Merge pull request #148 from DependencyTrack/136-improve-github-advisory-config-ui-api-token-documentation

Improve GHSA description; Prevent saving of invalid configs; Add GitHub and NIST logos

Author: nscuro

src/assets/img/github-logo.svg

@@ -442,11 +442,12 @@
     "vulnsource_nvd_desc": "The National Vulnerability Database (NVD) is the largest publicly available source of vulnerability intelligence. It is maintained by a group within the National Institute of Standards and Technology (NIST) and builds upon the work of MITRE and others. Vulnerabilities in the NVD are called Common Vulnerabilities and Exposures (CVE). There are over 100,000 CVEs documented in the NVD spanning from the 1990’s to the present.",
     "vulnsource_nvd_feeds_url": "NVD Feeds URL",
     "vulnsource_github_advisories_enable": "Enable GitHub Advisory mirroring",
-    "vulnsource_github_advisories_desc": "GitHub Advisories is a centralized source of vulnerability intelligence specific to GitHub projects. GitHub advisories may \nor may not be documented in the National Vulnerability Database. Restarting the Dependency-Track server is required to force the system to mirror the contents of GitHub Advisories. A Personal Access Token is needed, but it doesn't require any scope.",
+    "vulnsource_github_advisories_desc": "GitHub Advisories (GHSA) is a database of CVEs and GitHub-originated security advisories affecting the open source world. Dependency-Track integrates with GHSA by mirroring advisories via GitHub's public GraphQL API. The mirror is refreshed daily, or upon restart of the Dependency-Track instance. A personal access token (PAT) is required in order to authenticate with GitHub, but no scopes need to be assigned to it.",
     "registered_email_address": "Registered email address",
     "api_token": "API token",
     "consumer_key": "Consumer key",
     "consumer_secret": "Consumer secret",
+    "personal_access_token": "Personal Access Token",
     "identifier": "Identifier",
     "url": "URL",
     "enabled": "Enabled",

src/i18n/locales/en.json

@@ -1,10 +1,20 @@
 <template>
   <b-card no-body :header="header">
     <b-card-body>
-      <c-switch id="vulnsourceEnabled" color="primary" v-model="vulnsourceEnabled" label v-bind="labelIcon" />{{$t('admin.vulnsource_github_advisories_enable')}}
+      <img alt="GitHub logo" src="@/assets/img/github-logo.svg" width="65"/>
+      <hr/>
+      <c-switch
+        :disabled="!this.vulnsourceEnabled && !this.apitoken"
+        color="primary"
+        id="vulnsourceEnabled"
+        label
+        v-bind="labelIcon"
+        v-model="vulnsourceEnabled"
+      />
+      {{$t('admin.vulnsource_github_advisories_enable')}}
       <b-validated-input-group-form-input
         id="github-advisories-apitoken"
-        :label="$t('admin.api_token')"
+        :label="$t('admin.personal_access_token')"
         input-group-size="mb-3"
         rules="required"
         type="password"
@@ -15,7 +25,13 @@
       {{ $t('admin.vulnsource_github_advisories_desc') }}
     </b-card-body>
     <b-card-footer>
-      <b-button variant="outline-primary" class="px-4" @click="saveChanges">{{ $t('message.update') }}</b-button>
+      <b-button
+        :disabled="this.vulnsourceEnabled && !this.apitoken"
+        @click="saveChanges"
+        class="px-4"
+        variant="outline-primary">
+          {{ $t('message.update') }}
+      </b-button>
     </b-card-footer>
   </b-card>
 </template>

src/views/administration/vuln-sources/VulnSourceGitHubAdvisories.vue

@@ -1,7 +1,15 @@
 <template>
   <b-card no-body :header="header">
     <b-card-body>
-      <c-switch id="vulnsourceEnabled" color="primary" v-model="vulnsourceEnabled" label v-bind="labelIcon" />{{$t('admin.vulnsource_nvd_enable')}}
+      <c-switch
+        :disabled="!this.vulnsourceEnabled && !this.nvdFeedsUrl"
+        id="vulnsourceEnabled"
+        color="primary"
+        v-model="vulnsourceEnabled"
+        label
+        v-bind="labelIcon"
+      />
+      {{$t('admin.vulnsource_nvd_enable')}}
       <b-validated-input-group-form-input
         id="nvd-feeds-url"
         :label="$t('admin.vulnsource_nvd_feeds_url')"
@@ -15,7 +23,13 @@
       {{ $t('admin.vulnsource_nvd_desc') }}
     </b-card-body>
     <b-card-footer>
-      <b-button variant="outline-primary" class="px-4" @click="saveChanges">{{ $t('message.update') }}</b-button>
+      <b-button
+        :disabled="this.vulnsourceEnabled && !this.nvdFeedsUrl"
+        variant="outline-primary"
+        class="px-4"
+        @click="saveChanges">
+          {{ $t('message.update') }}
+      </b-button>
     </b-card-footer>
   </b-card>
 </template>