jfrog / jfrog/jfrog-cli-security
jf docker scan fails on golang/src/archive/tar/testdata/pax-bad-hdr-large.tar.bz2
Open
Nobody has claimed this yet.
bug
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Describe the bug
Running jf docker scan on a container image based on golang:1.20.1-alpine3.17 fails when trying to index pax-bad-hdr-large.tar.bz2 which is in the container at /usr/local/go/src/archive/tar/testdata/pax-bad-hdr-large.tar.bz2.
Current behavior
Ξ» ~/golang-test/ jf docker scan golang-test
12:25:28 [π΅Info] Log path: /Users/tom.george/.jfrog/logs/jfrog-cli.2023-03-30.12-25-28.36896.log
βββββββββββββββββββββββββββββββββββββββ
β β¨ No vulnerabilities were found β¨ β
βββββββββββββββββββββββββββββββββββββββ
12:25:42 [π¨Error] Xray indexer app failed indexing /var/folders/_1/qrh71qqj45xf2jhxwj6scgd40000gp/T/jfrog.cli.temp.-1680197129-1021605106/image.tar with exit status 2: 2023-03-30T17:25:37.464142Z [jfxia] [INFO ] [] [docker_layer_tar:171 ] [main ] Encountered release info file 'etc/alpine-release'
2023-03-30T17:25:37.464815Z [jfxia] [INFO ] [] [docker_layer_tar:171 ] [main ] Encountered release info file 'etc/os-release'
2023-03-30T17:25:39.917596Z [jfxia] [INFO ] [] [/usr/local/go/src/sync/once:74] [main ] SPDX license IDs from licenses.json and exceptions.json were loaded successfully
2023-03-30T17:25:40.969984Z [jfxia] [WARN ] [] [archive_mgr:662 ] [main ] Archive manifest.json exceeded internal depth limitation, extraction stopped.
2023-03-30T17:25:41.61123Z [jfxia] [WARN ] [] [archive_mgr:281 ] [main ] failed to extract tar: archive/tar: invalid tar header
2023-03-30T17:25:41.612136Z [jfxia] [WARN ] [] [archive_mgr:281 ] [main ] failed to extract tar: archive/tar: invalid tar header
2023-03-30T17:25:41.613006Z [jfxia] [WARN ] [] [archive_mgr:281 ] [main ] failed to extract tar: archive/tar: invalid tar header
2023-03-30T17:25:41.613783Z [jfxia] [WARN ] [] [archive_mgr:281 ] [main ] failed to extract tar: archive/tar: invalid tar header
2023-03-30T17:25:41.615615Z [jfxia] [WARN ] [] [archive_mgr:281 ] [main ] failed to extract tar: archive/tar: invalid tar header
2023-03-30T17:25:41.623937Z [jfxia] [ERROR] [] [archive_mgr:227 ] [main ] Failed to extract layer data of '/var/folders/_1/qrh71qqj45xf2jhxwj6scgd40000gp/T/jfrog.cli.temp.-1680197134-4073455054/cf96fe2d-63af-47ce-7b06-8f145d5f84b0/168019713993117900/sha256__c6bcad44cf36393c281e50b768d575a49a501a64aaba125d7a6d5e6d29690dfa.tar': 'failed to extract file pax-bad-hdr-large.tar.bz2 (root path: /var/folders/_1/qrh71qqj45xf2jhxwj6scgd40000gp/T/jfrog.cli.temp.-1680197134-4073455054/cf96fe2d-63af-47ce-7b06-8f145d5f84b0/168019713651366500/).
