Block Security Vulnerabilities from Entering Your Code

Note: this blog post has last been updated on November 7, 2021

As continuous software deployments grow and become the accepted standard, security measures gain even more importance. From development and all the way through to production, security requirements should be adopted by all teams in an organization.

JFrog IDE integrations provide security and compliance intelligence to the developer right from within their IDE. The plugins/extensions allow users to scan their project dependencies and view security vulnerabilities and license compliance issues during development time.

What’s Supported?

Currently JFrog supports four IDE integrations, all working with the same functionalities.

• Visual Studio Code – scanning your Maven, Python, Go and npm project dependencies
• IntelliJ IDEA – scanning your Maven, Gradle, Go, Pypi and npm project dependencies
  • Also supports  – WebStorm, PyCharm, Android Studio, GoLand
• Eclipse – scanning your Maven, Gradle and npm project dependencies
• Visual Studio – scanning your NuGet project dependencies

What’s included in the Plugin/Extension?

When installed, you will see a JFrog tab on the screen. The JFrog panel includes a dependency tree view, with the project’s direct dependencies at the top level and transitive dependencies that you can view when drilling down further in the tree. For example, in Visual Studio Code:

JFrog Xray automatically performs a scan whenever there is a change in the dependencies in the project. Clicking on a dependency displays its details, including the detected issue type, severity level, version, license, and issue summary. For example, in IntelliJ IDEA:

It is also possible to filter scan results according to severity using colour, for example high severity is displayed in red. Moreover, if a transitive dependency has a vulnerability or violation at the bottom of the tree, all of its parent dependencies, will be marked as vulnerable as well. This view allows pinpointing the transitive dependency, responsible for the vulnerability.

You can jump from a dependency in the tree to its definition on the editor.

There are many additional useful features, including searching for a dependency in the tree, hovering over a dependency in the editor to quickly display information about it, and viewing licenses directly from within the pom.xml,  package.json, requirements.txt or go.mod.

Shifting Left with Security

Delivering highly secure software, faster, requires efforts from all teams, as part of your DevOps workflow. Shifting left as part of a DevSecOps strategy with more tools, enables developers to stop any potential threats, such as security vulnerabilities and license violations, right from the start. This enables dev teams to easily mitigate any issues before they cause any potential risk to the organization, saving time and money in the long run.

If you haven’t started working with JFrog Xray yet, visit the JFrog website and start your free trial.

Read about the Log4shell