jfrog / jfrog/jfrog-cli-security

jf ver 2.71 Security Violations table not displaying correctly for ANSI colorized output

Open
#224 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
13
Forks
50
Avg merge
3d 48m
Merged PRs (30d)
26

Description

Describe the bug

After upgrading from jf cli 2.63.2 to 2.71.0, the jf build-scan is no longer displaying the Security Violations and License Compliance Violations table in the console output

Current behavior

The Security Violations table is now showing extra special characters that are throwing the cells out of alignment and making it hard to read.

Here is the table from the old version of jf:
Security Violations
┌──────────┬───────────────────────────┬─────────┬───────────────────────────┬──────────┬──────────┬───────┬────────────────┐
│ SEVERITY │ DIRECT │ DIRECT │ IMPACTED │ IMPACTED │ FIXED │ TYPE │ CVE │
│ │ PACKAGE │ PACKAGE │ PACKAGE │ PACKAGE │ VERSIONS │ │ │
│ │ │ VERSION │ NAME │ VERSION │ │ │ │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼──────────┼──────────┼───────┼────────────────┤
│ Critical │ jpetstore-1.06-20241018.1 │ │ com.thoughtworks.xstream: │ 1.3.1 │ [1.4.16] │ Maven │ CVE-2021-21345 │
│ │ 53626-1.war │ │ xstream │ │ │ │ │
│ │ │ │ │ │ │ │ │
└──────────┴───────────────────────────┴─────────┴───────────────────────────┴──────────┴──────────┴───────┴────────────────┘

AND here is the new table with version 2.71

Security Violations
┌────────────┬───────────────────────────┬────────────┬───────────────────────────┬────────────┬──────────┬───────┬────────────────┐
│ SEVERITY │ DIRECT │ DIRECT │ IMPACTED │ IMPACTED │ FIXED │ TYPE │ CVE │
│ │ DEPENDENCY │ DEPENDENCY │ DEPENDENCY │ DEPENDENCY │ VERSIONS │ │ │
│ │ │ VERSION │ NAME │ VERSION │ │ │ │
├────────────┼───────────────────────────┼────────────┼───────────────────────────┼────────────┼──────────┼───────┼────────────────┤
│ 💀Critical │ jpetstore-1.06-20241018.1 │ │ com.thoughtworks.xstream: │ 1.3.1 │ [1.4.16] │ Maven │ CVE-2021-21345 │
│ │ 53626-1.war │ │ xstream │ │ │ │ │
│ │ │ │ │ │ │ │ │
└────────────┴───────────────────────────┴────────────┴───────────────────────────┴────────────┴──────────┴───────┴────────────────┘

Reproduction steps

Upload artifact to artifactory and run jf build-scan to wait for scan to complete

Expected behavior

Expected Security Violations and License Compliance Violations table to display indicating violations to user

JFrog CLI-Security version

??

JFrog CLI version (if applicable)

2.71.0

Operating system type and version

Windows 2019

JFrog Xray version

3.102.3

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the jf build-scan console output path for Security Violations and License Compliance Violations, reproducing it on Windows 2019 with CLI 2.71.0. Trace how ANSI color codes and the 💀Critical label are passed into table rendering; done means both tables remain aligned and readable while displaying the violation styling.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.