GitLab Issues Tracker gets {"message":"404 Project Not Found"}

[kayvonkhosrowpour]

Problem

I'm getting a 404 Project Not Found error in the GitLab job logs when running the checkmarx scan job on my feature branch. When I set --logging.level.org.springframework.web.client=TRACE and --logging.level.com.checkmarx.flow.custom=TRACE, I find that the gitlab project Id is set to 0.

For my company's security, I redacted the match results and other information.

• For this example, suppose that the project I am running CxFlow on is named MYPROJECT.
• The <some project name #> are actual project names

c.c.f.s.ResultsService     : Issue tracking is custom bean implementation
c.c.f.c.GitLabIssueTracker : Initializing GitLab processing
c.c.f.c.GitLabIssueTracker : Searching repo by query: MYPROJECT
o.s.w.c.RestTemplate       : HTTP GET https://gitlab-master.company.com/api/v4/projects?search=MYPROJECT
o.s.w.c.RestTemplate       : Accept=[text/plain, application/json, application/*+json, */*]
o.s.w.c.RestTemplate       : Response 200 OK
o.s.w.c.RestTemplate       : Reading to [java.lang.String] as "application/json"
c.c.f.c.GitLabIssueTracker : Projects found: 20. Looking for exact match.
c.c.f.c.GitLabIssueTracker : Checking <some project name 1> ... no match.
c.c.f.c.GitLabIssueTracker : Checking <some project name 2> ... no match.
c.c.f.c.GitLabIssueTracker : Checking <some project name 3> ... no match.
c.c.f.c.GitLabIssueTracker : Checking <some project name 4> ... no match.
c.c.f.c.GitLabIssueTracker : Checking <some project name 5> ... no match.
c.c.f.c.GitLabIssueTracker : Checking <some project name 6> ... no match.
c.c.f.c.GitLabIssueTracker : Checking <some project name 7> ... no match.
c.c.f.c.GitLabIssueTracker : Checking <some project name 8> ... no match.
c.c.f.c.GitLabIssueTracker : Checking <some project name 9> ... no match.
c.c.f.c.GitLabIssueTracker : Checking <some project name 10> ... no match.
c.c.f.c.GitLabIssueTracker : Checking <some project name 11> ... no match.
c.c.f.c.GitLabIssueTracker : Checking <some project name 12> ... no match.
c.c.f.c.GitLabIssueTracker : Checking <some project name 13> ... no match.
c.c.f.c.GitLabIssueTracker : Checking <some project name 14> ... no match.
c.c.f.c.GitLabIssueTracker : Checking <some project name 15> ... no match.
c.c.f.c.GitLabIssueTracker : Checking <some project name 16> ... no match.
c.c.f.c.GitLabIssueTracker : Checking <some project name 17> ... no match.
c.c.f.c.GitLabIssueTracker : Checking <some project name 18> ... no match.
c.c.f.c.GitLabIssueTracker : Checking <some project name 19> ... no match.
c.c.f.c.GitLabIssueTracker : Checking <some project name 20> ... no match.
c.c.f.s.CodeBashingService : not using CodeBashing lessons integration - one or more of the mandatory properties is missing
c.c.f.s.IssueService       : Processing Issues with custom bean GitLab
c.c.f.c.GitLabIssueTracker : Executing getIssues GitLab API call
o.s.w.c.RestTemplate       : HTTP GET https://gitlab-master.company.com/api/v4/projects/0/issues?per_page=100
o.s.w.c.RestTemplate       : Accept=[application/json, application/*+json]
o.s.w.c.RestTemplate       : Response 404 NOT_FOUND
c.c.f.CxFlowRunner         : An error occurred while processing request

org.springframework.web.client.HttpClientErrorException$NotFound: 404 Not Found: [{"message":"404 Project Not Found"}]
        at org.springframework.web.client.HttpClientErrorException.create(HttpClientErrorException.java:113)
        at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:184)
        at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:125)
        ...

Details

GitLab Tier: GitLab Enterprise Edition 13.12.4-ee

Checkmarx job and variables:

variables:
    CHECKMARX_DOCKER_IMAGE: "checkmarx/cx-flow"
    CHECKMARX_VERSION: "9.0"
    CHECKMARX_SETTINGS_OVERRIDE: "false"
    CHECKMARX_EXCLUDE_FILES: ""
    CHECKMARX_EXCLUDE_FOLDERS: ""
    CHECKMARX_CONFIGURATION: "Default Configuration"
    CHECKMARX_SCAN_PRESET: "Checkmarx Default"
    CHECKMARX_BASE_URL: "https://checkmarx.company.com"
    CX_FLOW_EXE: "java -jar /app/cx-flow.jar"
    CX_PROJECT: "$CI_PROJECT_NAME"
    CX_FLOW_ENABLED_VULNERABILITY_SCANNERS: sast
    CX_FLOW_BREAK_BUILD: "false"
    CX_FLOW_ZIP_EXCLUDE: "" 
    CX_PARAMS: "" 
    GITLAB_BLOCK_MERGE: "false"
    GITLAB_URL: "https://gitlab-master.company.com"
    GITLAB_API_URL: "${GITLAB_URL}/api/v4"
    GITLAB_TOKEN: "${CHECKMARX_GITLAB_TOKEN}"

checkmarx-scan:
  script:
  - ${CX_FLOW_EXE}
      --scan
      --bug-tracker="GitLab"
      --bug-tracker-impl="GitLab"
      --logging.level.org.springframework.web.client=TRACE
      --logging.level.com.checkmarx.flow.custom=TRACE
      --app="${CI_PROJECT_NAME}" 
      --namespace="${CI_PROJECT_NAMESPACE}" 
      --repo-name="${CI_PROJECT_NAME}" 
      --repo-url="${CI_REPOSITORY_URL}" 
      --cx-team="${CX_TEAM}" 
      --cx-project="${CX_PROJECT}" 
      --branch="${CI_COMMIT_BRANCH}"
      --spring.profiles.active="${CX_FLOW_ENABLED_VULNERABILITY_SCANNERS}" 
      --f=. 
  allow_failure: true

Further Investigation

When I call the below endpoint that was logged, MYPROJECT does appear in the response from the below endpoint, and I get far more than 20 results:

GET https://gitlab-master.company.com/api/v4/projects?search=MYPROJECT&per_page=100

I'm not sure why only the first 20 results are being logged. Perhaps only the first 20 are being processed and that is why MYPROJECT is not being found, and thus the GitLab project ID for MYPROJECT is not being found.

Questions

1. I'm not sure if this is a bug or if there is additional setup?
2. Why are all of the projects being queried to find the corresponding project Id? The environment variable CI_PROJECT_ID is available

[jbrotsos]

I'm slightly confused by the error and output.

Are you saying that Checkmarx can't find the GitLab project? And what variable did you have to override?

Thanks!
James

[kayvonkhosrowpour]

Thank you for responding, James! I updated my initial post, hopefully to make it more clear.

1. Are you saying that Checkmarx can't find the GitLab project?
   Yes. Checkmarx completes the scan, but it seems CxFlow is not able to find the GitLab project. I believe that is why the GitLab project ID is 0.
2. And what variable did you have to override?
   I'm not sure what you mean, I did not override a particular variable.

[jbrotsos]

Ok, I see. This was a manual command to find the project and you did not override:

GET https://gitlab-master.nvidia.com/api/v4/projects?search=MYPROJECT&per_page=100

[kayvonkhosrowpour]

If by command, you mean request, then yes. I made that GET request to find the project and it's there. But I did not override any particular variable other than what you see on the job definition.

[kayvonkhosrowpour]

@jbrotsos Following up to the discussion thus far. I have not yet found a solution to this issue.

Any assistance would be much appreciated 🙏