Block Security Vulnerabilities from Entering Your Code

Note: this blog post has last been updated on November 7, 2021

As continuous software deployments grow and become the accepted standard, security measures gain even more importance. From development and all the way through to production, security requirements should be adopted by all teams in an organization.

JFrogIDE integrationsprovide security and compliance intelligence to the developer right from within their IDE. The plugins/extensions allow users to scan their project dependencies and viewsecurity vulnerabilitiesand license compliance issues during development time.

支持什么?

Currently JFrog supports four IDE integrations, all working with the same functionalities.

• Visual Studio Code– scanning your Maven, Python, Go and npm project dependencies
• IntelliJ IDEA——扫描你的Maven, Gradle, Go, Pypi and npm project dependencies
  • Also supports – WebStorm, PyCharm, Android Studio, GoLand
• Eclipse– scanning your Maven, Gradle and npm project dependencies
• Visual Studio– scanning your NuGet project dependencies

What’s included in the Plugin/Extension?

When installed, you will see a JFrog tab on the screen. The JFrog panel includes a dependency tree view, with the project’sdirect dependenciesat the top level andtransitive dependenciesthat you can view when drilling down further in the tree. For example, in Visual Studio Code:

JFrog Xrayautomatically performs a scan whenever there is a change in the dependencies in the project. Clicking on a dependency displays its details, including the detected issue type, severity level, version, license, and issue summary. For example, in IntelliJ IDEA:

It is also possible to filter scan results according to severity using colour, for example high severity is displayed in red. Moreover, if a transitive dependency has a vulnerability or violation at the bottom of the tree, all of its parent dependencies, will be marked as vulnerable as well. This view allows pinpointing the transitive dependency, responsible for the vulnerability.

You can jump from a dependency in the tree to its definition on the editor.

There are manyadditional useful features, including searching for a dependency in the tree, hovering over a dependency in the editor to quickly display information about it, and viewing licenses directly from within the pom.xml, package.json, requirements.txt or go.mod.

Shifting Left with Security

Delivering highly secure software, faster, requires efforts from all teams, as part of yourDevOps workflow.Shifting leftas part of aDevSecOpsstrategy with more tools, enables developers to stop any potential threats, such as security vulnerabilities and license violations, right from the start. This enables dev teams to easily mitigate any issues before they cause any potential risk to the organization, saving time and money in the long run.

If you haven’t started working with JFrog Xray yet, visit the JFrog website andstart your free trial.

Read about theLog4shell