Composite_key_approach by cx-apoorva-singh · Pull Request #68 · checkmarx-ltd/ServiceNowCxOne

cx-apoorva-singh · 2026-03-30T07:04:27Z

PR Title
CxOne AVIT Composite Key Implementation & Aggregation Logic

Description
This PR introduces a stable composite key for mapping CxOne SAST findings to ServiceNow AVITs, replacing the previous key based on resultHash. The new key is a SHA256 hash of the finding’s code-flow location, ensuring stability across scans and enabling aggregation of multiple findings into a single AVIT. The implementation also includes logic for migration from old keys, aggregation handling, NOT_EXPLOITABLE closure, and ensures correct closure/update behavior for AVITs. Non-SAST findings (SCA, KICS, Containers, etc.) remain unaffected.

Summary of New Changes

Composite Key: SAST source_avit_id is now computed as similarityId + '_' + SHA256(similarityId + startNodeName + startFileName + endNodeName + endFileName).
Aggregation: Multiple findings with the same composite key are aggregated into one AVIT. The count is stored in dependency_type, and up to 20 deep links are stored in source_vulnerability_summary.
Migration: On first scan after deployment, old-key AVITs are re-keyed to the new composite key, and duplicates are closed.
NOT_EXPLOITABLE Handling: If a finding is marked NOT_EXPLOITABLE, all AVITs sharing the composite key for the project/branch are set to FIXED and closed.
Closure Logic: AVITs are closed if all findings disappear in a scan; remain open if any finding remains.
Non-SAST Findings: SCA, KICS, Containers, etc., continue to use the old key logic.
Max Link Limit: Only 20 links are stored per AVIT for aggregated findings.

Test Cases & Coverage

Composite Key Generation (Covered)
- Test Case:
  - Input: SAST finding with specific similarityId, nodes array (with start/end node names and file names).
  - Expected: source_avit_id is similarityId + '_' + SHA256(similarityId + startNodeName + startFileName + endNodeName + endFileName).
  - Edge: Single-node and multi-node findings.
Aggregation Logic (Covered)
- Test Case:
  - Input: Two findings with same composite key (different resultHash), same scan.
  - Expected: Only one AVIT created, dependency_type = 2, both deep links in source_vulnerability_summary (max 20).
Migration from Old Key (Covered)
- Test Case:
  - Input: Existing AVIT with old key (similarityId + '_' + resultHash), new scan with composite key.
  - Expected: Old AVIT re-keyed to new composite key, counter/links reset, duplicates closed (state=3, FIXED).
Counter and Link Reset per Scan (Covered)
- Test Case:
  - Input: First finding for composite key in new scan.
  - Expected: dependency_type = 1, source_vulnerability_summary = current link.
- Test Case:
  - Input: Second finding for same composite key in same scan.
  - Expected: dependency_type increments, link appended.
Closure Logic (Remaining)
- Test Case:
  - Input: All findings for a composite key disappear in a scan.
  - Expected: AVIT is closed by closure processor.
- Test Case:
  - Input: Some findings remain.
  - Expected: AVIT remains open.
Max Link Limit (Remaining)
- Test Case:
  - Input: >20 findings for same composite key in one scan.
  - Expected: Only 20 links stored in source_vulnerability_summary.
Non-SAST Findings (Remaining)
- Test Case:
  - Input: SCA, KICS, Containers, etc.
  - Expected: Old key logic applies, no composite key logic.

Jira Link : https://checkmarx.atlassian.net/browse/CXSER-983

Addition pf Composite_key (source_avit_id is similarityId + '_' + SHA256(similarityId + startNodeName + startFileName + endNodeName + endFileName) to Source AVIT Id column of ServiceNow. Jira link: https://checkmarx.atlassian.net/browse/CXSER-983

…9e510026f72021153af1b.js removing stale code

cx-rakesh-kadu · 2026-03-30T17:45:00Z

+                            '?resultId=' + encodeURIComponent(sastResultHash);
+
+                        var sastScanUrl = '';
                        if (!jsonLastScanReportResp.results[item].data.resultHash.indexOf('/') == -1) {


The ! negates indexOf(...) before comparing to -1, so !0 == -1 → false, !5 == -1 → false, and !(-1) == -1 → false as well. This condition is always false — the else branch (/sast) is always taken, making the URL-building logic dead code. The intent was almost certainly.

will update sastVulnerabilityLink creation

cx-rakesh-kadu · 2026-03-30T18:09:36Z

+            existingCounter = parseInt(avitNew.getValue('dependency_type') || '0', 10);
+            existingLinks = avitNew.getValue('source_vulnerability_summary') || '';
+            existingScanSummaryStr = avitNew.getDisplayValue('app_vul_scan_summary') || '';
+            existingStatus = avitNew.getValue('source_remediation_status') || '';


missing var declaration for existingStatus

will remove existingStatus , it is not being used.

