Package org.jenkinsci.plugins.cortexcloud.shared

Class Vulnerability

java.lang.Object
org.jenkinsci.plugins.cortexcloud.shared.Vulnerability
All Implemented Interfaces:
Serializable
public class Vulnerability extends Object implements Serializable
A single vulnerability or compliance finding reported by the Cortex CLI. Field mapping mirrors the legacy plugin so the result UI ports cleanly. The Gson SerializedName aliases make deserialization tolerant of the exact JSON key names used by the CLI; once a real --output-format json payload is captured from CLI >= 0.33.0, any renamed key is a one-line alias addition rather than a redesign. All getters are null-safe so a partial payload still renders.
See Also:

  • Constructor Details

    • Vulnerability

      public Vulnerability()

  • Method Details

    • create

      public static Vulnerability create()
      Fluent builder used by ScanOutputParser to map the Cortex CLI's XDM finding schema onto this view model. Each setter returns this so a finding can be constructed in one expression.

    • cve

      public Vulnerability cve(String v)

    • severity

      public Vulnerability severity(String v)

    • cvss

      public Vulnerability cvss(double v)

    • packageName

      public Vulnerability packageName(String v)

    • packageVersion

      public Vulnerability packageVersion(String v)

    • status

      public Vulnerability status(String v)
      Sets the fix status, e.g. "fixed in 1.33.2" (drives getFixVersions()).

    • link

      public Vulnerability link(String v)

    • description

      public Vulnerability description(String v)

    • title

      public Vulnerability title(String v)

    • type

      public Vulnerability type(String v)

    • fixDate

      public Vulnerability fixDate(long v)
      Unix epoch seconds when a fix became available (drives getTimeSinceFixDate()).

    • published

      public Vulnerability published(long v)

    • getCve

      public String getCve()

    • getText

      public String getText()

    • getLink

      public String getLink()

    • getId

      public int getId()

    • getSeverity

      public String getSeverity()

    • getCvss

      public double getCvss()

    • getDescription

      public String getDescription()

    • getTitle

      public String getTitle()

    • getCause

      public String getCause()

    • getType

      public String getType()
      Returns:
      the finding type. When the CLI provides an explicit type string it is used as-is; otherwise findings without a CVE are treated as compliance issues. This is intentionally simpler than the legacy id-based mapping and will be refined against a captured JSON payload.

    • getStatus

      public String getStatus()

    • getPackageName

      public String getPackageName()

    • getPackageVersion

      public String getPackageVersion()

    • getPublished

      public long getPublished()

    • getGracePeriodDays

      public Integer getGracePeriodDays()

    • getValidCve

      public boolean getValidCve()
      Returns:
      true when this finding has both a CVE identifier and a vendor link, i.e. it can be rendered as a working hyperlink in the results table. A link without a CVE (or vice versa) is not treated as linkable.

    • getBlock

      public boolean getBlock()

    • getIsFixed

      public boolean getIsFixed()

    • getShowFixLink

      public boolean getShowFixLink()

    • getFixLink

      public String getFixLink()

    • getFixVersions

      public String getFixVersions()

    • getFixDate

      public long getFixDate()

    • getTimeSinceFixDate

      public String getTimeSinceFixDate()

    • getTimeSinceExpiration

      public String getTimeSinceExpiration()

    • getGraceDaysLeft

      public String getGraceDaysLeft()

    • getIsCompliance

      public boolean getIsCompliance()

    • getDescriptionItems

      public List<String[]> getDescriptionItems()
      Returns:
      key/value items used to describe the finding in the result UI. Returns simple String[] pairs ([label, value]) to avoid a dependency on commons-lang Pair in the model layer.