectedHttpResponseException:
Request: POST https://api.emea.fortify.com/api/v3/releases/192434/open-source-scans/start-scan?fragNo=-1&offset=0:
Reason: HTTP 500 Internal Server Error
Body:
{"errors":[{"errorCode":1001,"message":"Unexpected error processing request"}]}

Thank you so much again for your input.

[rsenden]

@jaiswals007, I've seen users reporting this error before. From the fcli side, we're just uploading the user-specified file to the FoD REST endpoint. For some reason, FoD returns an HTTP 500 Internal Server Error on this request; the FoD team would need to check their logs to find out why FoD is not accepting these requests. Given that FoD doesn't return any useful error message, we can't identify what's wrong with this request from the client side.

I think usually this endpoint is used to submit a ScanCentral package that was created with the -oss option (to collect dependency info); I don't know whether this endpoint is supposed to also accept a CycloneDX payload, again FoD team would need to confirm. If the CycloneDX file already contains vulnerability info, I think the right way to submit it to FoD is through the fcli fod oss-scan import command.