Support all attributes in Central Configs by attiasas · Pull Request #670 · jfrog/jfrog-cli-security

attiasas · 2026-02-12T10:48:02Z

`feat(audit): config-profile scan targets, include/exclude, and xray-lib working dirs`

Depends on:

XRAY-135682 (bug: secrets/CA when multiple roots are passed)
XRAY-138915 (improvement: iac does not support multiple roots)
XSC - Update params in config profile jfrog-client-go#1344

Analyzer-Manager minimum version: 1.33.0

Update AnalyzerManager version to 1.33.0 #748

Summary

Aligns audit, git audit, SCA (Xray-Lib), and JAS scanners with JFrog Platform config profiles: per-target include/exclude patterns, scanner enablement, secret validation, partial results, and custom analyzer download paths. Passes resolved include directories and exclusions into Xray-Lib instead of global ignore patterns, and refactors scan execution around an enriched ScanTarget model.

Changes

Audit / scan orchestration (commands/audit/, commands/scan/, commands/git/audit/): target discovery via GetTargetsInfo; populate ScanTarget with include/exclude and central-config modules; honor config-profile scanner toggles and allow_partial_results; wire custom releases repo for Xray-Lib plugin download.
Xray-Lib BOM (sca/bom/xrayplugin/): pass IncludeDirs and per-target SCA exclusions to the plugin; remove WithTotalTargets / WithIgnorePatterns; support WithCentralRemoteReleasesDetails for profile-driven dependency downloads.
JAS scanners (jas/, jas/runner/): run against results.ScanTarget (include roots, profile exclusions); consolidate config-profile skip logic; fix SARIF invocation working directory to reflect scan target, not analyzer-manager temp dir; per-target secret validation via IsSecretValidationActive.
Results model (utils/results/): ScanTarget gains Include, Exclude, Technologies[], CentralConfigModules; skippable GeneralErrors / TargetErrors for partial results; helpers for central-config scan requests and exclusions; expanded unit tests.
Path / exclusion utilities (utils/paths.go, utils/techutils.go): pattern handling for include/exclude during recursive scans.
Git audit (commands/git/audit/): fetch config profile by clone URL; hidden --use-config-profile flag (default true); validate single-module profile constraints.
CLI (cli/docs/flags.go, cli/gitcommands.go): expose WorkingDirs on audit; add hidden use-config-profile.
Output / parsers (utils/results/conversion/, utils/results/output/): adapt to multi-technology targets and updated error shapes.
Dependencies (go.mod, go.sum): bump jfrog-client-go and jfrog-cli-artifactory.

Notes

Behavioral / API shifts: single Technology on ScanTarget replaced by Technologies[]; GeneralError replaced by GeneralErrors (SkippableError); JAS ScannerCmd adds target-based Run with DeprecatedRun for legacy jfrog-apps-config modules.
Git audit config profile is limited to one module with path_from_root: "." (enforced in verifyConfigProfile).
In the new flow, jfrog-apps-config.yml is deprecated – flags, env vars, or central JFrog Platform config should be used instead.
The old graph-based flow is untouched and still loads jfrog-apps-config as before.

…config in new flow

eranturgeman · 2026-05-07T13:45:03Z

 		relative := utils.GetRelativePath(potential.Target, sourceBasePath)
 		log.Debug(fmt.Sprintf("Comparing target %s, relative: '%s'", potential.String(), relative))
-		if technology != techutils.NoTech && potential.Technology != technology {
+		if len(technologies) > 0 && !utils.ElementsEqual[techutils.Technology](potential.Technologies, technologies) {


maybe not something we want to address but maybe worth noting- if a new tech is added in a PR (new module or something) we will find no match. this is a edge case but maybe worth a comment

eranturgeman · 2026-05-10T07:16:44Z

 		log.Debug(fmt.Sprintf("%sSkipping SCA for %s as requested by input...", logPrefix, params.ScanResults.Target))
 		return false, nil
 	}
+	if params.ScanResults == nil {


I see this check existed before, but I dont think it is really a possible usecase. we can leave it for safety though

eranturgeman · 2026-05-10T08:02:41Z

 }
+
+func TestPrepareSimpleJsonVulnerabilities_Technology(t *testing.T) {
+	testCases := []struct {


maybe add another testcase with multi-rows and different technologies?

eranturgeman

LGTM! see my comments

github-actions · 2026-05-17T10:38:26Z

📗 Scan Summary

Frogbot scanned for vulnerabilities and found 1 issues

Scan Category	Status	Security Issues
Software Composition Analysis	✅ Done	Not Found
Contextual Analysis	✅ Done	-
Static Application Security Testing (SAST)	✅ Done	1 Issues Found 1 Low
Secrets	✅ Done	-
Infrastructure as Code (IaC)	✅ Done	Not Found

🐸 JFrog Frogbot

github-actions · 2026-05-17T10:38:27Z

os.ReadFile(strings.TrimSpace(path))

at sca/bom/buildinfo/technologies/java/deptreemanager.go (line 109)

🎯 Static Application Security Testing (SAST) Vulnerability

Severity	Finding
Low	Untrusted stored input used in file paths, allowing access to unintended files.