--- at /go/src/jfrog.com/xray/backend/indexer/indexer_core/archive_mgr.go:291 (ArchiveManager.deepArchiveScanWrapper) ---
Caused by: failed to check if 2f7661722f666f6c646572732f5f312f717268373171716a34357866326a6878776a3673636764343030303067702f542f6a66726f672e636c692e74656d702e2d313638303139373133342d343037333435353035342f63663936666532642d363361662d343763652d376230362d3866313435643566383462302f3136383031393731343136313539343930302f7061782d6261642d6864722d6c617267652e7461722e627a32 is a conda package
--- at /go/src/jfrog.com/xray/backend/indexer/indexer_core/tar.go:74 (TarOpenerFactory.DeepArchiveScan) ---
Caused by: Irrecoverable Error: failed reading tar.bz2 file /var/folders/_1/qrh71qqj45xf2jhxwj6scgd40000gp/T/jfrog.cli.temp.-1680197134-4073455054/cf96fe2d-63af-47ce-7b06-8f145d5f84b0/168019714161594900/pax-bad-hdr-large.tar.bz2
--- at /go/src/jfrog.com/xray/backend/indexer/indexer_core/conda.go:179 (getIndexJsonContentFromArchiveReader) ---
Caused by: archive/tar: header field too long'
2023-03-30T17:25:41.624321Z [jfxia] [ERROR] [] [docker_tar:99 ] [main ] Failed to index temporary file '/var/folders/_1/qrh71qqj45xf2jhxwj6scgd40000gp/T/jfrog.cli.temp.-1680197134-4073455054/cf96fe2d-63af-47ce-7b06-8f145d5f84b0/168019713654542100/9f9a556ab2f4fe3ce505c017c7bdf2ca3249172303697c103a928d94cb4f3bde/sha256__c6bcad44cf36393c281e50b768d575a49a501a64aaba125d7a6d5e6d29690dfa.tar': failed to extract file sha256__c6bcad44cf36393c281e50b768d575a49a501a64aaba125d7a6d5e6d29690dfa.tar (root path: /var/folders/_1/qrh71qqj45xf2jhxwj6scgd40000gp/T/jfrog.cli.temp.-1680197134-4073455054/cf96fe2d-63af-47ce-7b06-8f145d5f84b0/168019713651366500/).
--- at /go/src/jfrog.com/xray/backend/indexer/indexer_core/archive_mgr.go:291 (ArchiveManager.deepArchiveScanWrapper) ---
Caused by: failed to extract file pax-bad-hdr-large.tar.bz2 (root path: /var/folders/_1/qrh71qqj45xf2jhxwj6scgd40000gp/T/jfrog.cli.temp.-1680197134-4073455054/cf96fe2d-63af-47ce-7b06-8f145d5f84b0/168019713651366500/).
--- at /go/src/jfrog.com/xray/backend/indexer/indexer_core/archive_mgr.go:291 (ArchiveManager.deepArchiveScanWrapper) ---
Caused by: failed to check if 2f7661722f666f6c646572732f5f312f717268373171716a34357866326a6878776a3673636764343030303067702f542f6a66726f672e636c692e74656d702e2d313638303139373133342d343037333435353035342f63663936666532642d363361662d343763652d376230362d3866313435643566383462302f3136383031393731343136313539343930302f7061782d6261642d6864722d6c617267652e7461722e627a32 is a conda package
--- at /go/src/jfrog.com/xray/backend/indexer/indexer_core/tar.go:74 (TarOpenerFactory.DeepArchiveScan) ---
Caused by: Irrecoverable Error: failed reading tar.bz2 file /var/folders/_1/qrh71qqj45xf2jhxwj6scgd40000gp/T/jfrog.cli.temp.-1680197134-4073455054/cf96fe2d-63af-47ce-7b06-8f145d5f84b0/168019714161594900/pax-bad-hdr-large.tar.bz2
--- at /go/src/jfrog.com/xray/backend/indexer/indexer_core/conda.go:179 (getIndexJsonContentFromArchiveReader) ---
Caused by: archive/tar: header field too long
2023-03-30T17:25:41.650578Z [jfxia] [ERROR] [] [proc:250 ] [main ] Failed to index '/var/folders/_1/qrh71qqj45xf2jhxwj6scgd40000gp/T/jfrog.cli.temp.-1680197129-1021605106/image.tar': failed to index file '/var/folders/_1/qrh71qqj45xf2jhxwj6scgd40000gp/T/jfrog.cli.temp.-1680197129-1021605106/image.tar'
--- at /go/src/jfrog.com/xray/backend/indexer/indexer_core/archive_mgr.go:126 (ArchiveManager.IndexStandaloneExtFile) ---
Caused by: failed to extract file /golang-test/latest/manifest.json (root path: /var/folders/_1/qrh71qqj45xf2jhxwj6scgd40000gp/T/jfrog.cli.temp.-1680197134-4073455054/cf96fe2d-63af-47ce-7b06-8f145d5f84b0/168019713651366500/).
