Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Validate xray url #160

Open
wants to merge 3 commits into
base: dev
Choose a base branch
from
Open

Validate xray url #160

wants to merge 3 commits into from
+88 −13

Conversation

hadarshjfrog
Copy link

@hadarshjfrog hadarshjfrog commented Aug 30, 2024 •
edited
Loading

  • The pull request is targeting the dev branch.
  • The code has been validated to compile successfully by running go vet ./....
  • The code has been formatted properly using go fmt ./....
  • All static analysis checks passed.
  • All tests have passed. If this feature is not already covered by the tests, new tests have been added.
  • All changes are detailed at the description. if not already covered at JFrog Documentation, new documentation have been added.

When configuring xray-url only, without the url - the audit command didn't recognize them, and couldn't set JAS scanners:

I keep getting this warning “To include 'Advanced Security' scan as part of the audit output, please run the 'jf c add' command before running this command.“ when running the jf audit.

The command I use to reproduce the issue:
jf c add "test" --xray-url="PLATFORM_URL" --interactive=false --access-token="access-token*****"

I was able to solve it using the following cmd:
jf c add "test" --url="PLATFORM_URL" --interactive=false --access-token="access-token******"

@hadarshjfrog hadarshjfrog added bug Something isn't working safe to test Approve running integration tests on a pull request labels Aug 30, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Aug 30, 2024
@hadarshjfrog hadarshjfrog added the safe to test Approve running integration tests on a pull request label Aug 30, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Aug 30, 2024
@hadarshjfrog hadarshjfrog added the safe to test Approve running integration tests on a pull request label Sep 3, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Sep 3, 2024
@hadarshjfrog hadarshjfrog added the safe to test Approve running integration tests on a pull request label Sep 8, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Sep 8, 2024
@hadarshjfrog hadarshjfrog added the safe to test Approve running integration tests on a pull request label Sep 16, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Sep 16, 2024
@hadarshjfrog hadarshjfrog added the safe to test Approve running integration tests on a pull request label Sep 17, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Sep 17, 2024
@orz25
Copy link
Contributor

orz25 commented Sep 17, 2024 •
edited
Loading

@hadarshjfrog I think it's worth adding a test to audit_test.go - configure a server with Xray URL only and validate we get JAS results

@github-actions GitHub Actions
Copy link

🚨 Frogbot scanned this pull request and found the below:

📦 Vulnerable Dependencies

✍️ Summary

SEVERITY CONTEXTUAL ANALYSIS DIRECT DEPENDENCIES IMPACTED DEPENDENCY FIXED VERSIONS CVES

Unknown		 Not Covered github.com/golang/go:v1.22.3 github.com/golang/go v1.22.3 [1.22.7]
[1.23.1]		 CVE-2024-34155

Unknown		 Not Covered github.com/golang/go:v1.22.3 github.com/golang/go v1.22.3 [1.22.7]
[1.23.1]		 CVE-2024-34158

Unknown		 Not Covered github.com/golang/go:v1.22.3 github.com/golang/go v1.22.3 [1.22.7]
[1.23.1]		 CVE-2024-34156

Critical		 Not Applicable github.com/golang/go:v1.22.3 github.com/golang/go v1.22.3 [1.21.11]
[1.22.4]		 CVE-2024-24790

Medium		 Not Applicable github.com/golang/go:v1.22.3 github.com/golang/go v1.22.3 [1.21.11]
[1.22.4]		 CVE-2024-24789

Unknown		 Not Applicable github.com/golang/go:v1.22.3 github.com/golang/go v1.22.3 [1.21.12]
[1.22.5]		 CVE-2024-24791

🔬 Research Details

[ CVE-2024-34155 ] github.com/golang/go v1.22.3

Description:
Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.

[ CVE-2024-34158 ] github.com/golang/go v1.22.3

Description:
Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.

[ CVE-2024-34156 ] github.com/golang/go v1.22.3

Description:
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.

[ CVE-2024-24790 ] github.com/golang/go v1.22.3

Description:
The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

[ CVE-2024-24789 ] github.com/golang/go v1.22.3

Description:
The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

[ CVE-2024-24791 ] github.com/golang/go v1.22.3

Description:
The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.

@hadarshjfrog hadarshjfrog added the safe to test Approve running integration tests on a pull request label Oct 1, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Oct 1, 2024
orz25
orz25 reviewed Oct 6, 2024
View reviewed changes
audit_test.go
@@ -620,3 +620,37 @@ func TestAuditOnEmptyProject(t *testing.T) {
output := securityTests.PlatformCli.WithoutCredentials().RunCliCmdWithOutput(t, "audit", "--format="+string(format.SimpleJson))
securityTestUtils.VerifySimpleJsonJasResults(t, output, 0, 0, 0, 0, 0, 0, 0, 0, 0)
}

// xray-url only
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you make the comment more informative?

orz25
orz25 reviewed Oct 6, 2024
View reviewed changes
audit_test.go
securityTestUtils.VerifySimpleJsonJasResults(t, output, 0, 0, 0, 0, 0, 0, 0, 0, 0)
}

func getNoJasAuditMockCommandWithXrayUrl() components.Command {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we can use the function getNoJasAuditMockCommand (I don't see any difference)

orz25
orz25 reviewed Oct 6, 2024
View reviewed changes
audit_test.go
}

func TestXrayAuditJasSimpleJsonWithXrayUrl(t *testing.T) {
output := testXrayAuditJas(t, securityTests.PlatformCli, filepath.Join("jas", "jas"), "3", false)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think you should create here a 'cliToRun' object, same in TestXrayAuditNotEntitledForJasWithXrayUrl. Otherwise the test will use the default CLI configured to the integration test

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@orz25 orz25 orz25 left review comments

At least 1 approving review is required to merge this pull request.

Assignees

@eranturgeman eranturgeman

@orz25 orz25

Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@hadarshjfrog @orz25 @eranturgeman