Full description

Vulnerability Details


Rule ID:	go-stored-path-traversal

Overview

Stored Path Traversal is a type of vulnerability that arises when user-controlled
input, such as file names or paths, is stored by the application and later used
without proper validation or sanitization to perform file operations. This can
allow an attacker to traverse directories and access or overwrite sensitive files
on the filesystem, potentially compromising the security and integrity of the
application or system.

Vulnerable example

func serveFile(w http.ResponseWriter, r *http.Request) {
    row := db.QueryRow("SELECT file_path FROM files WHERE id = 12")
    row.Scan(&filePath)
    http.ServeFile(w, r, filePath)
}

In this example, the serveFile function serves a file based on the file query
parameter provided by the user. However, in a real-world scenario, the filePath
variable might be retrieved from a stored source, such as a database or configuration
file, instead of being directly obtained from the request URL. The vulnerability
arises if the stored filePath is not properly validated or sanitized before being
used to serve files. Attackers could manipulate the stored filePath to perform
directory traversal attacks, potentially accessing sensitive files outside the
intended directory structure.

Remediation

To mitigate stored path traversal vulnerabilities, it is essential to validate
and sanitize user-controlled input before using it to construct file paths or
perform file operations. In this example, we can validate the file name to ensure
it does not contain directory traversal sequences before serving the file.

func serveFile(w http.ResponseWriter, r *http.Request) {
    row := db.QueryRow("SELECT file_path FROM files WHERE id = ?", r.URL.Query().Get("id"))
    row.Scan(&filePath)
+    // Validate file path to prevent directory traversal
+    if strings.Contains(filePath, "..") {
+        http.Error(w, "Invalid file path", http.StatusBadRequest)
+        return
+    }
    http.ServeFile(w, r, filePath)
}

Code Flows

Vulnerable data flow analysis result

↘️ os.ReadFile(outputFilePath) (at sca/bom/buildinfo/technologies/java/gradle.go line 187)

↘️ outputFileContent (at sca/bom/buildinfo/technologies/java/gradle.go line 187)

↘️ `func (gdt *gradleDepTreeManager) execGradleDepTree(depTreeDir string) (outputFileContent []byte, err error) {

gradleExecPath, err := build.GetGradleExecPath(gdt.useWrapper)
if err != nil {
	err = errorutils.CheckError(err)
	return
}
outputFilePath := filepath.Join(depTreeDir, gradleDepTreeOutputFile)
tasks := []string{
	"clean",
	"generateDepTrees", "-I", filepath.Join(depTreeDir, gradleDepTreeInitFile),
	"-q",
	gradleNoCacheFlag,
	fmt.Sprintf("-Dcom.jfrog.depsTreeOutputFile=%s", outputFilePath),
	"-Dcom.jfrog.includeAllBuildFiles=true",
	fmt.Sprintf("-Dcom.jfrog.includeIncludedBuilds=%t", gdt.useIncludedBuilds)}

// Add curation audit mode for pass-through functionality if this is a curation command
if gdt.isCurationCmd {
	tasks = append(tasks, "-Dcom.jfrog.curationAuditMode=true")
}

if output, err := buildGradleExecCommand(gradleExecPath, gdt.useWrapper, tasks).CombinedOutput(); err != nil {
	return nil, errorutils.CheckErrorf("error running gradle-dep-tree: %s\n%s", err.Error(), string(output))
}
defer func() {
	err = errors.Join(err, errorutils.CheckError(os.Remove(outputFilePath)))
}()
outputFileContent, err = os.ReadFile(outputFilePath)
err = errorutils.CheckError(err)
return

}` (at sca/bom/buildinfo/technologies/java/gradle.go line 159)

↘️ (outputFileContent []byte, err error) (at sca/bom/buildinfo/technologies/java/gradle.go line 159)

↘️ gdt.execGradleDepTree(depTreeDir) (at sca/bom/buildinfo/technologies/java/gradle.go line 96)

↘️ output (at sca/bom/buildinfo/technologies/java/gradle.go line 96)

↘️ output (at sca/bom/buildinfo/technologies/java/gradle.go line 100)

