Skip to content

feat: Improve jf scan summary for unsupported file types #415

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

davidkopiel
Copy link

Currently, when jf scan is run on a file whose type is not supported by the Xray indexer (e.g., a plain .txt or .exe file), the command completes successfully but prints the summary message: ✨ No vulnerable components were found ✨. This is misleading for users, as it implies the file was scanned and found clean, rather than indicating it wasn't scanned at all due to incompatibility.

Solution:

This PR implements the following changes to provide clearer feedback in this scenario:

Added Warning: A log.Warn message is now printed immediately when the indexer skips a file due to an unsupported type (exit code 3), explicitly informing the user about that specific file. (Change in commands/scan/scan.go)
Track Scannable State: A new boolean field HasScannableComponents was added to the results.SecurityCommandResults struct to track whether at least one file in the scan input was successfully indexed and processed (i.e., was of a supported type). (Change in utils/results/results.go)
Set Tracking Flag: Logic was added at the end of the RunScan function to set the HasScannableComponents flag based on whether any TargetResults had their Technology identified. (Change in commands/scan/scan.go)
Conditional Summary: The output logic (in utils/results/output/resultwriter.go) was modified. Before printing the final summary, it now checks:
If zero vulnerabilities were found AND the HasScannableComponents flag is false AND files were actually attempted, it prints a new, more accurate summary: ✨ Scan completed: No files of a supported type were found or scanned. ✨
Otherwise, it prints the original summary ("No vulnerable components found" or the vulnerability table).
Benefit:

This change significantly improves the user experience by:

Providing immediate feedback when a file is skipped due to its type.
Displaying a clear and accurate summary message when only unsupported files are scanned, preventing confusion.
Testing:

Verified locally by running the modified jf scan command against:

An unsupported file type (e.g., .txt, .exe): Confirmed the warning and the new summary message appear.
A supported file type with no vulnerabilities: Confirmed the standard "No vulnerable components" message appears.
A supported file type with vulnerabilities: Confirmed the vulnerability table appears correctly.

Adds warning for unsupported files and displays specific summary when only unsupported files are scanned. Avoids misleading 'No vulnerable components' message in this case.
Copy link

github-actions bot commented Apr 28, 2025

All contributors have signed the CLA ✍️ ✅
Posted by the CLA Assistant Lite bot.

@davidkopiel
Copy link
Author

I have read the CLA Document and I hereby sign the CLA

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant