Scans Triggered from Visual Studio

Developers who work in an integrated development environment (IDE) such as CxSAST Visual Studio plugin, as part of a much larger development project managed in source control, would sometimes prefer to scan their code before uploading it to their source control repository. 

The CxSAST Visual Studio plugin allows the developer to scan the code from within the Visual Studio project. When scanning code from the CxSAST Visual Studio plugin, the scanned coded is always the local code, which resides in the Visual Studio project, regardless of the CxSAST project’s Location type (Local/Shared/Source Control).  This implies that projects can now contain scans of different location types, and the location type can be viewed as a scan property.

Usually, scan results of local code have no relevance to the entire team, and we would like to limit their visibility only to the scan owner. Furthermore, results of "interim scans". namely: scans carried out while the code is still being processed during the work day, are likely to adversely affect the count of daily issues, because issues "detected" through these scans may well be resolved later on, before the code is uploaded to the source control repository at the end of the day.

If the user chooses not to make the scan results visible to other users - in other words, to make the scan private - the scan will only be visible to the following entities: 

  • The scan's owner (the user)
  • Users with CxAdmin priviliges
  • Users whose location in the hierarchy is higher than that of the user

The CxSAST Visual Studio plugin provides the user with two ways to achieve this behavior:

  1. Define the scan as private from within a public project
  2. Define the project as private, namely: making all of the project's scans non-visible to other users

The operations described in this page must be carried out by a user with the appropriate credentials in CxSAST server. To ensure you have such credentials, see Setting Up the Visual Studio Plugin.

Defining Scans as Private

The process of defining scans as private takes place within Visual Studio.

To define a scan as private in an existing (not bound) public project:

  1. Right-click the project's name.
  2. Click CxViewer > Scan.
  3. In the Results Visibility dialog box that appears now, click No to make the scan private.

To define a scan as private in a bound project:

  1. Bind the CxViewer project to a project to an existing project, which is by definition public:
    1. Right-click the project's name.
    2. Click CxViewer > Bind Project.
    3. Select the project to which the CxViewer project is to be bound.
    4. Click Bind.
  2. Scan the newly bound project:
    1. Right-click the project's name.
    2. Click CxViewer > Scan.
  3. In the Results Visibility dialog box that appears now, click No to make the scan private.

Defining Projects as Private

To define a project as private:

  1. Right-click the project's name.
  2. Click CxViewer > Scan. 
  3. Ensure that the project is not bound (click No when prompted if you want to bind the project the corresponding project on the server). This will always create a new Cx project.
  4. In the Upload Source dialog box that appears now, clear the check box Make project scan results visible to other users.

Making a project private means that all of the projec's scan results are not visible to other users and will only be visible to the following entities:

  • The scan's owner (the user)
  • Users with Server Manager privileges
  • Users whose location in the hierarchy is higher than that of the user. 
    These users can only read or delete private projects defined in lower hierarchy levels, and they cannot edit or modify these projects.



Have a question?  Want to report an issue?  Contact Checkmarx support