Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

When running docker scan in a folder containing .jfrog/jfrog-apps-config.yml the wrong folder is passed to JAS scanner #1091

Open
guyshe-jfrog opened this issue Dec 26, 2023 · 0 comments
Labels
bug Something isn't working

Comments

@guyshe-jfrog
Copy link
Contributor

guyshe-jfrog commented Dec 26, 2023

Describe the bug

Stumbled when working on #1035

The file was added here that broke our IDEs working on it: https://github.com/jfrog/jfrog-cli/blob/dev/.jfrog/jfrog-apps-config.yml

The issue is that if you run docker scan in a folder that has .jfrog/jfrog-apps-config.yml the folder is taken to JAS scan and not the docker container.

Current behavior

Take a look at:
https://github.com/jfrog/jfrog-cli-core/blame/dev/xray/commands/audit/jas/common.go#L73

func createJFrogAppsConfig(workingDirs []string) (*jfrogappsconfig.JFrogAppsConfig, error) {
	if jfrogAppsConfig, err := jfrogappsconfig.LoadConfigIfExist(); err != nil {
		return nil, errorutils.CheckError(err)
	} else if jfrogAppsConfig != nil {
		// jfrog-apps-config.yml exist in the workspace
		return jfrogAppsConfig, nil // RETURN WITHOUT TAKING IN TO ACCOUNT workingDirs IN DOCKER SCAN
	}

	// jfrog-apps-config.yml does not exist in the workspace
	fullPathsWorkingDirs, err := coreutils.GetFullPathsWorkingDirs(workingDirs)
	if err != nil {
		return nil, err
	}
	jfrogAppsConfig := new(jfrogappsconfig.JFrogAppsConfig)
	for _, workingDir := range fullPathsWorkingDirs {
		jfrogAppsConfig.Modules = append(jfrogAppsConfig.Modules, jfrogappsconfig.Module{SourceRoot: workingDir})
	}
	return jfrogAppsConfig, nil
}

workingDirs is not taken in to account if the config file exists. In the case of docker scan the current dir is not passed but a docker .tar file.

Reproduction steps

Run jf docker scan [container] in the jfrog-cli project

Expected behavior

The container should be scanned. AKA the yaml file passed should include the docker tar file

JFrog CLI-Core version

dev

JFrog CLI version (if applicable)

dev

Operating system type and version

OS X 14

JFrog Artifactory version

No response

JFrog Xray version

No response

Workaround

Run in a different folder the docker scan

@guyshe-jfrog guyshe-jfrog added the bug Something isn't working label Dec 26, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant