New sca support v3 #976
New sca support v3 #976
Conversation
kerenr-jfrog
added
safe to test
github-actions
bot
removed
the
safe to test
kerenr-jfrog
added
the
safe to test
github-actions
bot
removed
the
safe to test
kerenr-jfrog
added
the
safe to test
github-actions
bot
removed
the
safe to test
# Conflicts: # go.mod # go.sum # scanpullrequest/scanpullrequest.go # scanrepository/scanrepository.go # utils/params.go
| SetUseWrapper(*sc.UseWrapper). | ||
| SetMaxTreeDepth(sc.MaxPnpmTreeDepth). | ||
| SetDepsRepo(sc.DepsRepo). | ||
| SetIgnoreConfigFile(true). |
There was a problem hiding this comment.
IDW, I can't find any real usage at the Securtiy-CLI
| auditBasicParams := (&audit.AuditBasicParams{}). | ||
| SetXrayVersion(sc.XrayVersion). | ||
| SetXscVersion(sc.XscVersion). | ||
| SetPipRequirementsFile(sc.PipRequirementsFile). |
There was a problem hiding this comment.
this scares me for scan and fix we dont support it on paper but how will our scan adn fix work without it?
isnt it mandatory for pip to work?
@orto17
| func (sc *ScanDetails) RunInstallAndAudit(workDirs ...string) (auditResults *results.SecurityCommandResults) { | ||
| auditBasicParams := (&audit.AuditBasicParams{}). | ||
| SetXrayVersion(sc.XrayVersion). | ||
| SetXscVersion(sc.XscVersion). |
kerenr-jfrog
added
the
safe to test
github-actions
bot
removed
the
safe to test
kerenr-jfrog
requested a deployment
to
frogbot
GitHub Actions
Waiting
kerenr-jfrog
added
the
safe to test
github-actions
bot
removed
the
safe to test
|
📗 Scan Summary
|
1 similar comment
|
📗 Scan Summary
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Cross-Site Scripting (XSS) is a type of vulnerability where malicious Vulnerable examplefunc serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
fmt.Fprintf(w, "<h1>%s</h1>", message)
}In this example, the RemediationTo mitigate Stored XSS vulnerabilities, always sanitize and encode user func serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
- fmt.Fprintf(w, "<h1>%s</h1>", message)
+ fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}In the remediation, we've used the Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Cross-Site Scripting (XSS) is a type of vulnerability where malicious Vulnerable examplefunc serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
fmt.Fprintf(w, "<h1>%s</h1>", message)
}In this example, the RemediationTo mitigate Stored XSS vulnerabilities, always sanitize and encode user func serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
- fmt.Fprintf(w, "<h1>%s</h1>", message)
+ fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}In the remediation, we've used the Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Cross-Site Scripting (XSS) is a type of vulnerability where malicious Vulnerable examplefunc serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
fmt.Fprintf(w, "<h1>%s</h1>", message)
}In this example, the RemediationTo mitigate Stored XSS vulnerabilities, always sanitize and encode user func serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
- fmt.Fprintf(w, "<h1>%s</h1>", message)
+ fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}In the remediation, we've used the Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Cross-Site Scripting (XSS) is a type of vulnerability where malicious Vulnerable examplefunc serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
fmt.Fprintf(w, "<h1>%s</h1>", message)
}In this example, the RemediationTo mitigate Stored XSS vulnerabilities, always sanitize and encode user func serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
- fmt.Fprintf(w, "<h1>%s</h1>", message)
+ fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}In the remediation, we've used the Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Cross-Site Scripting (XSS) is a type of vulnerability where malicious Vulnerable examplefunc serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
fmt.Fprintf(w, "<h1>%s</h1>", message)
}In this example, the RemediationTo mitigate Stored XSS vulnerabilities, always sanitize and encode user func serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
- fmt.Fprintf(w, "<h1>%s</h1>", message)
+ fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}In the remediation, we've used the Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Cross-Site Scripting (XSS) is a type of vulnerability where malicious Vulnerable examplefunc serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
fmt.Fprintf(w, "<h1>%s</h1>", message)
}In this example, the RemediationTo mitigate Stored XSS vulnerabilities, always sanitize and encode user func serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
- fmt.Fprintf(w, "<h1>%s</h1>", message)
+ fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}In the remediation, we've used the Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Cross-Site Scripting (XSS) is a type of vulnerability where malicious Vulnerable examplefunc serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
fmt.Fprintf(w, "<h1>%s</h1>", message)
}In this example, the RemediationTo mitigate Stored XSS vulnerabilities, always sanitize and encode user func serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
- fmt.Fprintf(w, "<h1>%s</h1>", message)
+ fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}In the remediation, we've used the Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Cross-Site Scripting (XSS) is a type of vulnerability where malicious Vulnerable examplefunc serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
fmt.Fprintf(w, "<h1>%s</h1>", message)
}In this example, the RemediationTo mitigate Stored XSS vulnerabilities, always sanitize and encode user func serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
- fmt.Fprintf(w, "<h1>%s</h1>", message)
+ fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}In the remediation, we've used the Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Cross-Site Scripting (XSS) is a type of vulnerability where malicious Vulnerable examplefunc serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
fmt.Fprintf(w, "<h1>%s</h1>", message)
}In this example, the RemediationTo mitigate Stored XSS vulnerabilities, always sanitize and encode user func serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
- fmt.Fprintf(w, "<h1>%s</h1>", message)
+ fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}In the remediation, we've used the Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Cross-Site Scripting (XSS) is a type of vulnerability where malicious Vulnerable examplefunc serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
fmt.Fprintf(w, "<h1>%s</h1>", message)
}In this example, the RemediationTo mitigate Stored XSS vulnerabilities, always sanitize and encode user func serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
- fmt.Fprintf(w, "<h1>%s</h1>", message)
+ fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}In the remediation, we've used the Code FlowsVulnerable data flow analysis result
|
# Conflicts: # scanpullrequest/scanpullrequest.go # scanrepository/scanrepository.go # utils/consts.go # utils/scandetails.go
kerenr-jfrog
requested a deployment
to
frogbot
GitHub Actions
Waiting
kerenr-jfrog
requested a deployment
to
frogbot
GitHub Actions
Waiting
…nd scan repository tests
kerenr-jfrog
requested a deployment
to
frogbot
GitHub Actions
Waiting
4 participants
Uh oh!
There was an error while loading. Please reload this page.