Skip to content

Adding token validation info to Frogbot's output #1005

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
eranturgeman wants to merge 2 commits into from
+41 −30
Closed

Adding token validation info to Frogbot's output #1005

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cd7601e
adding Token validation to Frogbot's output
eranturgeman Dec 21, 2025
e4d7901
CR comments
eranturgeman Dec 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions testdata/messages/reviewcomment/secrets/secret_review_content_simplified.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,9 @@
## 🤫 Secret Vulnerability

---
| Severity | Status | Origin | Finding |
| :---------------------: | :-----------------------------------: | :-----------------------------------: | :-----------------------------------: |
| High | Active | JFrog | Secret keys were found |
| Severity | Token Validation | Token Info | Origin | Finding |
| :---------------------: | :-----------------------------------: | :-----------------------------------: | :-----------------------------------: | :-----------------------------------: |
| High | Active | The token was validated and found to be active. This indicates that the secret is currently in use. | JFrog | Secret keys were found |


---
Expand Down
6 changes: 3 additions & 3 deletions testdata/messages/reviewcomment/secrets/secret_review_content_standard.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,9 @@
## 🤫 Secret Vulnerability
<div align='center'>

| Severity | Status | Origin | Finding |
| :---------------------: | :-----------------------------------: | :-----------------------------------: | :-----------------------------------: |
| ![high](https://raw.githubusercontent.com/jfrog/frogbot/master/resources/v2/applicableHighSeverity.png)<br> High | Active | JFrog | Secret keys were found |
| Severity | Token Validation | Token Info | Origin | Finding |
| :---------------------: | :-----------------------------------: | :-----------------------------------: | :-----------------------------------: | :-----------------------------------: |
| ![high](https://raw.githubusercontent.com/jfrog/frogbot/master/resources/v2/applicableHighSeverity.png)<br> High | Active | The token was validated and found to be active. This indicates that the secret is currently in use. | JFrog | Secret keys were found |

</div>

Expand Down
8 changes: 4 additions & 4 deletions ...ta/messages/reviewcomment/secrets/secret_violation_review_content_simplified.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,10 @@
## 🤫 Secret Violation

---
| Severity | ID | Status | Origin | Finding | Watch Name | Policies |
| :---------------------: | :-----------------------------------: | :-----------------------------------: | :-----------------------------------: | :-----------------------------------: | :-----------------------------------: | :-----------------------------------: |
| High | secret-violation-id | Active | JFrog | Secret keys were found | jas-watch | policy1 |
| Critical | secret-violation-id-2 | Inactive | JFrog | Secret keys were found | jas-watch2 | policy1, policy2 |
| Severity | ID | Token Validation | Token Info | Origin | Finding | Watch Name | Policies |
| :---------------------: | :-----------------------------------: | :-----------------------------------: | :-----------------------------------: | :-----------------------------------: | :-----------------------------------: | :-----------------------------------: | :-----------------------------------: |
| High | secret-violation-id | Active | The token was validated and found to be active. This indicates that the secret is currently in use. | JFrog | Secret keys were found | jas-watch | policy1 |
| Critical | secret-violation-id-2 | Inactive | The token was validated and found to be inactive. This indicates that the secret is no longer in use. | JFrog | Secret keys were found | jas-watch2 | policy1, policy2 |


---
Expand Down
8 changes: 4 additions & 4 deletions ...data/messages/reviewcomment/secrets/secret_violation_review_content_standard.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,10 @@
## 🤫 Secret Violation
<div align='center'>

| Severity | ID | Status | Origin | Finding | Watch Name | Policies |
| :---------------------: | :-----------------------------------: | :-----------------------------------: | :-----------------------------------: | :-----------------------------------: | :-----------------------------------: | :-----------------------------------: |
| ![high](https://raw.githubusercontent.com/jfrog/frogbot/master/resources/v2/applicableHighSeverity.png)<br> High | secret-violation-id | Active | JFrog | Secret keys were found | jas-watch | policy1 |
| ![critical (not applicable)](https://raw.githubusercontent.com/jfrog/frogbot/master/resources/v2/notApplicableCritical.png)<br>Critical | secret-violation-id-2 | Inactive | JFrog | Secret keys were found | jas-watch2 | policy1<br>policy2 |
| Severity | ID | Token Validation | Token Info | Origin | Finding | Watch Name | Policies |
| :---------------------: | :-----------------------------------: | :-----------------------------------: | :-----------------------------------: | :-----------------------------------: | :-----------------------------------: | :-----------------------------------: | :-----------------------------------: |
| ![high](https://raw.githubusercontent.com/jfrog/frogbot/master/resources/v2/applicableHighSeverity.png)<br> High | secret-violation-id | Active | The token was validated and found to be active. This indicates that the secret is currently in use. | JFrog | Secret keys were found | jas-watch | policy1 |
| ![critical (not applicable)](https://raw.githubusercontent.com/jfrog/frogbot/master/resources/v2/notApplicableCritical.png)<br>Critical | secret-violation-id-2 | Inactive | The token was validated and found to be inactive. This indicates that the secret is no longer in use. | JFrog | Secret keys were found | jas-watch2 | policy1<br>policy2 |

</div>

Expand Down
18 changes: 10 additions & 8 deletions utils/outputwriter/outputcontent.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -524,28 +524,30 @@ func SecretReviewContent(violation bool, writer OutputWriter, issues ...formats.

func getSecretsDescriptionTable(writer OutputWriter, issues ...formats.SourceCodeRow) string {
// Construct table
table := NewMarkdownTable("Severity", "ID", "Status", "Origin", "Finding", "Watch Name", "Policies").SetDelimiter(writer.Separator())
table := NewMarkdownTable("Severity", "ID", "Token Validation", "Token Info", "Origin", "Finding", "Watch Name", "Policies").SetDelimiter(writer.Separator())
// Hide optional columns if all empty (violations/no status)
table.GetColumnInfo("ID").OmitEmpty = true
table.GetColumnInfo("Status").OmitEmpty = true
table.GetColumnInfo("Token Validation").OmitEmpty = true
table.GetColumnInfo("Token Info").OmitEmpty = true
table.GetColumnInfo("Watch Name").OmitEmpty = true
table.GetColumnInfo("Policies").OmitEmpty = true
// Construct rows
for _, issue := range issues {
// Determine the issue applicable status
applicability := jasutils.Applicable.String()
status := ""
tokenValidationStatus := ""
tokenValidationInfo := ""
if issue.Applicability != nil && issue.Applicability.Status != "" {
status = issue.Applicability.Status
if status == jasutils.Inactive.String() {
// Update the applicability status to Not Applicable for Inactive
tokenValidationStatus = issue.Applicability.Status
if tokenValidationStatus == jasutils.Inactive.String() {
applicability = jasutils.NotApplicable.String()
}
tokenValidationInfo = issue.Applicability.ScannerDescription
}
table.AddRowWithCellData(
NewCellData(writer.FormattedSeverity(issue.Severity, applicability)),
NewCellData(issue.IssueId),
NewCellData(status),
NewCellData(tokenValidationStatus),
NewCellData(tokenValidationInfo),
NewCellData(issue.ScannerInfo.Origin),
NewCellData(issue.Finding),
NewCellData(issue.Watch),
Expand Down
25 changes: 17 additions & 8 deletions utils/outputwriter/outputcontent_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -882,11 +882,14 @@ func TestSecretsReviewContent(t *testing.T) {
},
},
{
name: "Secret review comment content with applicability status",
name: "Secret review comment content with applicability status and info",
issues: []formats.SourceCodeRow{{
SeverityDetails: formats.SeverityDetails{Severity: "High"},
Applicability: &formats.Applicability{Status: jasutils.Active.String()},
Finding: "Secret keys were found",
Applicability: &formats.Applicability{
Status: jasutils.Active.String(),
ScannerDescription: "The token was validated and found to be active. This indicates that the secret is currently in use.",
},
Finding: "Secret keys were found",
ScannerInfo: formats.ScannerInfo{
RuleId: "rule-id",
Cwe: []string{"CWE-798", "CWE-799"},
Expand All @@ -909,12 +912,15 @@ func TestSecretsReviewContent(t *testing.T) {
},
},
{
name: "Secrets violation review comment content with applicability status",
name: "Secrets violation review comment content with applicability status and info",
issues: []formats.SourceCodeRow{
{
SeverityDetails: formats.SeverityDetails{Severity: "High"},
Applicability: &formats.Applicability{Status: jasutils.Active.String()},
Finding: "Secret keys were found",
Applicability: &formats.Applicability{
Status: jasutils.Active.String(),
ScannerDescription: "The token was validated and found to be active. This indicates that the secret is currently in use.",
},
Finding: "Secret keys were found",
ScannerInfo: formats.ScannerInfo{
RuleId: "rule-id",
Cwe: []string{"CWE-798", "CWE-799"},
Expand All @@ -930,8 +936,11 @@ func TestSecretsReviewContent(t *testing.T) {
},
{
SeverityDetails: formats.SeverityDetails{Severity: "Critical"},
Applicability: &formats.Applicability{Status: jasutils.Inactive.String()},
Finding: "Secret keys were found",
Applicability: &formats.Applicability{
Status: jasutils.Inactive.String(),
ScannerDescription: "The token was validated and found to be inactive. This indicates that the secret is no longer in use.",
},
Finding: "Secret keys were found",
ScannerInfo: formats.ScannerInfo{
RuleId: "rule-id",
Cwe: []string{"CWE-798", "CWE-799"},
Expand Down
Loading