Typically, Code Sight does not display issue details until you click to highlight one of the issues in the Issues list. When an issue is highlighted, the Issue Details display shows specific information about the issue.

Policy violations

For Code Sight to display Black Duck SCA reports of policy violations, the Black Duck server must be configured as follows:

  • The policy rule needs to be applicable to Rapid Scan mode.
  • The policy rule can be set to either All Projects or Subset of Projects.

    Code Sight does not do matching on project properties (such as names, tags, and so on) for Subset of Projects. Only the policy rules that specify exclusions of project properties (for example, not in) will work with Code Sight.

  • The policy rule will be tested if the Component and Vulnerability conditions apply.

SCA issues in Eclipse, IntelliJ, and Visual Studio

 For an issue found by Black Duck SCA, the diamond-shaped issue icon highlights the number of issues found. This is followed by a list of open-source components that result in the issue; the names of the security vulnerabilities detected; the names of policy violations detected; and then by further details such as the license used and dates and times on which the issues were detected.

Figure 1. Details panel for an SCA issue

Details panel for composition analysis

(Example from IntelliJ)

Each occurrence of an issue shows an icon that indicates whether the issue is a direct (declared) dependency or a transitive (indirect) dependency:

 Direct dependency

 Transitive dependency

Fix It feature (Eclipse and Visual Studio)

In Eclipse and Visual Studio, the Details panel can contain buttons to facilitate fixing a detected problem.

  •  Click the Fix It button with a green icon to resolve the issue using auto-remediation.

    An automatic fix might be available if your project was build using npm®.

    Figure 2. Panel for automatically fixing an SCA issue

    Panel to automatically fix an open-source issue and then rescan

    Choose an alternate open-source component from the drop-down list, and then click Fix and Rescan.

  •  Click the Fix It button with a pointing-finger icon to resolve the issue manually.
    Figure 3. Panel for manually fixing an SCA issue

    Panel to fix an open-source issue manually

    Review the components in the drop-down list. Choose one, replace it in your source project, and then click Rescan.

SCA issues in VS Code

VS Code displays SCA issues in the LOCAL VIEW in the left-hand side bar.

Figure 4. LOCAL VIEW with SCA issues in VS Code

VS Code display of SCA issues
  • To launch a new SCA scan in VS Code, click the Run Open Source Analysis Scan icon. (The icon is visible only when your mouse hovers over the LOCAL VIEW.)

To see the details about an issue, click its entry. Code Sight displays the details in an Editor tab.

Figure 5. SCA issue details in VS Code editor

VS Code display of SCA issue details