Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

jf scan throws "sca graph scan" error when scanning generic JAR

Aperta
  • Qualcosa non va?
#906 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 2 giorni

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
55/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
go
Ambito
cli, security

Direzione di ricerca

Reproduce the failure with jf scan "json.jar" and with --sca --without-contextual-analysis, then trace the CLI security scan path that submits the SCA graph request. Done means a generic JAR with no dependency metadata completes without the nodes validation error, while normal scans continue to work.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug
Describe the bug

When running jf scan and providing JAR files containing class files + MANIFEST.MF but no other dependency, maven, or other project information, xray throws an error even when not requesting to run an SCA scan.

14:06:35 [🚨Error] target 'json.jar [unknown]' errors:
sca scanning 'generic://sha256:d7c7b242bbe4e16743cefeff8effa1bc685a0eb6a4d8a0d575de55d79270dfc0/json.jar' failed with error: server response: 400 Bad Request
"sca graph scan request is not valid: the field 'nodes' is required"
Current behavior

2026-10-02T14:27:21.437Z [jfxia] [DEBUG] [] [archive_mgr:732 ] [UnnamedContext ] No classification found for json.jar, classified as generic [flow_origin][cli_indexer_app]
2026-10-02T14:27:21.437Z [jfxia] [DEBUG] [] [archive_mgr:738 ] [UnnamedContext ] json.jar was classified as Generic [flow_origin][cli_indexer_app]
2026-10-02T14:27:21.437Z [jfxia] [DEBUG] [] [utils:442 ] [UnnamedContext ] total running time for indexing tree construction of json.jar: 9.3747e-05 seconds [flow_origin][cli_indexer_app]
2026-10-02T14:27:21.437Z [jfxia] [INFO ] [] [archive_mgr:356 ] [UnnamedContext ] finished walking artifact files: artifact:/json.jar, sha256:d7c7b242bbe4e16743cefeff8effa1bc685a0eb6a4d8a0d575de55d79270dfc0, filteredOut:0, inspected:26, archivesOpened:0, archivesNotOpened:0 [flow_origin][cli_indexer_app]
2026-10-02T14:27:21.437Z [jfxia] [DEBUG] [] [utils:442 ] [UnnamedContext ] total running time for indexing json.jar: 0.00163604 seconds [flow_origin][cli_indexer_app]
2026-10-02T14:27:21.689Z [jfxia] [DEBUG] [] [refiner:259 ] [UnnamedContext ] returned from external 0 comps [flow_origin][cli_indexer_app]

14:27:21 [Debug] Sending HTTP POST request to: https://XXX.jfrog.io/xray/api/v1/xsc/sca/scan/graph?multi_scan_id=XXX&scan_type=binary
14:27:21 [Debug] Sending HTTP PUT request to: https://XXX.jfrog.io/xray/api/v1/xsc/event
14:27:22 [Debug] Command event:
{{0 failed 0 0 false 6.919976092s } XXX [] }
14:27:22 [🔵Info] Trace ID for JFrog Platform logs: XXX
14:27:22 [🚨Error] target 'json.jar [unknown]' errors:
sca scanning 'generic://sha256:d7c7b242bbe4e16743cefeff8effa1bc685a0eb6a4d8a0d575de55d79270dfc0/json.jar' failed with error: server response: 400 Bad Request
"sca graph scan request is not valid: the field 'nodes' is required"

Reproduction steps

The same results with:
jf scan "json.jar"

and

jf scan "json.jar" --sca --without-contextual-analysis

Expected behavior

As the JAR is generic and does not appear to match any vulnerabilities, the scan should continue without error

JFrog CLI-Security version

3.999.999

JFrog CLI version (if applicable)

2.125.0

Operating system type and version

RHEL 8.10

JFrog Xray version

3.154.11

Lingua principale
Go
Stelle
13
Fork
52
Merge medio
2g 11h
PR unite (30g)
22

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di jfrog/jfrog-cli-security

Tutte le issue di jfrog/jfrog-cli-security

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.