jfrog / jfrog/jfrog-cli-security

Jfrog scan does not detect license written in a java file

Open
#115 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

question
Dominant language
Go
Stars
13
Forks
50
Avg merge
3d 48m
Merged PRs (30d)
26

Description

Hello,

We're trying to scan a java license written in a java file using the xray analysis features.
To do this, we use jfrog cli for the maven build and for scan.

To Reproduce

jfrog config add <serverIdName> --artifactory-url=https://<artifactoryName>/artifactory --user=<user_from_access_token> --access-token=<token> --enc-password
jfrog rt mvnc --server-id-resolve <serverIdName> --repo-resolve-releases maven --repo-resolve-snapshots maven
jfrog rt bp --server-id <serverIdName> --build-url <buildUrl>

jfrog scan --server-id <serverIdName> --format=json --licenses=true  **/**.jar  > xray_result.json
Here are the example of a java file containing a license:
/*-
 * #%L
 * attribution_licence
 * %%
 * Copyright (C) 2022 TEST
 * %%
 * Redistribution and use in source and binary forms, with or without modification,
 * are permitted provided that the following conditions are met:
 * 
 * 1. Redistributions of source code must retain the above copyright notice, this
 *    list of conditions and the following disclaimer.
 * 
 * 2. Redistributions in binary form must reproduce the above copyright notice,
 *    this list of conditions and the following disclaimer in the documentation
 *    and/or other materials provided with the distribution.
 * 
 * 3. Neither the name of the TEST nor the names of its contributors
 *    may be used to endorse or promote products derived from this software without
 *    specific prior written permission.
 * 
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
 * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 * #L%
 */
package org.continuous_security;


import org.apache.commons.fileupload.MultipartStream;

import java.io.ByteArrayInputStream;
import java.io.IOException;

public class Main {

    public static void main(String[] args) {
        byte[] bytes = new byte[256];
        try {
            new MultipartStream(new ByteArrayInputStream(bytes), bytes);
        } catch (IOException ignored) {
        }
        System.out.println("Program completed.");
    }
}

The result of the Xray scan of the java file shows that no license was found.

Is it normal for the Xray scan not to detect license inside a Java file ?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the Maven build and jfrog scan commands from the issue using the provided Java source, then inspect xray_result.json for license results. Compare the scan output with the license comment shown in the example; done means determining whether Java-file licenses are supported and documenting or isolating the missing detection behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.