Typically, Code Sight does not display issue details until you click to highlight one of the issues in the Issues list. When an issue is highlighted, the Issue Details display shows specific information about the issue.
Policy violations
For Code Sight to display Black Duck SCA reports of policy violations, the Black Duck server must be configured as follows:
- The policy rule needs to be applicable to Rapid Scan mode.
-
The policy rule can be set to either All Projects or Subset of Projects.
Code Sight does not do matching on project properties (such as names, tags, and so on) for Subset of Projects. Only the policy rules that specify exclusions of project properties (for example, not in) will work with Code Sight.
- The policy rule will be tested if the Component and Vulnerability conditions apply.
SCA issues in Eclipse, IntelliJ, and Visual Studio
For an issue found by Black Duck SCA, the diamond-shaped issue icon highlights the number of issues found.
This is followed by a list of open-source components that result in the issue;
the names of the security vulnerabilities detected;
the names of policy violations detected;
and then by further details such as the license used and dates and times on which the issues were detected.
(Example from IntelliJ)
Each occurrence of an issue shows an icon that indicates whether the issue is a direct (declared) dependency or a transitive (indirect) dependency:
Direct dependency
Transitive dependency
SCA issues in VS Code
VS Code displays SCA issues in the LOCAL VIEW in the left-hand side bar.
To launch a new SCA scan in VS Code, use a scan configuration.
To see the details about an issue, click its entry. Code Sight displays the details in an Editor tab.