--- at /go/src/jfrog.com/xray/backend/indexer/indexer_core/archive_mgr.go:291 (ArchiveManager.deepArchiveScanWrapper) ---
Caused by: failed to scan docker layer 'sha256__c6bcad44cf36393c281e50b768d575a49a501a64aaba125d7a6d5e6d29690dfa.tar'
--- at /go/src/jfrog.com/xray/backend/indexer/indexer_core/docker.go:110 (DockerOpener.DeepArchiveScan) ---
Caused by: failed to extract file sha256__c6bcad44cf36393c281e50b768d575a49a501a64aaba125d7a6d5e6d29690dfa.tar (root path: /var/folders/_1/qrh71qqj45xf2jhxwj6scgd40000gp/T/jfrog.cli.temp.-1680197134-4073455054/cf96fe2d-63af-47ce-7b06-8f145d5f84b0/168019713651366500/).
--- at /go/src/jfrog.com/xray/backend/indexer/indexer_core/archive_mgr.go:291 (ArchiveManager.deepArchiveScanWrapper) ---
Caused by: failed to extract file pax-bad-hdr-large.tar.bz2 (root path: /var/folders/_1/qrh71qqj45xf2jhxwj6scgd40000gp/T/jfrog.cli.temp.-1680197134-4073455054/cf96fe2d-63af-47ce-7b06-8f145d5f84b0/168019713651366500/).
--- at /go/src/jfrog.com/xray/backend/indexer/indexer_core/archive_mgr.go:291 (ArchiveManager.deepArchiveScanWrapper) ---
Caused by: failed to check if 2f7661722f666f6c646572732f5f312f717268373171716a34357866326a6878776a3673636764343030303067702f542f6a66726f672e636c692e74656d702e2d313638303139373133342d343037333435353035342f63663936666532642d363361662d343763652d376230362d3866313435643566383462302f3136383031393731343136313539343930302f7061782d6261642d6864722d6c617267652e7461722e627a32 is a conda package
--- at /go/src/jfrog.com/xray/backend/indexer/indexer_core/tar.go:74 (TarOpenerFactory.DeepArchiveScan) ---
Caused by: Irrecoverable Error: failed reading tar.bz2 file /var/folders/_1/qrh71qqj45xf2jhxwj6scgd40000gp/T/jfrog.cli.temp.-1680197134-4073455054/cf96fe2d-63af-47ce-7b06-8f145d5f84b0/168019714161594900/pax-bad-hdr-large.tar.bz2
--- at /go/src/jfrog.com/xray/backend/indexer/indexer_core/conda.go:179 (getIndexJsonContentFromArchiveReader) ---
Caused by: archive/tar: header field too long
Reproduction steps
FROM golang:1.20.1-alpine3.17
docker build -t golang-test .
jf docker scan golang-test
Expected behavior
I expect it to not fail on this piece of test data, or to skip it like many of the invalid tar header errors.
JFrog CLI version
2.35.0
Operating system type and version
Mac/Linux, happens locally and in CI
JFrog Artifactory version
7.55.9
JFrog Xray version
3.69.3
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up β it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the failure with the Dockerfile and jf docker scan, then trace the reported paths in archive_mgr.go, tar.go, conda.go, and docker.go. Check how the malformed pax-bad-hdr-large.tar.bz2 error propagates during layer extraction; done means the scan completes or skips this invalid test archive without failing the image scan.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go
- Domain
- cli, devops, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100