Deprecate all multi commands #941

eyalk007 · 2025-10-28T13:49:36Z

All tests passed. If this feature is not already covered by the tests, I added new tests.
This pull request is on the dev branch.
I used gofmt for formatting the code before submitting the pull request.
Update documentation about new features / new supported technologies

This reverts commit c7fa431.

utils/scandetails.go

action/lib/src/main.js

…s-scan

github-actions · 2025-11-20T13:10:06Z

📗 Scan Summary

Frogbot scanned for vulnerabilities and found 8 issues

Scan Category	Status	Security Issues
Software Composition Analysis	ℹ️ Not Scanned	-
Contextual Analysis	ℹ️ Not Scanned	-
Static Application Security Testing (SAST)	✅ Done	8 Issues Found 1 High 7 Medium
Secrets	✅ Done	-
Infrastructure as Code (IaC)	✅ Done	Not Found

🐸 JFrog Frogbot

github-actions · 2025-11-20T13:10:07Z

body

at utils/testsutils.go (line 250)

🎯 Static Application Security Testing (SAST) Vulnerability

Severity	Finding
High	Deserializing untrusted data without validation

Full description

Vulnerability Details


Rule ID:	go-unsafe-deserialization

Overview

Unsafe deserialization in Go occurs when a program deserializes untrusted
data with a potentially dangerous deserializer. Deserialization is the
process of converting serialized data (data that has been converted into a
format that can be easily transmitted or stored) back into its original
form. In some ("unsafe") serialization protocols, if an attacker is able
to manipulate the serialized data, they may be able to execute arbitrary
code or perform other malicious actions when the data is deserialized.

Vulnerable example

import (
    "github.com/go-yaml/yaml"
    "net/http"
)

func storeHandler(w http.ResponseWriter, r *http.Request) {
    var data map[string]interface{}
    yaml.Unmarshal([]byte(r.URL.Query().Get("data")), &data) // NOT OK
}

This code uses yaml.Unmarshal to deserialize untrusted data from the
user, with a potentially dangerous deserializer.

Remediation

import (
    "github.com/go-yaml/yaml"
    "net/http"
)

func storeHandler(w http.ResponseWriter, r *http.Request) {
    var data map[string]interface{}
    yaml.UnmarshalStrict([]byte(r.URL.Query().Get("data")), &data) // SAFE
}

Using yaml.UnmarshalStrict solves the problem by ensuring a safe
serialization protocol.

Code Flows

Vulnerable data flow analysis result

↘️ r.Body (at utils/testsutils.go line 243)

↘️ io.ReadAll(r.Body) (at utils/testsutils.go line 243)

↘️ body (at utils/testsutils.go line 243)

↘️ body (at utils/testsutils.go line 250)

🐸 JFrog Frogbot

github-actions · 2025-11-20T13:10:09Z

content

at utils/testsutils.go (line 196)

🎯 Static Application Security Testing (SAST) Vulnerability

Severity	Finding
Medium	Untrusted stored value is included in web page content

Full description

Vulnerability Details


Rule ID:	go-stored-xss

Overview

Stored Cross-Site Scripting (XSS) is a type of vulnerability where malicious
scripts are injected into a web application and stored in a persistent state,
such as a database. When other users access the affected page, the stored
scripts are executed in their browsers, leading to various attacks.

Vulnerable example

func serveMessage(w http.ResponseWriter, r *http.Request) {
    db, _ := sql.Open("sqlite3", "test.db")
    message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
    fmt.Fprintf(w, "<h1>%s</h1>", message)
}

In this example, the serveMessage function retrieves a message from the
database and directly embeds it into an HTML response without proper escaping.
If the message contains malicious scripts, it can lead to Stored XSS attacks
when other users view the page.

Remediation

To mitigate Stored XSS vulnerabilities, always sanitize and encode user
input before storing it in a persistent state and before displaying it
to other users:

func serveMessage(w http.ResponseWriter, r *http.Request) {
    db, _ := sql.Open("sqlite3", "test.db")
    message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
-   fmt.Fprintf(w, "<h1>%s</h1>", message)
+   fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}

In the remediation, we've used the html.EscapeString function to escape
the message before embedding it into the HTML response. This helps prevent
the execution of malicious scripts and mitigates the Stored XSS vulnerability.

