From 9bd366680f81c68d81a479f26d7684257c243836 Mon Sep 17 00:00:00 2001 From: Eran Turgeman Date: Sun, 8 Nov 2026 12:51:14 +0200 Subject: [PATCH 1/5] switch priority in ReleasesRepo setting - profile over env var --- go.mod | 4 ++-- go.sum | 8 +++---- utils/getconfiguration.go | 6 +++-- utils/getconfiguration_test.go | 43 ++++++++++++++++++++++++++++++++++ 4 files changed, 53 insertions(+), 8 deletions(-) diff --git a/go.mod b/go.mod index d5e4d7359..9a2be1b00 100644 --- a/go.mod +++ b/go.mod @@ -14,7 +14,7 @@ require ( github.com/jfrog/gofrog v1.7.7 github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20261027135447-d76f4db4eedc github.com/jfrog/jfrog-cli-security v1.41.2 - github.com/jfrog/jfrog-client-go v1.55.1-0.20261029150622-a2075f5e551a + github.com/jfrog/jfrog-client-go v1.55.1-0.20261102081622-45c51cfca4f7 github.com/owenrumney/go-sarif/v3 v3.2.3 github.com/stretchr/testify v1.11.1 github.com/urfave/cli/v2 v2.27.7 @@ -130,7 +130,7 @@ require ( gopkg.in/yaml.v3 v3.0.1 // indirect ) -// replace github.com/jfrog/jfrog-cli-security => github.com/jfrog/jfrog-cli-security dev +replace github.com/jfrog/jfrog-cli-security => github.com/eranturgeman/jfrog-cli-security v0.0.0-20261108103331-af8ec87c4b5a // replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 dev diff --git a/go.sum b/go.sum index 43b63aa11..70e362d21 100644 --- a/go.sum +++ b/go.sum @@ -61,6 +61,8 @@ github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE= github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc= github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ= +github.com/eranturgeman/jfrog-cli-security v0.0.0-20261108103331-af8ec87c4b5a h1:U6lQSh22bZ6va/oh1ScEkBYGJQ/bbbPfXDjWe4sumCw= +github.com/eranturgeman/jfrog-cli-security v0.0.0-20261108103331-af8ec87c4b5a/go.mod h1:MhtXEKVzi9eoOsZr6dx4hyNhvhvdfXhDp5N9rie3mxU= github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk= github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM= github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE= @@ -154,10 +156,8 @@ github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20261101122816-c0098229a376 h1:K github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20261101122816-c0098229a376/go.mod h1:94/aLloMSK6avu4umcJS3DJ6IuGM5K10PwZ6kDqgzSo= github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20261027135447-d76f4db4eedc h1:xrIYOKdHgIcYZEP9+bw14Ts6ZQyeSs2UGD6cQxhXV40= github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20261027135447-d76f4db4eedc/go.mod h1:dU4UKp2AB2MPsVd+v+o9a2/O3vVO2/Yt2dZ5ajqQUnI= -github.com/jfrog/jfrog-cli-security v1.41.2 h1:yLGCrg8T54y2HatjXSSawMVU8c03+dv2Tl8Y9Gz2G54= -github.com/jfrog/jfrog-cli-security v1.41.2/go.mod h1:2LD9S9gqEGSvxUhVC+/DLIPzXFIg6jdCaw5pMdfnS7Y= -github.com/jfrog/jfrog-client-go v1.55.1-0.20261029150622-a2075f5e551a h1:YcDqBspQfxmIgjKY1S6XWzHiAoYL2e6pP4Yy0s09Ky0= -github.com/jfrog/jfrog-client-go v1.55.1-0.20261029150622-a2075f5e551a/go.mod h1:+WGudVz1kZofy4hfEidGdTXqF/E51IC65z4yTtt0TwE= +github.com/jfrog/jfrog-client-go v1.55.1-0.20261102081622-45c51cfca4f7 h1:gd1jzPoUxEsfL0N2qebHyemEHKqvob6d9Q8yOl0D5zE= +github.com/jfrog/jfrog-client-go v1.55.1-0.20261102081622-45c51cfca4f7/go.mod h1:+WGudVz1kZofy4hfEidGdTXqF/E51IC65z4yTtt0TwE= github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c= github.com/jhump/protoreflect v1.15.1/go.mod h1:jD/2GMKKE6OqX8qTjhADU1e6DShO+gavG9e0Q693nKo= github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY= diff --git a/utils/getconfiguration.go b/utils/getconfiguration.go index ec66bbaff..91c38683b 100644 --- a/utils/getconfiguration.go +++ b/utils/getconfiguration.go @@ -181,10 +181,12 @@ func GetFrogbotDetails(commandName string) (frogbotDetails *FrogbotDetails, err func createFrogbotDetails(xrayVersion string, xscVersion string, repository Repository, client vcsclient.VcsClient, jfrogServer *coreconfig.ServerDetails) *FrogbotDetails { frogbotDetails := FrogbotDetails{XrayVersion: xrayVersion, XscVersion: xscVersion, Repository: repository, GitClient: client, ServerDetails: jfrogServer} - frogbotDetails.ReleasesRepo = os.Getenv(jfrogReleasesRepoEnv) - if frogbotDetails.ReleasesRepo == "" { + if repository.ConfigProfile != nil { frogbotDetails.ReleasesRepo = repository.GeneralConfig.ScannersDownloadPath } + if frogbotDetails.ReleasesRepo == "" { + frogbotDetails.ReleasesRepo = os.Getenv(jfrogReleasesRepoEnv) + } return &frogbotDetails } diff --git a/utils/getconfiguration_test.go b/utils/getconfiguration_test.go index bb26024ef..41717b9ba 100644 --- a/utils/getconfiguration_test.go +++ b/utils/getconfiguration_test.go @@ -546,3 +546,46 @@ func createMockVcsClient(t *testing.T, repoOwner, repoName string, withError boo } return mockVcsClient } + +func TestCreateFrogbotDetailsReleasesRepo(t *testing.T) { + defer func() { + assert.NoError(t, SanitizeEnv()) + }() + testCases := []struct { + name string + profile *services.ConfigProfile + envValue string + expectedRepo string + }{ + { + name: "Profile only", + profile: &services.ConfigProfile{GeneralConfig: services.GeneralConfig{ScannersDownloadPath: "profile-repo"}}, + expectedRepo: "profile-repo", + }, + { + name: "Env var only", + profile: &services.ConfigProfile{}, + envValue: "env-repo", + expectedRepo: "env-repo", + }, + { + name: "Both, profile takes priority", + profile: &services.ConfigProfile{GeneralConfig: services.GeneralConfig{ScannersDownloadPath: "profile-repo"}}, + envValue: "env-repo", + expectedRepo: "profile-repo", + }, + { + name: "Neither", + profile: &services.ConfigProfile{}, + expectedRepo: "", + }, + } + for _, testCase := range testCases { + t.Run(testCase.name, func(t *testing.T) { + SetEnvAndAssert(t, map[string]string{jfrogReleasesRepoEnv: testCase.envValue}) + repository := Repository{Params: Params{ConfigProfile: testCase.profile}} + frogbotDetails := createFrogbotDetails("", "", repository, nil, nil) + assert.Equal(t, testCase.expectedRepo, frogbotDetails.ReleasesRepo) + }) + } +} From f96b7c9516537d1c1fcab219132ba4e97012c682 Mon Sep 17 00:00:00 2001 From: Eran Turgeman Date: Sun, 8 Nov 2026 15:05:50 +0200 Subject: [PATCH 2/5] add log --- utils/getconfiguration.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/utils/getconfiguration.go b/utils/getconfiguration.go index 91c38683b..814d9ebe0 100644 --- a/utils/getconfiguration.go +++ b/utils/getconfiguration.go @@ -184,8 +184,11 @@ func createFrogbotDetails(xrayVersion string, xscVersion string, repository Repo if repository.ConfigProfile != nil { frogbotDetails.ReleasesRepo = repository.GeneralConfig.ScannersDownloadPath } + envReleasesRepo := os.Getenv(jfrogReleasesRepoEnv) if frogbotDetails.ReleasesRepo == "" { - frogbotDetails.ReleasesRepo = os.Getenv(jfrogReleasesRepoEnv) + frogbotDetails.ReleasesRepo = envReleasesRepo + } else if envReleasesRepo != "" && envReleasesRepo != frogbotDetails.ReleasesRepo { + log.Info(fmt.Sprintf("Both the Config Profile and the '%s' environment variable define a releases repository. Using the Config Profile value '%s' and ignoring '%s'", jfrogReleasesRepoEnv, frogbotDetails.ReleasesRepo, envReleasesRepo)) } return &frogbotDetails } From c856a2645d8b98ef9d173c756b7bfb815246345d Mon Sep 17 00:00:00 2001 From: Eran Turgeman Date: Sun, 8 Nov 2026 17:20:06 +0200 Subject: [PATCH 3/5] . --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 9a2be1b00..9e7d29279 100644 --- a/go.mod +++ b/go.mod @@ -130,7 +130,7 @@ require ( gopkg.in/yaml.v3 v3.0.1 // indirect ) -replace github.com/jfrog/jfrog-cli-security => github.com/eranturgeman/jfrog-cli-security v0.0.0-20261108103331-af8ec87c4b5a +replace github.com/jfrog/jfrog-cli-security => github.com/eranturgeman/jfrog-cli-security v0.0.0-20261108151652-5d782e3d6abf // replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 dev diff --git a/go.sum b/go.sum index 70e362d21..0a5d71cb7 100644 --- a/go.sum +++ b/go.sum @@ -61,8 +61,8 @@ github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE= github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc= github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ= -github.com/eranturgeman/jfrog-cli-security v0.0.0-20261108103331-af8ec87c4b5a h1:U6lQSh22bZ6va/oh1ScEkBYGJQ/bbbPfXDjWe4sumCw= -github.com/eranturgeman/jfrog-cli-security v0.0.0-20261108103331-af8ec87c4b5a/go.mod h1:MhtXEKVzi9eoOsZr6dx4hyNhvhvdfXhDp5N9rie3mxU= +github.com/eranturgeman/jfrog-cli-security v0.0.0-20261108151652-5d782e3d6abf h1:Lq7Z4Tu2mb7qUD9PVBS5SWdDMVdRZrU84+hv9Q0U6nk= +github.com/eranturgeman/jfrog-cli-security v0.0.0-20261108151652-5d782e3d6abf/go.mod h1:MhtXEKVzi9eoOsZr6dx4hyNhvhvdfXhDp5N9rie3mxU= github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk= github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM= github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE= From 34f47608a7b8b5f2eeb98c254b3c642f6373f9a7 Mon Sep 17 00:00:00 2001 From: Eran Turgeman Date: Mon, 9 Nov 2026 10:13:40 +0200 Subject: [PATCH 4/5] . --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 9e7d29279..6952794e0 100644 --- a/go.mod +++ b/go.mod @@ -130,7 +130,7 @@ require ( gopkg.in/yaml.v3 v3.0.1 // indirect ) -replace github.com/jfrog/jfrog-cli-security => github.com/eranturgeman/jfrog-cli-security v0.0.0-20261108151652-5d782e3d6abf +replace github.com/jfrog/jfrog-cli-security => github.com/jfrog/jfrog-cli-security v1.41.3-0.20261108164505-d19dab5de46c // replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 dev diff --git a/go.sum b/go.sum index 0a5d71cb7..e4fa969f6 100644 --- a/go.sum +++ b/go.sum @@ -61,8 +61,6 @@ github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE= github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc= github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ= -github.com/eranturgeman/jfrog-cli-security v0.0.0-20261108151652-5d782e3d6abf h1:Lq7Z4Tu2mb7qUD9PVBS5SWdDMVdRZrU84+hv9Q0U6nk= -github.com/eranturgeman/jfrog-cli-security v0.0.0-20261108151652-5d782e3d6abf/go.mod h1:MhtXEKVzi9eoOsZr6dx4hyNhvhvdfXhDp5N9rie3mxU= github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk= github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM= github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE= @@ -156,6 +154,8 @@ github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20261101122816-c0098229a376 h1:K github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20261101122816-c0098229a376/go.mod h1:94/aLloMSK6avu4umcJS3DJ6IuGM5K10PwZ6kDqgzSo= github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20261027135447-d76f4db4eedc h1:xrIYOKdHgIcYZEP9+bw14Ts6ZQyeSs2UGD6cQxhXV40= github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20261027135447-d76f4db4eedc/go.mod h1:dU4UKp2AB2MPsVd+v+o9a2/O3vVO2/Yt2dZ5ajqQUnI= +github.com/jfrog/jfrog-cli-security v1.41.3-0.20261108164505-d19dab5de46c h1:eZnlUZ+NIDrSqHIOkTWMzES9EPhlAkCp8S0E2zMYS7s= +github.com/jfrog/jfrog-cli-security v1.41.3-0.20261108164505-d19dab5de46c/go.mod h1:MhtXEKVzi9eoOsZr6dx4hyNhvhvdfXhDp5N9rie3mxU= github.com/jfrog/jfrog-client-go v1.55.1-0.20261102081622-45c51cfca4f7 h1:gd1jzPoUxEsfL0N2qebHyemEHKqvob6d9Q8yOl0D5zE= github.com/jfrog/jfrog-client-go v1.55.1-0.20261102081622-45c51cfca4f7/go.mod h1:+WGudVz1kZofy4hfEidGdTXqF/E51IC65z4yTtt0TwE= github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c= From 2562be86f47b14697e1fe4f92593fa1cb4066943 Mon Sep 17 00:00:00 2001 From: Eran Turgeman Date: Mon, 9 Nov 2026 10:49:31 +0200 Subject: [PATCH 5/5] Update multi-dir expected response after minimatch CVE-2026-118764 is no longer reported Co-Authored-By: Claude Sonnet 5.5 --- .../expected_response_multi_dir.md | 44 +------------------ 1 file changed, 2 insertions(+), 42 deletions(-) diff --git a/testdata/scanpullrequest/expected_response_multi_dir.md b/testdata/scanpullrequest/expected_response_multi_dir.md index ceab2d9fe..91c0c6454 100644 --- a/testdata/scanpullrequest/expected_response_multi_dir.md +++ b/testdata/scanpullrequest/expected_response_multi_dir.md @@ -11,11 +11,11 @@ ## 📗 Scan Summary -- Frogbot scanned for vulnerabilities and found 12 issues +- Frogbot scanned for vulnerabilities and found 11 issues | Scan Category | Status | Security Issues | | --------------------- | :-----------------------------------: | ----------------------------------- | -| **Software Composition Analysis** | ✅ Done |
12 Issues Found 10 High
2 Medium
| +| **Software Composition Analysis** | ✅ Done |
11 Issues Found 10 High
1 Medium
| | **Contextual Analysis** | ✅ Done | - | | **Static Application Security Testing (SAST)** | ✅ Done | Not Found | | **Secrets** | ✅ Done | - | @@ -26,7 +26,6 @@ | Severity | ID | Contextual Analysis | Dependency Path | | :---------------------: | :-----------------------------------: | :-----------------------------------: | ----------------------------------- | -| ![medium](https://raw.githubusercontent.com/jfrog/frogbot/master/resources/v2/applicableMediumSeverity.png)
Medium | CVE-2026-118764 | Not Covered |
1 Directminimatch:3.0.4
| | ![medium](https://raw.githubusercontent.com/jfrog/frogbot/master/resources/v2/applicableMediumSeverity.png)
Medium | CVE-2026-102277 | Not Covered |
1 Transitivebrace-expansion:1.1.12
| | ![high (not applicable)](https://raw.githubusercontent.com/jfrog/frogbot/master/resources/v2/notApplicableHigh.png)
High | CVE-2026-69152 | Not Applicable |
1 Transitivebrace-expansion:1.1.12
| | ![high (not applicable)](https://raw.githubusercontent.com/jfrog/frogbot/master/resources/v2/notApplicableHigh.png)
High | CVE-2026-33750 | Not Applicable |
1 Transitivebrace-expansion:1.1.12
| @@ -42,45 +41,6 @@ ### 🔖 Details -
[ CVE-2026-118764 ] minimatch 3.0.4 - -### Vulnerability Details -| | | -| --------------------- | :-----------------------------------: | -| **Contextual Analysis:** | Not Covered | -| **CVSS V3:** | - | -| **Dependency Path:** |
minimatch: 3.0.4 (Direct)Fix Version: 11.0.1
| - -minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess() when optimizationLevel >= 2. - -researcher: Reid Downing (b1nv0id) -files: - -- src/index.ts: 690-770 -- src/index.ts: 780-796 - -issue: -input-controlled growth of globParts during first-phase preprocessing, followed by quadratic second-phase processing. - -the **/../ transformation clones a globparts entry and appends the clone to the same globparts array: -``` -parts.splice(gs, 1) -const other = parts.slice(0) -other[gs] = '**' -globParts.push(other) -``` -this occurs inside a do...while (didSomething) fixpoint loop, allowing generated entries to be processed again. - -the expanded globparts array is subsequently processed by secondPhasePreProcess(), which performs pairwise comparisons: -``` -for (let i = 0; i < globParts.length - 1; i++) { - for (let j = i + 1; j < globParts.length; j++) { - this.partsMatch(...) - } -} -``` -an attacker who can supply a glob pattern can therefore cause additional pattern entries to be generated during preprocessing, followed by quadratic pairwise processing, resulting in excessive cpu and memory consumption.
-
[ CVE-2026-102277 ] brace-expansion 1.1.12 ### Vulnerability Details