jfrog / jfrog/jfrog-cli-security
jf ver 2.71 Security Violations table not displaying correctly for ANSI colorized output
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Describe the bug
After upgrading from jf cli 2.63.2 to 2.71.0, the jf build-scan is no longer displaying the Security Violations and License Compliance Violations table in the console output
Current behavior
The Security Violations table is now showing extra special characters that are throwing the cells out of alignment and making it hard to read.
Here is the table from the old version of jf:
Security Violations
┌──────────┬───────────────────────────┬─────────┬───────────────────────────┬──────────┬──────────┬───────┬────────────────┐
│ SEVERITY │ DIRECT │ DIRECT │ IMPACTED │ IMPACTED │ FIXED │ TYPE │ CVE │
│ │ PACKAGE │ PACKAGE │ PACKAGE │ PACKAGE │ VERSIONS │ │ │
│ │ │ VERSION │ NAME │ VERSION │ │ │ │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼──────────┼──────────┼───────┼────────────────┤
│ Critical │ jpetstore-1.06-20241018.1 │ │ com.thoughtworks.xstream: │ 1.3.1 │ [1.4.16] │ Maven │ CVE-2021-21345 │
│ │ 53626-1.war │ │ xstream │ │ │ │ │
│ │ │ │ │ │ │ │ │
└──────────┴───────────────────────────┴─────────┴───────────────────────────┴──────────┴──────────┴───────┴────────────────┘
AND here is the new table with version 2.71
Security Violations
┌────────────┬───────────────────────────┬────────────┬───────────────────────────┬────────────┬──────────┬───────┬────────────────┐
│ SEVERITY │ DIRECT │ DIRECT │ IMPACTED │ IMPACTED │ FIXED │ TYPE │ CVE │
│ │ DEPENDENCY │ DEPENDENCY │ DEPENDENCY │ DEPENDENCY │ VERSIONS │ │ │
│ │ │ VERSION │ NAME │ VERSION │ │ │ │
├────────────┼───────────────────────────┼────────────┼───────────────────────────┼────────────┼──────────┼───────┼────────────────┤
│ [101;97m💀Critical[0m │ jpetstore-1.06-20241018.1 │ │ com.thoughtworks.xstream: │ 1.3.1 │ [1.4.16] │ Maven │ CVE-2021-21345 │
│ │ 53626-1.war │ │ xstream │ │ │ │ │
│ │ │ │ │ │ │ │ │
└────────────┴───────────────────────────┴────────────┴───────────────────────────┴────────────┴──────────┴───────┴────────────────┘
Reproduction steps
Upload artifact to artifactory and run jf build-scan to wait for scan to complete
Expected behavior
Expected Security Violations and License Compliance Violations table to display indicating violations to user
JFrog CLI-Security version
??
JFrog CLI version (if applicable)
2.71.0
Operating system type and version
Windows 2019
JFrog Xray version
3.102.3
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the jf build-scan console output path for Security Violations and License Compliance Violations, reproducing it on Windows 2019 with CLI 2.71.0. Trace how ANSI color codes and the 💀Critical label are passed into table rendering; done means both tables remain aligned and readable while displaying the violation styling.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100