jfrog / jfrog/jfrog-cli-security

jf audit - Maven Multi-module not detected correctly

Open
#343 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
13
Forks
50
Avg merge
3d 48m
Merged PRs (30d)
26

Description

Describe the bug

I'm not sure if this is intentional or not, but the JSON output from 2.34.0 to 2.36.1 changed at some point and doesn't display the correct package_type anymore (and different structure).

Current behavior

Single component named "root" with "Generic" as the package type.
image

What it used to be:
Multiple components with their module name and "Maven" as their package type.
image

Reproduction steps
  • Run a scan with JFrog CLI 2.36.0 on a multi-module maven project
  • Run a scan with JFrog CLI 2.36.1 on a multi-module maven project
  • Compare the outputs
Expected behavior

Either one of:

  • Singular scan_id with the component_id matching the name of the root project and package_type maven.
    • Not sure how it should handle projects with mixed languages however.
  • Multiple scan_id with each modules with package_type maven.
JFrog CLI version

2.36.1

Operating system type and version

Docker

JFrog Artifactory version

No response

JFrog Xray version

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source file, test, or entry point is identified in the report. Reproduce scans with JFrog CLI 2.36.0 and 2.36.1 on a multi-module Maven project, compare the JSON outputs, and trace the detection path responsible for the component names and package_type. Done means the output consistently represents the Maven modules or root project according to an agreed behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.