Code Flows

Vulnerable data flow analysis result

↘️ os.ReadFile("../testdata/configprofile/configProfileExample.json") (at utils/testsutils.go line 176)

↘️ content (at utils/testsutils.go line 176)

↘️ content (at utils/testsutils.go line 196)

🐸 JFrog Frogbot

github-actions · 2025-11-20T13:10:10Z

content

at utils/testsutils.go (line 205)

🎯 Static Application Security Testing (SAST) Vulnerability

Severity	Finding
Medium	Untrusted stored value is included in web page content

Full description

Vulnerability Details


Rule ID:	go-stored-xss

Overview

Stored Cross-Site Scripting (XSS) is a type of vulnerability where malicious
scripts are injected into a web application and stored in a persistent state,
such as a database. When other users access the affected page, the stored
scripts are executed in their browsers, leading to various attacks.

Vulnerable example

func serveMessage(w http.ResponseWriter, r *http.Request) {
    db, _ := sql.Open("sqlite3", "test.db")
    message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
    fmt.Fprintf(w, "<h1>%s</h1>", message)
}

In this example, the serveMessage function retrieves a message from the
database and directly embeds it into an HTML response without proper escaping.
If the message contains malicious scripts, it can lead to Stored XSS attacks
when other users view the page.

Remediation

To mitigate Stored XSS vulnerabilities, always sanitize and encode user
input before storing it in a persistent state and before displaying it
to other users:

func serveMessage(w http.ResponseWriter, r *http.Request) {
    db, _ := sql.Open("sqlite3", "test.db")
    message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
-   fmt.Fprintf(w, "<h1>%s</h1>", message)
+   fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}

In the remediation, we've used the html.EscapeString function to escape
the message before embedding it into the HTML response. This helps prevent
the execution of malicious scripts and mitigates the Stored XSS vulnerability.

Code Flows

Vulnerable data flow analysis result

↘️ os.ReadFile("../testdata/configprofile/configProfileExample.json") (at utils/testsutils.go line 202)

↘️ content (at utils/testsutils.go line 202)

↘️ content (at utils/testsutils.go line 205)

🐸 JFrog Frogbot

github-actions · 2025-11-20T13:10:11Z

scanrepository/scanrepository_test.go

+			if r.RequestURI == fmt.Sprintf("/%s", projectName) {
+				file, err := os.ReadFile(fmt.Sprintf("%s.tar.gz", projectName))
+				assert.NoError(t, err)
+				_, err = w.Write(file)


🎯 Static Application Security Testing (SAST) Vulnerability

Severity Finding

Medium Untrusted stored value is included in web page content

Full description

Vulnerability Details

Rule ID: go-stored-xss

Overview

Stored Cross-Site Scripting (XSS) is a type of vulnerability where malicious
scripts are injected into a web application and stored in a persistent state,
such as a database. When other users access the affected page, the stored
scripts are executed in their browsers, leading to various attacks.

Vulnerable example

func serveMessage(w http.ResponseWriter, r *http.Request) { db, _ := sql.Open("sqlite3", "test.db") message := db.QueryRow("SELECT message FROM messages WHERE id = 1") fmt.Fprintf(w, "<h1>%s</h1>", message) }

In this example, the serveMessage function retrieves a message from the
database and directly embeds it into an HTML response without proper escaping.
If the message contains malicious scripts, it can lead to Stored XSS attacks
when other users view the page.

Remediation

To mitigate Stored XSS vulnerabilities, always sanitize and encode user
input before storing it in a persistent state and before displaying it
to other users:

func serveMessage(w http.ResponseWriter, r *http.Request) { db, _ := sql.Open("sqlite3", "test.db") message := db.QueryRow("SELECT message FROM messages WHERE id = 1") - fmt.Fprintf(w, "<h1>%s</h1>", message) + fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message)) }

In the remediation, we've used the html.EscapeString function to escape
the message before embedding it into the HTML response. This helps prevent
the execution of malicious scripts and mitigates the Stored XSS vulnerability.

Code Flows

Vulnerable data flow analysis result

↘️ os.ReadFile(fmt.Sprintf("%s.tar.gz", projectName)) (at scanrepository/scanrepository_test.go line 855)

↘️ file (at scanrepository/scanrepository_test.go line 855)

↘️ file (at scanrepository/scanrepository_test.go line 857)

🐸 JFrog Frogbot

github-actions · 2025-11-20T13:10:13Z

repoFile

at scanpullrequest/scanpullrequest_test.go (line 1220)

🎯 Static Application Security Testing (SAST) Vulnerability

Severity	Finding
Medium	Untrusted stored value is included in web page content

Full description

Vulnerability Details


Rule ID:	go-stored-xss

Overview

Stored Cross-Site Scripting (XSS) is a type of vulnerability where malicious
scripts are injected into a web application and stored in a persistent state,
such as a database. When other users access the affected page, the stored
scripts are executed in their browsers, leading to various attacks.

Vulnerable example

func serveMessage(w http.ResponseWriter, r *http.Request) {
    db, _ := sql.Open("sqlite3", "test.db")
    message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
    fmt.Fprintf(w, "<h1>%s</h1>", message)
}

In this example, the serveMessage function retrieves a message from the
database and directly embeds it into an HTML response without proper escaping.
If the message contains malicious scripts, it can lead to Stored XSS attacks
when other users view the page.

Remediation

To mitigate Stored XSS vulnerabilities, always sanitize and encode user
input before storing it in a persistent state and before displaying it
to other users:

func serveMessage(w http.ResponseWriter, r *http.Request) {
    db, _ := sql.Open("sqlite3", "test.db")
    message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
-   fmt.Fprintf(w, "<h1>%s</h1>", message)
+   fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}

In the remediation, we've used the html.EscapeString function to escape
the message before embedding it into the HTML response. This helps prevent
the execution of malicious scripts and mitigates the Stored XSS vulnerability.

Code Flows

Vulnerable data flow analysis result

↘️ os.ReadFile(filepath.Join("..", params.RepoName, "sourceBranch.gz")) (at scanpullrequest/scanpullrequest_test.go line 1218)

↘️ repoFile (at scanpullrequest/scanpullrequest_test.go line 1218)

↘️ repoFile (at scanpullrequest/scanpullrequest_test.go line 1220)

🐸 JFrog Frogbot

github-actions · 2025-11-20T13:10:15Z

repoFile

at scanpullrequest/scanpullrequest_test.go (line 1227)

🎯 Static Application Security Testing (SAST) Vulnerability

Severity	Finding
Medium	Untrusted stored value is included in web page content

Full description

Vulnerability Details


Rule ID:	go-stored-xss

Overview

Stored Cross-Site Scripting (XSS) is a type of vulnerability where malicious
scripts are injected into a web application and stored in a persistent state,
such as a database. When other users access the affected page, the stored
scripts are executed in their browsers, leading to various attacks.

Vulnerable example

func serveMessage(w http.ResponseWriter, r *http.Request) {
    db, _ := sql.Open("sqlite3", "test.db")
    message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
    fmt.Fprintf(w, "<h1>%s</h1>", message)
}

In this example, the serveMessage function retrieves a message from the
database and directly embeds it into an HTML response without proper escaping.
If the message contains malicious scripts, it can lead to Stored XSS attacks
when other users view the page.

Remediation

To mitigate Stored XSS vulnerabilities, always sanitize and encode user
input before storing it in a persistent state and before displaying it
to other users:

func serveMessage(w http.ResponseWriter, r *http.Request) {
    db, _ := sql.Open("sqlite3", "test.db")
    message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
-   fmt.Fprintf(w, "<h1>%s</h1>", message)
+   fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}

In the remediation, we've used the html.EscapeString function to escape
the message before embedding it into the HTML response. This helps prevent
the execution of malicious scripts and mitigates the Stored XSS vulnerability.

Code Flows

Vulnerable data flow analysis result

↘️ os.ReadFile(filepath.Join("..", params.RepoName, "targetBranch.gz")) (at scanpullrequest/scanpullrequest_test.go line 1225)

↘️ repoFile (at scanpullrequest/scanpullrequest_test.go line 1225)

↘️ repoFile (at scanpullrequest/scanpullrequest_test.go line 1227)

🐸 JFrog Frogbot

github-actions · 2025-11-20T13:10:16Z

comments

at scanpullrequest/scanpullrequest_test.go (line 1234)

🎯 Static Application Security Testing (SAST) Vulnerability

Severity	Finding
Medium	Untrusted stored value is included in web page content

Full description

Vulnerability Details


Rule ID:	go-stored-xss

Overview

Stored Cross-Site Scripting (XSS) is a type of vulnerability where malicious
scripts are injected into a web application and stored in a persistent state,
such as a database. When other users access the affected page, the stored
scripts are executed in their browsers, leading to various attacks.

Vulnerable example

func serveMessage(w http.ResponseWriter, r *http.Request) {
    db, _ := sql.Open("sqlite3", "test.db")
    message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
    fmt.Fprintf(w, "<h1>%s</h1>", message)
}

In this example, the serveMessage function retrieves a message from the
database and directly embeds it into an HTML response without proper escaping.
If the message contains malicious scripts, it can lead to Stored XSS attacks
when other users view the page.

Remediation

To mitigate Stored XSS vulnerabilities, always sanitize and encode user
input before storing it in a persistent state and before displaying it
to other users:

func serveMessage(w http.ResponseWriter, r *http.Request) {
    db, _ := sql.Open("sqlite3", "test.db")
    message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
-   fmt.Fprintf(w, "<h1>%s</h1>", message)
+   fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}

In the remediation, we've used the html.EscapeString function to escape
the message before embedding it into the HTML response. This helps prevent
the execution of malicious scripts and mitigates the Stored XSS vulnerability.

Code Flows

Vulnerable data flow analysis result

↘️ os.ReadFile(filepath.Join("..", "commits.json")) (at scanpullrequest/scanpullrequest_test.go line 1232)

↘️ comments (at scanpullrequest/scanpullrequest_test.go line 1232)

↘️ comments (at scanpullrequest/scanpullrequest_test.go line 1234)

🐸 JFrog Frogbot

github-actions · 2025-11-20T13:10:18Z

discussions

at scanpullrequest/scanpullrequest_test.go (line 1269)

🎯 Static Application Security Testing (SAST) Vulnerability

Severity	Finding
Medium	Untrusted stored value is included in web page content

Full description

Vulnerability Details


Rule ID:	go-stored-xss

Overview

Stored Cross-Site Scripting (XSS) is a type of vulnerability where malicious
scripts are injected into a web application and stored in a persistent state,
such as a database. When other users access the affected page, the stored
scripts are executed in their browsers, leading to various attacks.

Vulnerable example

func serveMessage(w http.ResponseWriter, r *http.Request) {
    db, _ := sql.Open("sqlite3", "test.db")
    message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
    fmt.Fprintf(w, "<h1>%s</h1>", message)
}

In this example, the serveMessage function retrieves a message from the
database and directly embeds it into an HTML response without proper escaping.
If the message contains malicious scripts, it can lead to Stored XSS attacks
when other users view the page.

Remediation

To mitigate Stored XSS vulnerabilities, always sanitize and encode user
input before storing it in a persistent state and before displaying it
to other users:

func serveMessage(w http.ResponseWriter, r *http.Request) {
    db, _ := sql.Open("sqlite3", "test.db")
    message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
-   fmt.Fprintf(w, "<h1>%s</h1>", message)
+   fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}

In the remediation, we've used the html.EscapeString function to escape
the message before embedding it into the HTML response. This helps prevent
the execution of malicious scripts and mitigates the Stored XSS vulnerability.

Code Flows

Vulnerable data flow analysis result

↘️ os.ReadFile(filepath.Join("..", "list_merge_request_discussion_items.json")) (at scanpullrequest/scanpullrequest_test.go line 1267)

↘️ discussions (at scanpullrequest/scanpullrequest_test.go line 1267)

↘️ discussions (at scanpullrequest/scanpullrequest_test.go line 1269)

🐸 JFrog Frogbot

eyalk007 added 2 commits October 28, 2025 15:11

created new release using workflows and deleted old one

c7fa431

removed the scan multi from frogbot

7a38adc

eyalk007 requested a deployment to frogbot October 28, 2025 13:49 — with GitHub Actions Waiting

eyalk007 added safe to test Approve running integration tests on a pull request improvement Automatically generated release notes breaking change Automatically generated release notes and removed improvement Automatically generated release notes labels Oct 28, 2025

github-actions bot removed the safe to test Approve running integration tests on a pull request label Oct 28, 2025

Revert "created new release using workflows and deleted old one"

198c3d8

This reverts commit c7fa431.

eyalk007 requested a deployment to frogbot October 28, 2025 14:09 — with GitHub Actions Waiting

deleted unused elements and fixed lining issues

ba8c0b2

eyalk007 requested a deployment to frogbot November 3, 2025 12:49 — with GitHub Actions Waiting

Add go:generate directive for mock generation

a224fd7

eyalk007 requested a deployment to frogbot November 3, 2025 13:07 — with GitHub Actions Waiting

Remove unused commandName parameter from extractGitParamsFromEnvs

c8230ac

eyalk007 requested a deployment to frogbot November 3, 2025 13:22 — with GitHub Actions Waiting

eyalk007 requested a deployment to frogbot November 3, 2025 13:26 — with GitHub Actions Waiting

eyalk007 force-pushed the deprecate-all-repos-scan branch from 138037f to c8230ac Compare November 3, 2025 13:27

eyalk007 requested a deployment to frogbot November 3, 2025 13:28 — with GitHub Actions Waiting

eyalk007 self-assigned this Nov 5, 2025

orto17 reviewed Nov 5, 2025

View reviewed changes

utils/scandetails.go Show resolved Hide resolved

orto17 reviewed Nov 5, 2025

View reviewed changes

action/lib/src/main.js Outdated Show resolved Hide resolved

orto17 approved these changes Nov 5, 2025

View reviewed changes

Merge remote-tracking branch 'upstream/v3_er' into deprecate-all-repo…

6c8f3b5

…s-scan

eyalk007 requested a deployment to frogbot November 20, 2025 12:55 — with GitHub Actions Waiting

Remove duplicate action build artifacts

742f6b1

eyalk007 requested a deployment to frogbot November 20, 2025 12:58 — with GitHub Actions Waiting

eyalk007 added the safe to test Approve running integration tests on a pull request label Nov 20, 2025

github-actions bot removed the safe to test Approve running integration tests on a pull request label Nov 20, 2025

github-actions bot reviewed Nov 20, 2025

View reviewed changes

Deprecate all multi commands #941

Are you sure you want to change the base?

Deprecate all multi commands #941

Uh oh!

Conversation

eyalk007 commented Oct 28, 2025

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Nov 20, 2025

📗 Scan Summary

Uh oh!

github-actions bot commented Nov 20, 2025

🎯 Static Application Security Testing (SAST) Vulnerability

Vulnerability Details

Overview

Vulnerable example

Remediation

Uh oh!

github-actions bot commented Nov 20, 2025

🎯 Static Application Security Testing (SAST) Vulnerability

Vulnerability Details

Overview

Vulnerable example

Remediation

Uh oh!

github-actions bot commented Nov 20, 2025

🎯 Static Application Security Testing (SAST) Vulnerability

Vulnerability Details

Overview

Vulnerable example

Remediation

Uh oh!

github-actions bot Nov 20, 2025

Choose a reason for hiding this comment

🎯 Static Application Security Testing (SAST) Vulnerability

Vulnerability Details

Overview

Vulnerable example

Remediation

Uh oh!

github-actions bot commented Nov 20, 2025

🎯 Static Application Security Testing (SAST) Vulnerability

Vulnerability Details

Overview

Vulnerable example

Remediation

Uh oh!

github-actions bot commented Nov 20, 2025

🎯 Static Application Security Testing (SAST) Vulnerability

Vulnerability Details

Overview

Vulnerable example

Remediation

Uh oh!

github-actions bot commented Nov 20, 2025

🎯 Static Application Security Testing (SAST) Vulnerability

Vulnerability Details

Overview

Vulnerable example

Remediation

Uh oh!

github-actions bot commented Nov 20, 2025

🎯 Static Application Security Testing (SAST) Vulnerability

Vulnerability Details

Overview

Vulnerable example

Remediation

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants