PR - 2026-06-23 by cx-happy-yang · Pull Request #206 · checkmarx-ts/checkmarx-python-sdk

cx-happy-yang · 2026-06-23T06:24:00Z

Fix SSL context creation for self-signed CA certificates

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

- sastQueriesAPI: add scan_id/tenant_id to get_sast_query_description - sastResultsPredicatesAPI: add offset/limit to get_all_predicates_for_similarity_id - api_client: enable follow_redirects on httpx.Client for S3-based file retrieval Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

- update_project_preset: batch-update SAST preset for API projects from CSV - trigger_scm_project_scans_on_main_branch: trigger scans on main branch for SCM-integrated projects via repos-manager endpoint - export_sast_state_counts: export SAST state counts per project as CSV - export_sast_state_by_query: export SAST results by project, query, severity, language, and state for FP-rate analysis - get_project_sast_exclusions: get/update SAST recommended exclusions - get_audit_events: retrieve audit events Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

- Add PredicateInitialValues, PredicateHistoryResponse DTOs - Add from_dict to CommentJSON, PredicateWithCommentJSON, PredicateHistory - Update SastResultsPredicatesAPI to return typed PredicateHistoryResponse - Add offset/limit params to get_all_predicates_for_similarity_id Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

- triage_workflow.py: guided 9-step triage for SAST findings - Add *.har to .gitignore Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Work around server-side issue where /cxrestapi/sast/results returns duplicate data on the last page. Add diagnostic tests to detect the bug. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

The server-side pagination bug in /cxrestapi/sast/results occurs when limit exceeds the number of remaining results — the last page wraps around and returns earlier data instead of the actual trailing results. Instead of always using the full page size, compute remaining = total_count - offset and use min(limit, remaining) as the actual limit for each request after the first. This ensures the final request asks for exactly the right number of results, avoiding the server boundary condition. Dedup is kept as an additional safety net. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

…esults The CxSAST /cxrestapi/sast/results endpoint interprets the 'offset' parameter as a page number (records skipped = offset * limit), not as a record count. The previous implementation incremented offset by the page size each iteration, causing it to skip most results. Increment offset by 1 per page instead, and keep path_id dedup as a safety net. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

The operation exists in the WSDL but CxSAST 9.x returns "This action is no longer supported." Use CxAuditWebService's get_source_code_for_scan as the replacement. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

GetSourceByScanID (singular) is deprecated in CxSAST 9.x, but the plural GetSourcesByScanID returns per-file source content for requested file paths. GetFileNamesForPath returns file names associated with a path_id. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Portal SOAP (40 new methods): get_preset_details, update_preset, get_result_state_list, get_scan_report, get_scan_report_status, cancel_scan_report, get_results, get_result_summary, get_query_collection_for_language, get_query_description, get_query_short_description, get_scans_display_data_for_all_projects, get_scan_summary, get_server_license_basic, get_server_license_data_extended, get_custom_fields, get_custom_field_values, get_result_paths_for_query, get_results_for_query, get_queries_for_scan, get_scan_properties, get_status_of_single_scan, get_scans_statuses, get_scan_logs, update_result_state, update_result_comment, update_scan_comment, is_valid_preset_name, get_server_language_list, get_executable_list, count_lines, is_alive, is_smtp_host_configured, is_private_cloud, get_cwe_description, get_result_state_flags, cancel_scan, delete_scan, delete_scans, get_child_nodes, get_projects_with_scans, get_configuration_set_list Audit SOAP (24 new methods): get_results, get_result_summary, get_result_state_list, update_result_state, update_scan_comment, get_project_scans, get_projects_with_scans, get_query_collection, get_query_collection_for_language, get_query_description, get_query_description_by_query_id, get_queries_categories, get_preset_details, get_preset_list, get_path_comments_history, get_project_configuration, get_license_details, get_engine_configuration, get_hierarchy_group_tree, get_ancestry_group_tree, keep_alive, import_queries, get_cache All methods include module-level convenience functions, __init__.py exports, and pytest tests (55 Portal + 20 Audit = 75 tests passing). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

…rt_sast_state_counts Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

…st.md Convert CxSAST_and_CxOSA_REST_API_List.md, CxSAST_Portal_SOAP_API_List.md, and CxSAST_ODATA_API.md to consistent markdown table format with columns for class, method, HTTP/query pattern, and endpoint path. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

…mber - Replace `item["status"]["id"] == 2` with status name extraction via `status.get("value")`, returning "Started"/"Completed"/"Failed" strings - Handle both dict and plain-string status formats from the API - Add proper docstring with known status values - Update test to create a real branch, poll, and display all statuses - Update CxCliPy.py to use latest SDK OData API and add --branch_project support Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

…n Windows Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

…cConstraints ssl.create_default_context() enables VERIFY_X509_STRICT, which requires certificates loaded as CAs to have the BasicConstraints:CA:TRUE extension. Self-signed server certs (like IIS self-signed certs) typically lack this, causing "invalid CA certificate" errors. Switch to ssl.SSLContext with PROTOCOL_TLS_CLIENT (matching urllib3's approach), which does not enforce this strict check. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

github-actions · 2026-06-23T06:28:33Z

Checkmarx One – Scan Summary & Details – fa0a5644-89ad-4dd3-8ab3-faec816d0dfe

Great job! No new security vulnerabilities introduced in this pull request

cx-james-bostock

Hi @cx-happy-yang,
These changes look fine to me.

cx-happy-yang and others added 26 commits June 5, 2026 07:51

Remove presetManagerAPI and update .gitignore

ee690b5

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Rename SastPresetManagerAPI to PresetManagerAPI

6bda300

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Rename sast_ prefix to scanner_ in PresetManagerAPI

ba4d7dd

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Rename test_sast_preset_manager_api to test_preset_manager_api

d4b5b27

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Add triage workflow script and ignore HAR files

b40b100

- triage_workflow.py: guided 9-step triage for SAST findings - Add *.har to .gitignore Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Add get_all_scan_results helper with dedup for SAST pagination bug

e8d226c

Work around server-side issue where /cxrestapi/sast/results returns duplicate data on the last page. Add diagnostic tests to detect the bug. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

gitignore

305e82e

Add dump_all_path_ids diagnostic script using get_all_scan_results

44ffa66

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Move dump_all_path_ids.py from scripts/ to examples/CxSAST/

22a6076

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Bump version to 1.8.8 and update changelog

80d1949

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Add get_source_by_scan_id to Portal SOAP API (deprecated)

bfb7a66

The operation exists in the WSDL but CxSAST 9.x returns "This action is no longer supported." Use CxAuditWebService's get_source_code_for_scan as the replacement. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Update changelog for 1.8.8 Portal SOAP additions

1debae0

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Update CxOne examples: modify export_sast_state_by_query, remove expo…

6924ab3

…rt_sast_state_counts Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Update changelog for get_branch_project_status fix and CxCliPy.py

356e848

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Fix api_client Content-Type header for file uploads and zip cleanup o…

41fa6ec

…n Windows Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Remove examples/CxSAST/CxCliPy.py (moved to dedicated repo)

d7c5bf9

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

cx-happy-yang requested a review from cx-james-bostock June 23, 2026 06:32

cx-james-bostock approved these changes Jun 23, 2026

View reviewed changes

cx-happy-yang merged commit 1e0b0d8 into master Jun 23, 2026
8 of 9 checks passed

cx-happy-yang deleted the dev branch June 23, 2026 07:06

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

PR - 2026-06-23#206

PR - 2026-06-23#206
cx-happy-yang merged 26 commits into
masterfrom
dev

cx-happy-yang commented Jun 23, 2026

Uh oh!

github-actions Bot commented Jun 23, 2026

Uh oh!

cx-james-bostock left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

cx-happy-yang commented Jun 23, 2026

Uh oh!

github-actions Bot commented Jun 23, 2026

Great job! No new security vulnerabilities introduced in this pull request

Uh oh!

cx-james-bostock left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants