Ecliipse Plugin | Feature | Vuln Detection - Setting State - MCP - Problem Winodw by cx-aniket-shinde · Pull Request #263 · Checkmarx/ast-eclipse-plugin

cx-aniket-shinde · 2026-08-12T05:10:21Z

By submitting a PR to this repository, you agree to the terms within the Checkmarx Code of Conduct. Please see the contributing guidelines for how to create and submit a high-quality PR for this repo.

Description

Describe the purpose of this PR along with any background information and the impacts of the proposed change.

References

Include supporting link to GitHub Issue/PR number

Testing

Describe how this change was tested. Be specific about anything not tested and reasons why. If this solution has unit and/or integration testing, tests should be added for new functionality and existing tests should complete without errors.

Please include any manual steps for testing end-to-end or functionality not covered by unit/integration tests.

Checklist

I have added documentation for new/changed functionality in this PR (if applicable).
All active GitHub checks for tests, formatting, and security are passing
The correct base branch is being used

- Remove McpInstallService from PreferencesPage (common-lib) - Create AuthenticationListener in devassist-lib configuration - Register listener in McpInstallService static block - Create IProjectLifecycleListener interface in common-lib - ProjectLifecycleListener implements interface - Update PluginStartup.getProjectListener() to return interface - MCP auto-install now triggered by authentication event (devassist-lib) - Workspace scan triggered after login via interface Architecture: common-lib has no devassist imports, clean separation.

- Create IAuthenticationSuccessHandler interface in common-lib - Move welcome dialog logic to AuthenticationSuccessHandler in devassist-lib - PreferencesPage delegates to handler via Preferences registry - Removes WelcomeDialog import from common-lib PreferencesPage - Handlers registered in McpInstallService static block Architecture: common-lib has NO devassist imports, clean separation.

- Create ISettingsChangeNotifier interface in common-lib - Create SettingsChangeNotifier implementation in main plugin - Register notifier in PluginStartup static block - Remove PluginStartup and PluginUtils imports from common-lib PreferencesPage - Use notifier instead of direct event broker calls Architecture: common-lib has NO main plugin imports, clean separation.

devassist-lib should depend on common-lib for JAR access, not duplicate them. - Remove lib/ references from devassist-lib MANIFEST.MF and build.properties - Remove lib/ references from devassist-lib .classpath - devassist-lib Require-Bundle: common-lib provides JAR access - Revert .gitignore to only track main plugin lib/

stepsecurity-app · 2026-08-12T05:10:28Z

Security Policy Alert: Actions Policy Violation

This workflow run has been blocked by StepSecurity's actions policy.

Disallowed Actions:

timonvs/pr-labeler-action@8b99f404a073744885d8021d1de4e40c6eaf38e2

To fix this issue, please modify the workflow to use only allowed actions. Contact your organization administrator to request changes to the allowed actions list if needed.

For more information, see StepSecurity's Actions Policy documentation.

cx-rakesh-kadu · 2026-08-12T17:11:03Z

 .vs/
 *.jar
 !checkmarx-ast-eclipse-plugin/lib/*.jar
+!devassist-lib/lib/*.jar


common-lib/lib/*.jar is excluded from the repo, breaking the entire Tycho build from a clean checkout

common-lib/META-INF/MANIFEST.MF declares a Bundle-ClassPath of 8 jars under common-lib/lib/ (ast-cli-java-wrapper, jackson-, slf4j-, commons-lang3), but .gitignore's blanket .jar rule only has exceptions for checkmarx-ast-eclipse-plugin/lib/.jar and devassist-lib/lib/.jar — never common-lib/lib/.jar — and .gitattributes never LFS-tracks it either. I confirmed common-lib/lib/ does not exist in a clean clone, and an actual mvn -pl common-lib,checkmarx-ast-eclipse-plugin,checkmarx-ast-eclipse-plugin-tests -am compile run fails with 38 unresolved-type errors (CxWrapper, CxConfig, CxException, org.slf4j.Logger all missing) in common-lib's own Authenticator.java/TenantSettingsProvider.java. Since the test module depends on common-lib in the same reactor, this blocks CI/every downstream build, not just common-lib.

Suggested fix: Add !common-lib/lib/*.jar to .gitignore and an LFS tracking line to .gitattributes (mirroring the devassist-lib entries added in this same PR), then commit the actual jars.

