Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security Violations and License Compliance Violations table not displaying in console output #178

Open
lweitzel01 opened this issue Sep 13, 2024 · 3 comments
Labels
bug Something isn't working

Comments

@lweitzel01
Copy link

Describe the bug

After upgrading from jf cli 2.63.2 to 2.67.0, the jf build-scan is no longer displaying the Security Violations and License Compliance Violations table in the console output

Current behavior

Current behavior when running jf build-scan with version 2.67.0:

13:07:29 [Info] Scan of build ### is in progress
13:07:29 [Info] Waiting for Build Scan to complete...
13:07:30 [Info] The scan data is available at: https://###
The full scan results are available here: .jfrog\jfrog.cli.temp.-1726250850-2443012921

13:07:30 [Info] Trace ID for JFrog Platform logs: f2b9a375525fbbac
13:07:30 [Error] One or more of the violations found are set to fail builds that include them

The old behavior with 2.63.2
13:07:17 [Info] Scan of build ### is in progress
13:07:18 [Info] Waiting for Build Scan to complete...
13:07:28 [Info] The scan data is available at: https://###
The full scan results are available here: .jfrog\jfrog.cli.temp.-1726250848-220682823

Security Violations
┌──────────┬───────────────────────────┬─────────┬───────────────────────────┬──────────┬──────────┬───────┬────────────────┐
│ SEVERITY │ DIRECT │ DIRECT │ IMPACTED │ IMPACTED │ FIXED │ TYPE │ CVE │
│ │ PACKAGE │ PACKAGE │ PACKAGE │ PACKAGE │ VERSIONS │ │ │
│ │ │ VERSION │ NAME │ VERSION │ │ │ │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼──────────┼──────────┼───────┼────────────────┤
│ Critical │ jpetstore-1.06-20240913.1 │ │ com.thoughtworks.xstream: │ 1.3.1 │ [1.4.16] │ Maven │ CVE-2021-21345
│ │ 80712-1.war │ │ xstream │ │ │ │ │
│ │ │ │ │ │ │ │ │
└──────────┴───────────────────────────┴─────────┴───────────────────────────┴──────────┴──────────┴───────┴────────────────┘
License Compliance Violations
+---------------------------------------------+
| No license compliance violations were found |
+---------------------------------------------+
13:07:28 [Info] Trace ID for JFrog Platform logs: 6099fde7470bdc3c
13:07:28 [Error] One or more of the violations found are set to fail builds that include them

Reproduction steps

Upload artifact to artifactory and run jf build-scan to wait for scan to complete

Expected behavior

Expected Security Violations and License Compliance Violations table to display indicating violations to user

JFrog CLI-Security version

??

JFrog CLI version (if applicable)

2.67.0

Operating system type and version

Windows 2019

JFrog Xray version

3.102.3

@lweitzel01 lweitzel01 added the bug Something isn't working label Sep 13, 2024
@attiasas
Copy link
Contributor

Hi @lweitzel01, thank you for reporting this issue.
We are aware of this bug and it should be resolved soon (Fix handled here: #172)
Thank you!

@lweitzel01
Copy link
Author

lweitzel01 commented Oct 21, 2024

It appears the new jf CLI 2.71 does now display the table. However, the table is now showing extra special characters that are throwing the cells out of alignment and making it hard to read.

Here is the table from the old version of jf:
Security Violations
┌──────────┬───────────────────────────┬─────────┬───────────────────────────┬──────────┬──────────┬───────┬────────────────┐
│ SEVERITY │ DIRECT │ DIRECT │ IMPACTED │ IMPACTED │ FIXED │ TYPE │ CVE │
│ │ PACKAGE │ PACKAGE │ PACKAGE │ PACKAGE │ VERSIONS │ │ │
│ │ │ VERSION │ NAME │ VERSION │ │ │ │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼──────────┼──────────┼───────┼────────────────┤
│ Critical │ jpetstore-1.06-20241018.1 │ │ com.thoughtworks.xstream: │ 1.3.1 │ [1.4.16] │ Maven │ CVE-2021-21345 │
│ │ 53626-1.war │ │ xstream │ │ │ │ │
│ │ │ │ │ │ │ │ │
└──────────┴───────────────────────────┴─────────┴───────────────────────────┴──────────┴──────────┴───────┴────────────────┘

AND here is the new table with version 2.71

Security Violations
┌────────────┬───────────────────────────┬────────────┬───────────────────────────┬────────────┬──────────┬───────┬────────────────┐
│ SEVERITY │ DIRECT │ DIRECT │ IMPACTED │ IMPACTED │ FIXED │ TYPE │ CVE │
│ │ DEPENDENCY │ DEPENDENCY │ DEPENDENCY │ DEPENDENCY │ VERSIONS │ │ │
│ │ │ VERSION │ NAME │ VERSION │ │ │ │
├────────────┼───────────────────────────┼────────────┼───────────────────────────┼────────────┼──────────┼───────┼────────────────┤
│ �[101;97m💀Critical�[0m │ jpetstore-1.06-20241018.1 │ │ com.thoughtworks.xstream: │ 1.3.1 │ [1.4.16] │ Maven │ CVE-2021-21345 │
│ │ 53626-1.war │ │ xstream │ │ │ │ │
│ │ │ │ │ │ │ │ │
└────────────┴───────────────────────────┴────────────┴───────────────────────────┴────────────┴──────────┴───────┴────────────────┘

@lweitzel01
Copy link
Author

Is there any update on this or a way to turn off the ANSI colorization in the output of these tables?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants