Community
Products
Bitbucket
Questions
while running the pipe its getting failed. why ?

while running the pipe its getting failed. why ?

while im using the pipe bitbucket dependency scanner its getting failed.

Screenshot 2024-10-11 150451.png

2 answers

0 votes

The new version of the pipe with http error handler for annotation is released:

script:
  - pipe: atlassian/bitbucket-dependency-scanner:0.1.3

Welcome to use it and provide us with a feedback about your case.

Best regards,
Oleksandr Kyrdan

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Where is the web page/site for atlassian/bitbucket-dependency-scanner?

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

@Paul S hi.

You mean this one: bitbucket-dependency-scanner?

Additionally here is the pipe link to repository.

To discover more pipes: Bitbucket Pipes

Regards, Igor

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Like • Paul S likes this

@Oleksandr Kyrdan @Igor Stoyanov Hi, why does this warning happen in the first place? Do I need to enable something somewhere to get rid of it?

Using atlassian/bitbucket-dependency-scanner:0.3.0 - it completes successfully but ends with:

"WARNING: Skip to create annotations because of HTTP error.400 Client Error: Bad Request for url ..."

HTTP error 400 implies a malformed API request...?

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

@Anders Ervik Hi.
Thanks for your question.
Please, next time create your own topic, for your own issue.
Try to update the pipe version to 0.4.0 and see if a problem still happen.

Regards, Igor

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

@Igor Stoyanov Apologies, this reads like the same issue to me and the underlying issue seems to persist. Version 0.4.0 gives same warning.

Thanks for your reply though, it sounds like it should have worked without any external configuration, so that's helpful too.

My project is a monorepo with 9 npm projects scanned at once. Now I suspect the problem has to do with scale. I ran the pipe with DEBUG=true and examined the JSON-dump before it sends the annotations:

The JSON is 21kb, it has 13 annotation objects with `external_id`, `annotation_type`, `details` etc. The only thing that stands out is some of the 'details' fields are over 4k. I'd wager the Bitbucket annotation API does not support this large fields, but I don't have time to confirm. F.ex this one:

```

[{'external_id': 'e01eb8f4-83a1-459a-a5c6-33523ad6194e', 'annotation_type': 'VULNERABILITY', 'severity': 'moderate', 'summary': 'GHSA-9r9m-ffp6-9x4v in @intlify/core-base:10.0.4', 'path': '[REDACTED]/package-lock.json?vue-i18n:10.0.4/@intlify/core-base:10.0.4', 'details': '### Vulnerability type\nXSS\n\n### Description\nvue-i18n can be passed locale messages to `createI18n` or `useI18n`.\nwe can then translate them using `t` and `$t`.\nvue-i18n has its own syntax for local messages, and uses a message compiler to generate AST.\nIn order to maximize the performance of the translation function, vue-i18n uses bundler plugins such as `@intlify/unplugin-vue-i18n` and bulder to convert the AST in advance when building the application.\nBy using that AST as the locale message, it is no longer necessary to compile, and it is possible to translate using the AST.\n\nThe AST generated by the message compiler has special properties for each node in the AST tree to maximize performance. In the PoC example below, it is a `static` property, but that is just one of the optimizations.\nAbout details of special properties, see https://github.com/intlify/vue-i18n/blob/master/packages/message-compiler/src/nodes.ts\n\nIn general, the locale messages of vue-i18n are optimized during production builds using `@intlify/unplugin-vue-i18n`,\nso there is always a property that is attached during optimization like this time.\nBut if you are using a locale message AST in development mode or your own, there is a possibility of XSS if a third party injects.\n\n### Reproduce (PoC)\n```html\n<!doctype html>\n<html>\n <head>\n <meta charset="utf-8" />\n <title>vue-i18n XSS</title>\n <script src="https://unpkg.com/vue@3"></script>\n <script src="https://unpkg.com/vue-i18n@10"></script>\n \n <script>\n /**\n * Prototype pollution vulnerability with `Object.prototype`.\n * The \'static\' property is part of the optimized AST generated by the vue-i18n message compiler.\n * About details of special properties, see https://github.com/intlify/vue-i18n/blob/master/packages/message-compiler/src/nodes.ts\n *\n * In general, the locale messages of vue-i18n are optimized during production builds using `@intlify/unplugin-vue-i18n`,\n * so there is always a property that is attached during optimization like this time.\n * But if you are using a locale message AST in development or your own, there is a possibility of XSS if a third party injects prototype pollution code.\n */\n Object.defineProperty(Object.prototype, \'static\', {\n configurable: true,\n get() {\n alert(\'prototype polluted!\')\n return \'prototype pollution\'\n }\n })\n </script> \n </head>\n <body>\n <div id="app">\n <p>{{ t(\'hello\') }}</p>\n </div>\n <script>\n const { createApp } = Vue\n const { createI18n, useI18n } = VueI18n\n\n // AST style locale message, which build by `@intlify/unplugin-vue-i18n`\n const en = {\n hello: {\n type: 0,\n body: {\n items: [\n {\n type: 3,\n value: \'hello world!\'\n }\n ]\n }\n }\n }\n\n const i18n = createI18n({\n legacy: false,\n locale: \'en\',\n messages: {\n en\n }\n })\n\n const app = createApp({\n setup() {\n const { t } = useI18n()\n return { t }\n }\n })\n app.use(i18n)\n app.mount(\'#app\')\n </script>\n </body>\n</html>\n```\n\n### Workarounds\nBefore v10.0.0, we can work around this vulnerability by using the regular compilation (`jit: false` of `@intlify/unplugin-vue-i18n` plugin configuration) way instead of jit compilation.\n- jit compilation: https://vue-i18n.intlify.dev/guide/advanced/optimization.html#jit-compilation\n- bundler plugin option: https://github.com/intlify/bundle-tools/tree/main/packages/unplugin-vue-i18n#jitcompilation\n\n### References\n- [Simillar case: Vue 2 XSS vulnerability with prototype pollution](https://www.herodevs.com/vulnerability-directory/cve-2024-6783)\n'},

```

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

@Anders Ervik . Thanks for the additional details. Our team will investigate this.

Regards, Igor

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

@Igor Stoyanov Finally got around to reproduce it here. The full error message from the annotations API is:

{
key: 'report-service.general.bad-request',
message: 'The details field cannot contain more than 2000 characters.',
arguments: {}
}

Also tried with a long summary:

{
key: 'report-service.general.bad-request',
message: 'The summary field cannot contain more than 450 characters.',
arguments: {}
}

... based on modified examples from https://developer.atlassian.com/cloud/bitbucket/rest/api-group-reports/#api-repositories-workspace-repo-slug-commit-commit-reports-reportid-annotations-post

Wishlist:

Pipe prints full response from server on non-200 HTTP statuses
Pipe truncates summary and details at their respective size limits

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Hi @Anders Ervik

The new version with improvements is released:

script:
  - pipe: atlassian/bitbucket-dependency-scanner:0.5.0

Best regards,
Oleksandr Kyrdan

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Like • Anders Ervik likes this

0 votes

Hi @Sathish Kumar Reddy . Thanks for your question.

Please provide more details with your configuration from bitbucket-pipelines.yml
and copy log output in text format (delete all sensitive data).

Regards, Igor

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Hi Igor,
im using this owasp dependency check pipe

- pipe: atlassian/bitbucket-dependency-scanner:0.1.2

this is custom run step

dependency-check:

- step:

name: "Dependency check"

size: 8x

services:

- docker

script:

- mkdir -p $BITBUCKET_CLONE_DIR/dependency-check-report

- npm install

# Get the first 8 characters of the Bitbucket commit hash

- pipe: atlassian/bitbucket-dependency-scanner:0.1.2

variables:

NVD_API_KEY: "api key"

EXTRA_ARGS:

- "--format=HTML"

- "--project=backend-report"

REPORT_DIR_PATH: "./dependency-check-report"

DEBUG: "true"

# CREATE_REPORT: "true"

artifacts:

- dependency-check-report/**

and this is error

after the pipeline failed im getting the report in artifacts but not sure why its getting failed.
and thank u for responding..

Regards
Sathish

Screenshot 2024-10-11 174207.png

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Suggest an answer

Was this helpful?

Thanks!

Bitbucket

DEPLOYMENT TYPE

CLOUD

PRODUCT PLAN

STANDARD

PERMISSIONS LEVEL

Product Admin Site Admin

Forums

Product Q&A

Community resources

Support

Top groups

Community resources

Support

Learn

Community resources

Support

Events

Community resources

Support

while running the pipe its getting failed. why ?

2 answers

Suggest an answer

Was this helpful?

Thanks!

DEPLOYMENT TYPE

PRODUCT PLAN

PERMISSIONS LEVEL

TAGS

Atlassian Community Events

Forums

Product Q&A

Community resources

Support

Top groups

Community resources

Support

Learn

Community resources

Support

Events

Community resources

Support

while running the pipe its getting failed. why ?

2 answers

Suggest an answer

Was this helpful?

Thanks!

DEPLOYMENT TYPE

PRODUCT PLAN

PERMISSIONS LEVEL

TAGS

Atlassian Community Events

Welcome to the new Atlassian Community