V5 api update (V2 Framework) - #20
Merged
Merged
Conversation
…upport - Upgrade host detection endpoint from /api/2.0/ to /api/5.0/ with QDS fields - Add KnowledgeBase query module (API v4.0) for CVE and QID entities - Add scan list query module (API v3.0) for IP and QID entities - Add launch scan capability (API v2.0) via onMessage handler - Add check scan status via onMessage handler - Add domain entity support with two-step DNS→IP resolution - Add CVE entity type to dataTypes - Add enableScanLaunch, scanOptionProfile, scannerName config options - Update associateDataWithEntities for CVE/domain/scan data - Add scan launch UI with status checking to web component - Add CVE_DISPLAY_FORMAT and SCAN_DISPLAY_FORMAT constants - Update validateOptions with scan option validation Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…operly The KB_RECORD_FORMAT was storing CVE list items with key 'name' but the web component's _renderListOfLinks reads 'link.id'. This caused CVE IDs to render as undefined text in the pi-external-link component. Changed the mapping to use 'id' to match the expected data shape. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
When looking up a CVE entity, each matching KnowledgeBase record is now displayed in its own collapsible pi-card, with the vulnerability title as the card title. - Server: pass dontFlatten=true to getDisplayResults for CVE lookups, returning DisplayField[][] (one array per record) instead of a flat list - Web component: detect grouped format in _renderTabContent and delegate to new _renderKnowledgeBaseCard method - Each card is collapsible/expanded by default and participates in the copy-button expansion via data-pi-card attribute Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…fields Replaces the manual expand/collapse button pattern in _renderHtmlField with pi-section-header, which manages its own collapsed state internally. - Sections start collapsed (is-collapsed) to keep CVE cards compact - show-collapse-button enables the toggle - Removes fieldIndex parameter from _renderHtmlField (no longer needed) - Updates the HTML field test to reflect that content is always in the DOM Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Adds margin-bottom sm (0.5rem) to list-of-links fields via a new .list-of-links CSS class on the _renderListOfLinks wrapper div, giving visual breathing room before the Diagnosis pi-section-header. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The copy button was position:absolute at top:7px which landed directly on the first pi-card title bar after the CVE card grouping change. Switch to a normal flex row (justify-content: flex-end) so the button sits in its own right-aligned row above the copyable content, removing the overlap entirely. Removes the now-unneeded position:relative on .content-wrapper. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The copy-btn-container must be position:absolute so it escapes to the platform's outer container (which is position:relative). The previous fix mistakenly added position:relative to .content-wrapper, trapping the button inside the component. That wrapper rule was already removed in the prior commit — this restores the correct absolute positioning so the button floats at top-right of the platform container as intended. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Group flat scan fields (split on isNewSectionLineBreak) into per-scan bordered containers (.scan-item) with border, border-radius, padding - Remove <hr> section-break separators from the scans tab - Add gap:xs between scan items via .scan-list flex container - Limit display to first 10 scans; show 'Showing first 10 of N scans' message at the top when there are more than 10 results - Add 3 new web component tests covering grouped rendering, count message display, and no-message case Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…2 margin-top - Fix pi-tab count badge for scans to show actual scan count (number of groups) via _countScanGroups(), not the raw flat field array length — this also fixes the count message which was not appearing because the condition compared grouped count against MAX_SCANS correctly but the tab badge showed a misleading raw number - Remove indent-0 class from h2 title elements — only add indent class when indent > 0 (indent-0 applies padding-left:0 which is the default and does nothing) - Add margin-top:0 to h2 inside .scan-item to remove typographyCSS top margin from scan titles Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Replace raw DisplayField array length (which counted individual fields, not records) with _countTabRecords() that correctly returns: - For flat tabs (hostDetections, knowledgeBaseRecords, scans): count of isNewSectionLineBreak markers, one per host/KB/scan record - For grouped tabs (CVE knowledgeBaseRecords): inner array length Also renames the scan-specific _countScanGroups to the general-purpose _countTabRecords used by all tabs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Group flat hostDetections DisplayFields by isNewSectionLineBreak and render each host as a collapsible pi-card. The card title is built from the isTitle field (using label+value when showLabelAndValue is set). Title fields with displayLink are kept in the card body so the pi-external-link is still rendered. Update affected tests to assert pi-card presence instead of <h2/hr. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Use --pi-card-background CSS custom property (exposed by pi-card) to override the default container-base color with application-3, which is one level lighter/darker and visually distinguishable from the surrounding pi-tab-panel background. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The qds_factors processor returns a Record<string,string> of factor names
to values (e.g. { CVSS: '9.8', Exploitability: 'High' }). Previously it
was passed through as a plain string label, producing '[object Object]'.
- Add isKeyValueObject flag to DisplayFormatEntry and DisplayField types
- Mark qds_factors in the detection_list item format with isKeyValueObject
- Add _renderKeyValueObject renderer that iterates Object.entries and
renders one pi-key-value per factor
- Branch in _renderDisplayField to dispatch to the new renderer
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
QDS Factors appeared as [object Object] in the detection_list because _renderListItemField (used for collapsible isList items) had no branch for isKeyValueObject — it fell through to pi-key-value which coerced the object to a string. Delegate to _renderKeyValueObject there too. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
QDS Factors entries were rendering without their section label. Add an <h3> for field.label at the top of the .kv-object-section container, and add CSS to zero out its margin-top so it sits flush. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Change h3 → h2 for the QDS Factors label (consistent with other section headings in detection list items) - Wrap pi-key-value rows in .kv-object-section-values with margin-left sm so they are visually indented under the heading Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…can launch When Qualys returns a 400 (e.g. invalid option profile ID), PolarityRequest throws ApiRequestError before the XML body can be parsed. Catch the error, parse the XML from meta.body, and surface the Qualys error text as an IntegrationError with actionable help text. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Qualys has marked the 2.0 scan endpoint as End-of-Service (EOS), with EOL in ~195 days. Updated to the 3.0 path as directed by the API warning in the response body. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ts with <VALUE> element xml2js with charkey:'value' conflicts with Qualys <ITEM><VALUE> tag names — whitespace text nodes and the <VALUE> child element both map to 'value', producing an array like ['\n \n ', 'scan/1234.5678', '\n'] that serializes to '\n \n ,scan/1234.5678\n' in the query string. Fix: flatten array-or-string value, join, and trim in extractItemValue(). Also added friendly Qualys error extraction on 400 in checkScanStatus. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Two issues: 1. Container dist/ may be stale, still running old compiled code 2. Scan refs already persisted in the web component from pre-fix launches still carry the leading comma corruption Defensively extract just the scan/XXXXX.XXXXX portion via regex before using the value, and throw a clear IntegrationError if it doesn't match the required format. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The server-side xml2js charkey collision can return a scan ref with leading corruption (e.g. ',scan/1234.5678'). Apply the same regex extraction in the web component at the point the launch result is received, so the correct value is both displayed and stored in block.data.details._scanResult.scanRef. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Update QID regex to match 'QID:12345', 'QID: 12345', 'QID 12345', 'QID : 12345'
- Replace old flow(split(':'),last,trim) extraction with extractQidValue() helper
- Add customType entity type (editable, disabled by default)
- Add customTypeValueRegex admin option for custom digit extraction
- Add extractCustomTypeValue() with configurable regex and digit fallback
- Extend all qid query paths to also handle customType entities
- Add validateCustomTypeValueRegex() option validation
- Add 13 new tests covering extraction helpers and regex validation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…parator formats The custom QID type regex now allows :, -, and _ as separators (with optional surrounding whitespace) as well as no separator at all. Updated the extraction function to match and added tests for the new patterns. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The character class [:-_] was treating '-' as a range operator (ASCII 58-95), which does not include the literal hyphen character (ASCII 45). Moving the hyphen to the end of the class [:_-] makes it a literal match, fixing 'qid-38906' style lookups. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Tests referenced 'customTypeValueRegex' and 'extractCustomTypeValue' but the actual option key is 'customQidValueRegex' and the function is 'extractCustomQidValue'. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.