cx-rakesh-kadu · 2026-03-30T18:10:34Z

+            existingCounter = parseInt(avitNew.getValue('dependency_type') || '0', 10);
+            existingLinks = avitNew.getValue('source_vulnerability_summary') || '';
+            existingScanSummaryStr = avitNew.getDisplayValue('app_vul_scan_summary') || '';
+            existingStatus = avitNew.getValue('source_remediation_status') || '';


existingStatus is read but never used anywhere in the function body. It's dead code that should either be removed or actually consumed

will remove existingStatus , it is not being used.

cx-rakesh-kadu · 2026-03-30T18:17:27Z

+            } else {
+                var newCounter = existingCounter + 1;
+                resultObj['dependency_type'] = '' + newCounter;
+                if (linkHtml && existingCounter < 20) {


checked against existingCounter (the pre-increment value) but the result uses newCounter. The check should be against newCounter?

Yes, will add check against newCounter.

updated sastVulnerabilityLink creation added null check for compositeLocationHash removed existingStatus , since it not being used line 442 added check for newCounter insted of existingCounter

change has been added to handle closing of record , which has not been migrated with new composite key and belongs to latest scan hence was not handled by existing closure logic.

…9e510026f72021153af1b.js Updated SAST aggregation to use resultHash as the displayed link text in source_vulnerability_summary instead of the full vulnerability URL. Since resultHash is only about 22 characters and keeps the stored HTML well within the field's 8000 character limit, the append cap was increased from 20 to 30 to retain more finding links per AVIT.

Update CheckmarxOneAVITClosureProcessor.js This change adds handling for closing records that were not migrated to the new composite key and belong to the latest scan. Such records were not covered by the existing closure logic, and this update ensures they are now processed correctly.

… key and aggregation changes.pdf Document to manually apply composite change in version 1.0.34

Composite_key_approach

c9f1ea3

Addition pf Composite_key (source_avit_id is similarityId + '_' + SHA256(similarityId + startNodeName + startFileName + endNodeName + endFileName) to Source AVIT Id column of ServiceNow. Jira link: https://checkmarx.atlassian.net/browse/CXSER-983

cx-apoorva-singh requested review from cx-prathmesh-borle, cx-rakesh-kadu and cx-umesh-waghode March 30, 2026 07:05

Update CheckmarxOneAppVulItemProcessor_sys_script_include_ba2b3da6976…

683d6dc

…9e510026f72021153af1b.js removing stale code

cx-rakesh-kadu requested changes Mar 30, 2026

View reviewed changes

cx-rakesh-kadu requested changes Mar 31, 2026

View reviewed changes

Comment thread CheckmarxOneAppVulItemProcessor_sys_script_include_ba2b3da69769e510026f72021153af1b.js

cx-apoorva-singh added 2 commits March 31, 2026 13:01

Changes for PR comments

03ac281

updated sastVulnerabilityLink creation added null check for compositeLocationHash removed existingStatus , since it not being used line 442 added check for newCounter insted of existingCounter

removing unrequired file

2fcd727

cx-apoorva-singh requested a review from cx-rakesh-kadu March 31, 2026 08:32

cx-apoorva-singh added 3 commits March 31, 2026 15:58

Update CheckmarxOneAVITClosureProcessor.js

036e445

change has been added to handle closing of record , which has not been migrated with new composite key and belongs to latest scan hence was not handled by existing closure logic.

Update CheckmarxOneAVITClosureProcessor.js

15e51f4

cx-rakesh-kadu approved these changes Mar 31, 2026

View reviewed changes

cx-apoorva-singh added 4 commits March 31, 2026 20:57

Update CheckmarxOneAVITClosureProcessor.js

49aa850

Create ServiceNow manual update for Checkmarx One SAST AVIT composite…

7143543

… key and aggregation changes.pdf Document to manually apply composite change in version 1.0.34

Update UpdateSet_GA.xml

e541eef

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Composite_key_approach#68

Composite_key_approach#68
cx-apoorva-singh wants to merge 11 commits intopre-release-1.0.34from
composite_key_approach

cx-apoorva-singh commented Mar 30, 2026

Uh oh!

cx-rakesh-kadu Mar 30, 2026

Uh oh!

cx-apoorva-singh Mar 31, 2026

Uh oh!

Uh oh!

Uh oh!

cx-rakesh-kadu Mar 30, 2026

Uh oh!

cx-apoorva-singh Mar 31, 2026

Uh oh!

cx-rakesh-kadu Mar 30, 2026

Uh oh!

cx-apoorva-singh Mar 31, 2026

Uh oh!

Uh oh!

cx-rakesh-kadu Mar 30, 2026

Uh oh!

cx-apoorva-singh Mar 31, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

cx-apoorva-singh commented Mar 30, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants