jfrog / jfrog/jfrog-cli-security
Jfrog scan does not detect license written in a java file
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Hello,
We're trying to scan a java license written in a java file using the xray analysis features.
To do this, we use jfrog cli for the maven build and for scan.
To Reproduce
jfrog config add <serverIdName> --artifactory-url=https://<artifactoryName>/artifactory --user=<user_from_access_token> --access-token=<token> --enc-password
jfrog rt mvnc --server-id-resolve <serverIdName> --repo-resolve-releases maven --repo-resolve-snapshots maven
jfrog rt bp --server-id <serverIdName> --build-url <buildUrl>
jfrog scan --server-id <serverIdName> --format=json --licenses=true **/**.jar > xray_result.json
Here are the example of a java file containing a license:
/*-
* #%L
* attribution_licence
* %%
* Copyright (C) 2022 TEST
* %%
* Redistribution and use in source and binary forms, with or without modification,
* are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice, this
* list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
*
* 3. Neither the name of the TEST nor the names of its contributors
* may be used to endorse or promote products derived from this software without
* specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
* IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
* OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* #L%
*/
package org.continuous_security;
import org.apache.commons.fileupload.MultipartStream;
import java.io.ByteArrayInputStream;
import java.io.IOException;
public class Main {
public static void main(String[] args) {
byte[] bytes = new byte[256];
try {
new MultipartStream(new ByteArrayInputStream(bytes), bytes);
} catch (IOException ignored) {
}
System.out.println("Program completed.");
}
}
The result of the Xray scan of the java file shows that no license was found.
Is it normal for the Xray scan not to detect license inside a Java file ?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the Maven build and jfrog scan commands from the issue using the provided Java source, then inspect xray_result.json for license results. Compare the scan output with the license comment shown in the example; done means determining whether Java-file licenses are supported and documenting or isolating the missing detection behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100