↘️ string(output) (at sca/bom/buildinfo/technologies/java/gradle.go line 100)

↘️ return string(output), nil (at sca/bom/buildinfo/technologies/java/gradle.go line 100)

↘️ (string, error) (at sca/bom/buildinfo/technologies/java/gradle.go line 79)

↘️ manager.runGradleDepTree() (at sca/bom/buildinfo/technologies/java/deptreemanager_test.go line 57)

↘️ outputFileContent (at sca/bom/buildinfo/technologies/java/deptreemanager_test.go line 57)

↘️ outputFileContent (at sca/bom/buildinfo/technologies/java/deptreemanager_test.go line 59)

↘️ outputFilePaths (at sca/bom/buildinfo/technologies/java/deptreemanager.go line 56)

↘️ outputFilePaths (at sca/bom/buildinfo/technologies/java/deptreemanager.go line 57)

↘️ jsonFilePaths (at sca/bom/buildinfo/technologies/java/deptreemanager.go line 95)

↘️ jsonFilePaths (at sca/bom/buildinfo/technologies/java/deptreemanager.go line 96)

↘️ strings.TrimSpace(jsonFilePaths) (at sca/bom/buildinfo/technologies/java/deptreemanager.go line 96)

↘️ strings.Split(strings.TrimSpace(jsonFilePaths), "\n") (at sca/bom/buildinfo/technologies/java/deptreemanager.go line 96)

↘️ outputFilePaths (at sca/bom/buildinfo/technologies/java/deptreemanager.go line 98)

↘️ path (at sca/bom/buildinfo/technologies/java/deptreemanager.go line 98)

↘️ path (at sca/bom/buildinfo/technologies/java/deptreemanager.go line 99)

↘️ path (at sca/bom/buildinfo/technologies/java/deptreemanager.go line 108)

↘️ path (at sca/bom/buildinfo/technologies/java/deptreemanager.go line 109)

↘️ strings.TrimSpace(path) (at sca/bom/buildinfo/technologies/java/deptreemanager.go line 109)

↘️ os.ReadFile(strings.TrimSpace(path)) (at sca/bom/buildinfo/technologies/java/deptreemanager.go line 109)

🐸 JFrog Frogbot

add IncludeDirs option to Xray Bom Lib

32dc1fb

attiasas added the ignore for release Automatically generated release notes label Feb 12, 2026

attiasas had a problem deploying to frogbot February 12, 2026 10:48 — with GitHub Actions Failure

attiasas added 2 commits February 12, 2026 16:22

prepare to pass working dirs

1a1a659

format

26955ad

attiasas had a problem deploying to frogbot February 12, 2026 14:22 — with GitHub Actions Failure

use isSingleTarget, start deprecate old JAS interface to remove apps-…

b004474

…config in new flow

attiasas had a problem deploying to frogbot February 12, 2026 15:52 — with GitHub Actions Failure

Merge remote-tracking branch 'upstream/dev' into pass_wd_to_xray_lib

c33f179

attiasas had a problem deploying to frogbot February 12, 2026 15:53 — with GitHub Actions Failure

attiasas added the safe to test Approve running integration tests on a pull request label Feb 12, 2026

github-actions Bot removed the safe to test Approve running integration tests on a pull request label Feb 12, 2026

attiasas added 4 commits February 13, 2026 01:53

deprecate JAS apps config module, use scan target

d641985

new scan target detection logic

12005ea

start impl new flow in Secrets

abc25bb

update xray lib to 0.0.3-47

5fb9622

attiasas had a problem deploying to frogbot February 16, 2026 11:10 — with GitHub Actions Failure

attiasas added 3 commits February 16, 2026 13:25

fix tests

1bff793

Merge remote-tracking branch 'upstream/dev' into pass_wd_to_xray_lib

1d4fd00

fix static tests

8eac512

attiasas had a problem deploying to frogbot February 17, 2026 10:01 — with GitHub Actions Failure

attiasas added the safe to test Approve running integration tests on a pull request label Feb 17, 2026

github-actions Bot removed the safe to test Approve running integration tests on a pull request label Feb 17, 2026

Merge remote-tracking branch 'upstream/dev' into pass_wd_to_xray_lib

1ec4aeb

attiasas had a problem deploying to frogbot February 17, 2026 13:04 — with GitHub Actions Failure

Fix target creation and JAS results parsing

4711afb

attiasas had a problem deploying to frogbot February 19, 2026 11:22 — with GitHub Actions Failure

pass target to applicable, fix invocations

d0f5aed

attiasas had a problem deploying to frogbot February 19, 2026 13:17 — with GitHub Actions Failure

attiasas added the safe to test Approve running integration tests on a pull request label Feb 19, 2026