Evidence: .gitignore:7-9 has no common-lib exception; ls common-lib/lib → "No such file or directory"; mvn compile reproduced the failure independently.

cx-rakesh-kadu · 2026-08-12T17:11:55Z

@@ -0,0 +1,527 @@
+---
+name: jetbrains-scanner-state-management


Why we need this jetbrain file part of code?

cx-rakesh-kadu · 2026-08-12T17:16:05Z

 			parsedDate = dateTimeFormatter.format(instant);
 		} catch (Exception e) {
-			System.out.println(e);
+


Why empty catch block? Why not to use CxLogger.error(...)?

cx-rakesh-kadu · 2026-08-12T17:17:36Z

-		// Clear vulnerabilities from Problems View
-		PluginUtils.clearVulnerabilitiesFromProblemsView();
-
 		if (PluginUtils.areCredentialsDefined()) {


The pre-refactor code called PluginUtils.clearVulnerabilitiesFromProblemsView() at the top of createPartControl; that call was dropped and not relocated. Markers persist as real Eclipse IMarkers, so stale/incorrect vulnerability markers from a prior session can now survive an Eclipse restart until the user changes project/branch/scan.

Suggested fix: Re-add the clear call at the top of createPartControl (or into both drawPluginPanel/drawMissingCredentialsPanel).

Evidence: Diff removes PluginUtils.clearVulnerabilitiesFromProblemsView(); from createPartControl with nothing added in its place; the method is still called elsewhere (lines 981, 1121, 1186, 2707) but not on view creation.

cx-rakesh-kadu · 2026-08-12T17:19:41Z

@@ -0,0 +1,17 @@
+package com.checkmarx.eclipse.common.enums;
+
+public enum Severity {


checkmarx-ast-eclipse-plugin/src/.../enums/Severity.java is byte-for-byte identical to the new common-lib version and is now fully dead (zero remaining references), but was never deleted. Two identical types with the same simple name invite a future edit applied to only one copy.

Suggested fix: Delete the old plugin-local Severity.java and its now-orphaned dedicated tests.

Evidence: diff of the two files shows only the package line differs; repo-wide grep for the old FQN returns zero matches.

cx-rakesh-kadu · 2026-08-12T17:47:39Z

+            return IMarker.SEVERITY_WARNING;
+        }
+
+        switch (severity.toLowerCase()) {


Bug: No "Malicious" case in severity-to-marker mapping downgrades the most severe findings to Warning

SeverityLevel.MALICIOUS is defined as strictly more severe than CRITICAL, and ProblemDecorator already special-cases it — but calculateMarkerSeverity()'s switch has no "malicious" case and falls through to IMarker.SEVERITY_WARNING, understating the single most dangerous finding class (e.g. malicious packages/secrets).

Suggested fix: Add an explicit "malicious" → SEVERITY_ERROR case.
Evidence: MarkerIssueMapper.java:156-172; SeverityLevel.java:8; ProblemDecorator.java:205-206.

cx-rakesh-kadu · 2026-08-12T17:48:11Z

+        return new Object[0];
+    }
+
+    private Image getFileIcon(String fileName) {


New native Image created per file node on every tree refresh, never disposed

getElements() calls imageDescriptor.createImage() fresh for every file on every setInput() call; CxFindingsView.refreshTreeWithFilter() calls setInput() repeatedly (including from an async real-time-scan trigger), and dispose() is a no-op. SWT Images are OS handles, not GC'd — this leaks one handle per distinct file per refresh, eventually causing "no more handles" crashes in long-running sessions given how often real-time scanning refreshes the tree.

Suggested fix: Cache file-type icons by extension (like SeverityImageComposer's cache) and dispose superseded ones in dispose().
Evidence: FindingsContentProvider.java:36,58,108-111; CxFindingsView.java:1417,1422,1514.

cx-rakesh-kadu · 2026-08-12T17:48:38Z

+    }
+
+    @Override
+    public Object getParent(Object element) {


getParent() always returns null, breaking the ITreeContentProvider contract implied by getChildren()/hasChildren()

A real two-level hierarchy exists, but getParent() unconditionally returns null ("would need to track in the model"). Any future targeted-viewer operation (reveal, update) on a leaf will fail to locate the tree item. Latent today because the view always does full setInput() refreshes.
Suggested fix: Track the owning FileNodeLabel on each child, or maintain a child→parent map.
Evidence: FindingsContentProvider.java:70-95,81-86.

cx-rakesh-kadu · 2026-08-12T17:49:43Z

@@ -0,0 +1,106 @@
+//package com.checkmarx.eclipse.devassist.ui.findings.realtime;


(CheckmarxDocumentListener.java, CheckmarxEditorListener.java, RealTimeScanJob.java)

Entire package is a ~750-line, fully-unreferenced duplicate of the live real-time-scan implementation

devassist.ui.findings.realtime duplicates devassist.backend.listener (same class names, same purpose) but is imported by nothing (confirmed by grep), not exported in MANIFEST.MF, and every line of all three files is literally commented out including the package declaration itself. The canonical, wired implementation is backend.listener (held via a static strong reference in PluginStartup). Shipping ~750 lines of orphaned, plausible-looking duplicate source risks a future maintainer "fixing" the wrong, disconnected copy.

Suggested fix: Delete the three files under ui/findings/realtime/ entirely.
Evidence: grep for the package returns only its own files; every line begins with //; PluginStartup.java:12,48 imports the backend.listener version instead.

cx-rakesh-kadu · 2026-08-12T17:50:41Z

+ * - IAC: Represents scanning for Infrastructure as Code issues and misconfigurations.
+ * - ASCA: Represents scanning for Application Security Code Analysis.
+ */
+public enum ScanEngine {


duplicate of model/ScanEngine.java

utils.ScanEngine (used only by BaseScannerCommand/AscaScannerService) and model.ScanEngine (used by everything else — adaptors, ProblemDecorator, markers, remediation) are structurally different types for the same concept. BaseScannerCommand.getScannerType() bridges them via ScanEngine.valueOf(config.getEngineName().toUpperCase()) — a string round-trip with no compiler-enforced link. A future rename or new engine applied to only one enum breaks the bridge at runtime (IllegalArgumentException), not compile time.

Suggested fix: Consolidate to model.ScanEngine (the more complete, more widely used type) and delete utils.ScanEngine.
Evidence: utils/ScanEngine.java:14-21 vs model/ScanEngine.java:6-11; BaseScannerCommand.java:4,87-88; AscaScannerService.java:9,45.

cx-aniket-shinde added 18 commits August 7, 2026 23:57

module setup

fccb643

Gutter icons

86b13ef

lib

ee6a21d

Save

6445837

scanner state

6895b5a

Preferences state

d86b577

constant of promotional panel

d35e289

Missing Credentials panel when logout

c7f63e9

copilot integration

e96046f

Preferences package changes

2ab85da

Pref issues

fbfce35

Save code of enable disable scanners

68ec92a

Preferences cache clear

5bb8c29

MCP Install

19eebc6

cx-aniket-shinde requested review from a team, cx-anand-nandeshwar and cx-rakesh-kadu August 12, 2026 05:10

cx-aniket-shinde requested a review from cx-anurag-dalke as a code owner August 12, 2026 05:10

cx-aniket-shinde changed the base branch from main to feature/devassist_integration August 12, 2026 05:12

cx-rakesh-kadu requested changes Aug 12, 2026

View reviewed changes

Text changes and info-unkown underline removal.

66ad330

Navigation Menu

Uh oh!

Ecliipse Plugin | Feature | Vuln Detection - Setting State - MCP - Problem Winodw - #263

Ecliipse Plugin | Feature | Vuln Detection - Setting State - MCP - Problem Winodw#263
cx-aniket-shinde wants to merge 19 commits into
feature/devassist_integrationfrom
feature/preferences

cx-aniket-shinde commented Aug 12, 2026

Uh oh!

stepsecurity-app Bot commented Aug 12, 2026

Uh oh!

cx-rakesh-kadu Aug 12, 2026

Uh oh!

cx-rakesh-kadu Aug 12, 2026

Uh oh!

cx-rakesh-kadu Aug 12, 2026

Uh oh!

cx-rakesh-kadu Aug 12, 2026

Uh oh!

cx-rakesh-kadu Aug 12, 2026

Uh oh!

cx-rakesh-kadu Aug 12, 2026

Uh oh!

cx-rakesh-kadu Aug 12, 2026

Uh oh!

cx-rakesh-kadu Aug 12, 2026

Uh oh!

cx-rakesh-kadu Aug 12, 2026

Uh oh!

cx-rakesh-kadu Aug 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		@@ -0,0 +1,527 @@
		---
		name: jetbrains-scanner-state-management

		@@ -0,0 +1,17 @@
		package com.checkmarx.eclipse.common.enums;

		public enum Severity {

		@@ -0,0 +1,106 @@
		//package com.checkmarx.eclipse.devassist.ui.findings.realtime;

Uh oh!

Conversation

cx-aniket-shinde commented Aug 12, 2026

Description

References

Testing

Checklist

Uh oh!

stepsecurity-app Bot commented Aug 12, 2026

Security Policy Alert: Actions Policy Violation

Disallowed Actions:

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants