Service scan support

go.mod

@@ -130,14 +130,16 @@ require (
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
 
-// replace github.com/jfrog/jfrog-cli-security => github.com/jfrog/jfrog-cli-security dev
+// attiasas:services-sub-scan-source-code
+replace github.com/jfrog/jfrog-cli-security => github.com/attiasas/jfrog-cli-security v0.0.0-20260806060325-9a4c41b4285b
 
 // replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 dev
 
 // replace github.com/jfrog/jfrog-cli-artifactory => github.com/jfrog/jfrog-cli-artifactory main
 
 // replace github.com/jfrog/build-info-go => github.com/jfrog/build-info-go dev
 
-// replace github.com/jfrog/jfrog-client-go => github.com/jfrog/jfrog-client-go master
+// orto17:missconfiguration-service
+replace github.com/jfrog/jfrog-client-go => github.com/orto17/jfrog-client-go v0.0.0-20260803124813-bb92d09fecf2
 
 // replace github.com/jfrog/froggit-go => github.com/jfrog/froggit-go master

go.sum

@@ -21,6 +21,8 @@ github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFI
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
+github.com/attiasas/jfrog-cli-security v0.0.0-20260806060325-9a4c41b4285b h1:6c8YDC2VuDY8c90dZ2gCz9Vt9apJUz+mRqCgynJAKNE=
+github.com/attiasas/jfrog-cli-security v0.0.0-20260806060325-9a4c41b4285b/go.mod h1:YhlMkzTmOlKl9tgm2l9ye22mt6S7eBv5DU4g3Tu5y1M=
 github.com/beevik/etree v1.7.0 h1:xjBk9O4p4x7D1YajePjfLzdaFC4/uYUENA7P0pv6gXA=
 github.com/beevik/etree v1.7.0/go.mod h1:bh4zJxiIr62SOf9pRzN7UUYaEDa9HEKafK25+sLc0Gc=
 github.com/bradleyjkemp/cupaloy/v2 v2.8.0 h1:any4BmKE+jGIaMpnU8YgH/I2LPiLBufr6oMMlVBbn9M=
@@ -154,10 +156,6 @@ github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260803134309-cea6be60a1f2 h1:I
 github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260803134309-cea6be60a1f2/go.mod h1:1vxzqW7jHBSuTNqO2vxEnhbniwq4dj5wveDuCMJX7Yo=
 github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260728123939-34b27f070f2e h1:K0IK3w5a5h6SIi9yoOJ6a7DL+kuFjs5acypOxKyT2OM=
 github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260728123939-34b27f070f2e/go.mod h1:MygQx8pekgPCXyXnejIAVG9S4ImGcDFmcfRPUug/0d0=
-github.com/jfrog/jfrog-cli-security v1.32.1 h1:GQ89waCbRZSL6fEpFwGWpIeiy2c8SNUTzccyec2QC1Y=
-github.com/jfrog/jfrog-cli-security v1.32.1/go.mod h1:BKhIR0RkW0KMIdAeJbufG4rl44wZbpn+5bfE2jEN338=
-github.com/jfrog/jfrog-client-go v1.55.1-0.20260803094922-a87c05639195 h1:1h6qSM8fanMsy9xT7zrRn/lrAMclzQzT5OJt4a9X4Qo=
-github.com/jfrog/jfrog-client-go v1.55.1-0.20260803094922-a87c05639195/go.mod h1:FHpjN1nTDoj96xd6obe27EOgGErqzU0rQgC96L3Ch9E=
 github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c=
 github.com/jhump/protoreflect v1.15.1/go.mod h1:jD/2GMKKE6OqX8qTjhADU1e6DShO+gavG9e0Q693nKo=
 github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY=
@@ -215,6 +213,8 @@ github.com/oklog/run v1.0.0 h1:Ru7dDtJNOyC66gQ5dQmaCa0qIsAUFY3sFpK1Xk8igrw=
 github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA=
 github.com/onsi/gomega v1.38.2 h1:eZCjf2xjZAqe+LeWvKb5weQ+NcPwX84kqJ0cZNxok2A=
 github.com/onsi/gomega v1.38.2/go.mod h1:W2MJcYxRGV63b418Ai34Ud0hEdTVXq9NW9+Sx6uXf3k=
+github.com/orto17/jfrog-client-go v0.0.0-20260803124813-bb92d09fecf2 h1:CVSdxDuYR3F7WXTXO4Pn1eSFRKE3X/bKeHhvGL+xhlY=
+github.com/orto17/jfrog-client-go v0.0.0-20260803124813-bb92d09fecf2/go.mod h1:FHpjN1nTDoj96xd6obe27EOgGErqzU0rQgC96L3Ch9E=
 github.com/owenrumney/go-sarif/v3 v3.2.3 h1:n6mdX5ugKwCrZInvBsf6WumXmpAe3mbmQXgkXlIq34U=
 github.com/owenrumney/go-sarif/v3 v3.2.3/go.mod h1:1bV7t8SZg7pX41spaDkEUs8/yEjzk9JapztMoX1XNjg=
 github.com/package-url/packageurl-go v0.1.3 h1:4juMED3hHiz0set3Vq3KeQ75KD1avthoXLtmE3I0PLs=

scanpullrequest/scanpullrequest.go

@@ -195,6 +195,7 @@ func filterFailedResultsIfScannersFailuresAreAllowed(targetResults, sourceResult
 		filterScaResultsIfScanFailed(targetSourceResultsPair.target, targetSourceResultsPair.source)
 		filterJasResultsIfScanFailed(targetSourceResultsPair.target, targetSourceResultsPair.source, results.CmdStepContextualAnalysis)
 		filterJasResultsIfScanFailed(targetSourceResultsPair.target, targetSourceResultsPair.source, results.CmdStepSecrets)
+		filterJasResultsIfScanFailed(targetSourceResultsPair.target, targetSourceResultsPair.source, results.CmdStepServices)
 		filterJasResultsIfScanFailed(targetSourceResultsPair.target, targetSourceResultsPair.source, results.CmdStepIaC)
 		filterJasResultsIfScanFailed(targetSourceResultsPair.target, targetSourceResultsPair.source, results.CmdStepSast)
 	}
@@ -204,6 +205,7 @@ func filterFailedResultsIfScannersFailuresAreAllowed(targetResults, sourceResult
 		filterScaResultsIfScanFailed(targetSourceResultsPair.target, targetSourceResultsPair.source)
 		filterJasResultsIfScanFailed(targetSourceResultsPair.target, targetSourceResultsPair.source, results.CmdStepContextualAnalysis)
 		filterJasResultsIfScanFailed(targetSourceResultsPair.target, targetSourceResultsPair.source, results.CmdStepSecrets)
+		filterJasResultsIfScanFailed(targetSourceResultsPair.target, targetSourceResultsPair.source, results.CmdStepServices)
 		filterJasResultsIfScanFailed(targetSourceResultsPair.target, targetSourceResultsPair.source, results.CmdStepIaC)
 		filterJasResultsIfScanFailed(targetSourceResultsPair.target, targetSourceResultsPair.source, results.CmdStepSast)
 	}
@@ -213,6 +215,7 @@ func filterFailedResultsIfScannersFailuresAreAllowed(targetResults, sourceResult
 		filterScaResultsIfScanFailed(nil, sourceResult)
 		filterJasResultsIfScanFailed(nil, sourceResult, results.CmdStepContextualAnalysis)
 		filterJasResultsIfScanFailed(nil, sourceResult, results.CmdStepSecrets)
+		filterJasResultsIfScanFailed(nil, sourceResult, results.CmdStepServices)
 		filterJasResultsIfScanFailed(nil, sourceResult, results.CmdStepIaC)
 		filterJasResultsIfScanFailed(nil, sourceResult, results.CmdStepSast)
 	}
@@ -256,6 +259,12 @@ func filterSpecificScannersViolationsIfScanFailed(sourceResults *results.Securit
 		sourceResults.Violations.Secrets = nil
 	}
 
+	if (sourceStatusCodes.ServicesScanStatusCode != nil && *sourceStatusCodes.ServicesScanStatusCode != 0) ||
+		(targetStatusCodes.ServicesScanStatusCode != nil && *targetStatusCodes.ServicesScanStatusCode != 0) {
+		log.Debug(fmt.Sprintf(violationsFilteringErrorMessage, results.CmdStepServices))
+		sourceResults.Violations.Services = nil
+	}
+
 	if (sourceStatusCodes.IacScanStatusCode != nil && *sourceStatusCodes.IacScanStatusCode != 0) ||
 		(targetStatusCodes.IacScanStatusCode != nil && *targetStatusCodes.IacScanStatusCode != 0) {
 		log.Debug(fmt.Sprintf(violationsFilteringErrorMessage, results.CmdStepIaC))
@@ -354,6 +363,10 @@ func filterJasResultsIfScanFailed(targetResult, sourceResult *results.TargetResu
 		if sourceResult.JasResults != nil {
 			sourceResult.JasResults.JasVulnerabilities.SecretsScanResults = nil
 		}
+	case results.CmdStepServices:
+		if sourceResult.JasResults != nil {
+			sourceResult.JasResults.JasVulnerabilities.ServicesScanResults = nil
+		}
 	case results.CmdStepIaC:
 		if sourceResult.JasResults != nil {
 			sourceResult.JasResults.JasVulnerabilities.IacScanResults = nil
@@ -445,6 +458,9 @@ func scanResultsToIssuesCollection(scanResults *results.SecurityCommandResults,
 		IacVulnerabilities: simpleJsonResults.IacsVulnerabilities,
 		IacViolations:      simpleJsonResults.IacsViolations,
 
+		ServicesVulnerabilities: simpleJsonResults.ServicesVulnerabilities,
+		ServicesViolations:      simpleJsonResults.ServicesViolations,
+
 		SecretsVulnerabilities: simpleJsonResults.SecretsVulnerabilities,
 		SecretsViolations:      simpleJsonResults.SecretsViolations,
 
@@ -484,6 +500,7 @@ func getScanStatus(cmdResults ...formats.SimpleJsonResults) formats.ScanStatus {
 	for _, sourceResults := range cmdResults[1:] {
 		statuses.ScaStatusCode = getWorstScanStatus(statuses.ScaStatusCode, sourceResults.Statuses.ScaStatusCode)
 		statuses.IacStatusCode = getWorstScanStatus(statuses.IacStatusCode, sourceResults.Statuses.IacStatusCode)
+		statuses.ServicesStatusCode = getWorstScanStatus(statuses.ServicesStatusCode, sourceResults.Statuses.ServicesStatusCode)
 		statuses.SecretsStatusCode = getWorstScanStatus(statuses.SecretsStatusCode, sourceResults.Statuses.SecretsStatusCode)
 		statuses.SastStatusCode = getWorstScanStatus(statuses.SastStatusCode, sourceResults.Statuses.SastStatusCode)
 		statuses.ApplicabilityStatusCode = getWorstScanStatus(statuses.ApplicabilityStatusCode, sourceResults.Statuses.ApplicabilityStatusCode)

scanpullrequest/scanpullrequest_test.go

@@ -75,6 +75,7 @@ func TestScanResultsToIssuesCollection(t *testing.T) {
 			ScaScanStatusCode:            securityutils.NewIntPtr(0),
 			ContextualAnalysisStatusCode: securityutils.NewIntPtr(0),
 			IacScanStatusCode:            securityutils.NewIntPtr(0),
+			ServicesScanStatusCode:       securityutils.NewIntPtr(0),
 			SecretsScanStatusCode:        securityutils.NewIntPtr(0),
 			SastScanStatusCode:           securityutils.NewIntPtr(0),
 		},
@@ -107,6 +108,13 @@ func TestScanResultsToIssuesCollection(t *testing.T) {
 						),
 					),
 				},
+				ServicesScanResults: []*sarif.Run{
+					sarifutils.CreateRunWithDummyResults(
+						sarifutils.CreateResultWithLocations("Exposed service endpoint detected", "rule", severityutils.SeverityToSarifSeverityLevel(severityutils.Medium).String(),
+							sarifutils.CreateLocation("service.yaml", 1, 10, 2, 11, "services-snippet"),
+						),
+					),
+				},
 				SecretsScanResults: []*sarif.Run{
 					sarifutils.CreateRunWithDummyResults(
 						sarifutils.CreateResultWithLocations("Secret", "rule", severityutils.SeverityToSarifSeverityLevel(severityutils.High).String(),
@@ -166,6 +174,27 @@ func TestScanResultsToIssuesCollection(t *testing.T) {
 				},
 			},
 		},
+		ServicesVulnerabilities: []formats.SourceCodeRow{
+			{
+				SeverityDetails: formats.SeverityDetails{
+					Severity:         "Medium",
+					SeverityNumValue: 26,
+				},
+				ScannerInfo: formats.ScannerInfo{
+					ScannerDescription: "rule-msg",
+					RuleId:             "rule",
+				},
+				Finding: "Exposed service endpoint detected",
+				Location: formats.Location{
+					File:        "service.yaml",
+					StartLine:   1,
+					StartColumn: 10,
+					EndLine:     2,
+					EndColumn:   11,
+					Snippet:     "services-snippet",
+				},
+			},
+		},
 		SecretsVulnerabilities: []formats.SourceCodeRow{
 			{
 				SeverityDetails: formats.SeverityDetails{
@@ -215,6 +244,7 @@ func TestScanResultsToIssuesCollection(t *testing.T) {
 	if assert.NoError(t, err) {
 		assert.ElementsMatch(t, expectedOutput.ScaVulnerabilities, issuesRows.ScaVulnerabilities)
 		assert.ElementsMatch(t, expectedOutput.IacVulnerabilities, issuesRows.IacVulnerabilities)
+		assert.ElementsMatch(t, expectedOutput.ServicesVulnerabilities, issuesRows.ServicesVulnerabilities)
 		assert.ElementsMatch(t, expectedOutput.SecretsVulnerabilities, issuesRows.SecretsVulnerabilities)
 		assert.ElementsMatch(t, expectedOutput.SastVulnerabilities, issuesRows.SastVulnerabilities)
 		assert.ElementsMatch(t, expectedOutput.LicensesViolations, issuesRows.LicensesViolations)
@@ -584,6 +614,31 @@ func TestFilterJasResultsIfScanFailed(t *testing.T) {
 			},
 			hasFailure: true,
 		},
+		{
+			name:    "Services scanner failed - should remove Services vulnerabilities",
+			cmdStep: results.CmdStepServices,
+			targetResult: &results.TargetResults{
+				JasResults: &results.JasScansResults{
+					JasVulnerabilities: results.JasScanResults{
+						ServicesScanResults: []*sarif.Run{},
+					},
+				},
+				ResultsStatus: results.ResultsStatus{
+					ServicesScanStatusCode: intPtr(0),
+				},
+			},
+			sourceResult: &results.TargetResults{
+				JasResults: &results.JasScansResults{
+					JasVulnerabilities: results.JasScanResults{
+						ServicesScanResults: []*sarif.Run{},
+					},
+				},
+				ResultsStatus: results.ResultsStatus{
+					ServicesScanStatusCode: intPtr(1),
+				},
+			},
+			hasFailure: true,
+		},
 		{
 			name:    "SAST scanner failed - should remove SAST vulnerabilities",
 			cmdStep: results.CmdStepSast,
@@ -699,6 +754,8 @@ func TestFilterJasResultsIfScanFailed(t *testing.T) {
 					assert.Nil(t, test.sourceResult.JasResults.JasVulnerabilities.SecretsScanResults, "Secrets vulnerability scan results should be removed when scan failed")
 				case results.CmdStepIaC:
 					assert.Nil(t, test.sourceResult.JasResults.JasVulnerabilities.IacScanResults, "IaC vulnerability scan results should be removed when scan failed")
+				case results.CmdStepServices:
+					assert.Nil(t, test.sourceResult.JasResults.JasVulnerabilities.ServicesScanResults, "Services vulnerability scan results should be removed when scan failed")
 				case results.CmdStepSast:
 					assert.Nil(t, test.sourceResult.JasResults.JasVulnerabilities.SastScanResults, "SAST vulnerability scan results should be removed when scan failed")
 				}
@@ -1138,6 +1195,7 @@ func TestFilterViolationsResults(t *testing.T) {
 		shouldRemoveSca           bool
 		shouldRemoveSecrets       bool
 		shouldRemoveIac           bool
+		shouldRemoveServices      bool
 		shouldRemoveSast          bool
 		shouldRemoveAllViolations bool
 	}{
@@ -1171,6 +1229,20 @@ func TestFilterViolationsResults(t *testing.T) {
 			targetResults:   createSecurityCommandResultsForTest("test-target", "", false, false, false, false, false, false, 0, 0, 0, 1, 0, 0),
 			shouldRemoveIac: true,
 		},
+		{
+			name: "Violations scan succeeded, Services scan failed in source - should remove only Services violations",
+			sourceResults: func() *results.SecurityCommandResults {
+				result := createSecurityCommandResultsForTest("test-target", "", false, false, false, false, false, true, 0, 0, 0, 0, 0, 0)
+				result.Targets[0].ResultsStatus.ServicesScanStatusCode = intPtr(1)
+				return result
+			}(),
+			targetResults: func() *results.SecurityCommandResults {
+				result := createSecurityCommandResultsForTest("test-target", "", false, false, false, false, false, false, 0, 0, 0, 0, 0, 0)
+				result.Targets[0].ResultsStatus.ServicesScanStatusCode = intPtr(0)
+				return result
+			}(),
+			shouldRemoveServices: true,
+		},
 		{
 			name:             "Violations scan succeeded, SAST scan failed in source - should remove only SAST violations",
 			sourceResults:    createSecurityCommandResultsForTest("test-target", "", false, false, false, false, false, true, 0, 0, 0, 0, 1, 0),
@@ -1230,6 +1302,12 @@ func TestFilterViolationsResults(t *testing.T) {
 					assert.NotNil(t, test.sourceResults.Violations.Iac, "IaC violations should NOT be removed")
 				}
 
+				if test.shouldRemoveServices {
+					assert.Nil(t, test.sourceResults.Violations.Services, "Services violations should be removed")
+				} else {
+					assert.NotNil(t, test.sourceResults.Violations.Services, "Services violations should NOT be removed")
+				}
+
 				if test.shouldRemoveSast {
 					assert.Nil(t, test.sourceResults.Violations.Sast, "SAST violations should be removed")
 				} else {
@@ -1315,6 +1393,21 @@ func TestIsScanFailedInSourceOrTarget(t *testing.T) {
 			step:         results.CmdStepIaC,
 			expected:     true,
 		},
+		{
+			name: "Services scan failed in source - should return true",
+			sourceResult: &results.TargetResults{
+				ResultsStatus: results.ResultsStatus{
+					ServicesScanStatusCode: intPtr(1),
+				},
+			},
+			targetResult: &results.TargetResults{
+				ResultsStatus: results.ResultsStatus{
+					ServicesScanStatusCode: intPtr(0),
+				},
+			},
+			step:     results.CmdStepServices,
+			expected: true,
+		},
 		{
 			name:         "Both are nil - should return false",
 			sourceResult: nil,
@@ -1500,10 +1593,11 @@ func createSecurityCommandResultsForTest(targetLocation string, targetName strin
 
 	if withViolations {
 		result.Violations = &violationutils.Violations{
-			Sca:     []violationutils.CveViolation{{}},
-			Secrets: []violationutils.JasViolation{{}},
-			Iac:     []violationutils.JasViolation{{}},
-			Sast:    []violationutils.JasViolation{{}},
+			Sca:      []violationutils.CveViolation{{}},
+			Secrets:  []violationutils.JasViolation{{}},
+			Iac:      []violationutils.JasViolation{{}},
+			Services: []violationutils.JasViolation{{}},
+			Sast:     []violationutils.JasViolation{{}},
 		}
 	}
 

testdata/messages/integration/test_proj_pip_with_vulnerability.md

@@ -19,6 +19,7 @@
 | **Contextual Analysis** | ✅ Done | - |
 | **Static Application Security Testing (SAST)** | ✅ Done | Not Found |
 | **Secrets** | ✅ Done | - |
+| **Services** | ℹ️ Not Scanned | - |
 | **Infrastructure as Code (IaC)** | ✅ Done | Not Found |
 
 ### 📦 Vulnerable Dependencies

testdata/messages/integration/test_proj_with_vulnerability_simplified.md

@@ -18,6 +18,7 @@
 | **Contextual Analysis** | ✅ Done | - |
 | **Static Application Security Testing (SAST)** | ✅ Done | Not Found |
 | **Secrets** | ✅ Done | - |
+| **Services** | ℹ️ Not Scanned | - |
 | **Infrastructure as Code (IaC)** | ✅ Done | Not Found |
 
 

testdata/messages/integration/test_proj_with_vulnerability_standard.md

@@ -19,6 +19,7 @@
 | **Contextual Analysis** | ✅ Done | - |
 | **Static Application Security Testing (SAST)** | ✅ Done | Not Found |
 | **Secrets** | ✅ Done | - |
+| **Services** | ℹ️ Not Scanned | - |
 | **Infrastructure as Code (IaC)** | ✅ Done | Not Found |
 
 ### 📦 Vulnerable Dependencies

testdata/messages/reviewcomment/services/services_review_content_simplified.md

@@ -0,0 +1,28 @@
+
+
+---
+## 🔌 Services Vulnerability
+
+---
+| Severity                | Finding                  |
+| :---------------------: | :-----------------------------------: |
+| Medium | Exposed service endpoint detected |
+
+
+---
+### Full description
+
+---
+
+
+
+---
+### Vulnerability Details
+
+---
+|                 |                   |
+| --------------------- | :-----------------------------------: |
+| **Rule ID:** | rule-id |
+
+Scanner Description....
+

testdata/messages/reviewcomment/services/services_review_content_standard.md

@@ -0,0 +1,21 @@
+
+## 🔌 Services Vulnerability
+<div align='center'>
+
+| Severity                | Finding                  |
+| :---------------------: | :-----------------------------------: |
+| ![medium](https://raw.githubusercontent.com/jfrog/frogbot/master/resources/v2/applicableMediumSeverity.png)<br>  Medium | Exposed service endpoint detected |
+
+</div>
+
+
+<details><summary><b>Full description</b></summary>
+
+### Vulnerability Details
+|                 |                   |
+| --------------------- | :-----------------------------------: |
+| **Rule ID:** | rule-id |
+
+Scanner Description....
+
+<br></details>

testdata/messages/reviewcomment/services/services_violation_review_content_simplified.md

@@ -0,0 +1,28 @@
+
+
+---
+## 🔌 Services Violation
+
+---
+| Severity                | ID                  | Finding                  | Watch Name                  | Policies                  |
+| :---------------------: | :-----------------------------------: | :-----------------------------------: | :-----------------------------------: | :-----------------------------------: |
+| Medium | services-violation-id | Exposed service endpoint detected | jas-watch | policy1, policy2 |
+
+
+---
+### Full description
+
+---
+
+
+
+---
+### Violation Details
+
+---
+|                 |                   |
+| --------------------- | :-----------------------------------: |
+| **Rule ID:** | rule-id |
+
+Scanner Description....
+