Skip to content

Add risky tech callback guard after techs detection - #852

Merged
eranturgeman merged 5 commits into
jfrog:devfrom
eranturgeman:feature/frogbot-v3-env-guard-maven-gradle
Aug 17, 2026
Merged

Add risky tech callback guard after techs detection#852
eranturgeman merged 5 commits into
jfrog:devfrom
eranturgeman:feature/frogbot-v3-env-guard-maven-gradle

Conversation

@eranturgeman

@eranturgeman eranturgeman commented Aug 16, 2026

Copy link
Copy Markdown
Contributor
  • The pull request is targeting the dev branch.
  • The code has been validated to compile successfully by running go vet ./....
  • The code has been formatted properly using go fmt ./....
  • All static analysis checks passed.
  • All tests have passed. If this feature is not already covered by the tests, new tests have been added.
  • Updated the Contributing page / ReadMe page / CI Workflow files if needed.
  • All changes are detailed at the description. if not already covered at JFrog Documentation, new documentation have been added.

This PR adds ability to accept and execute a function that guards from executing risky technologies without proper validations.
When executing Frogbot we are exposed to untrusted code contributions (through PRs). In Maven and Gradle when we use the dep-tree plugins the tasks being executed are running scripts found in the repo prior to the task itself. In order to prevet malicious code execution we are adding an optional guard function that can be provided to audit. if not provided - no-op

@eranturgeman
eranturgeman requested a review from a team August 16, 2026 14:31
@eranturgeman eranturgeman added improvement Automatically generated release notes safe to test Approve running integration tests on a pull request labels Aug 16, 2026
@github-actions github-actions Bot removed the safe to test Approve running integration tests on a pull request label Aug 16, 2026
@eranturgeman eranturgeman added the safe to test Approve running integration tests on a pull request label Aug 16, 2026
@github-actions github-actions Bot removed the safe to test Approve running integration tests on a pull request label Aug 16, 2026
@eranturgeman eranturgeman added the safe to test Approve running integration tests on a pull request label Aug 16, 2026
@github-actions github-actions Bot removed the safe to test Approve running integration tests on a pull request label Aug 16, 2026

@attiasas attiasas left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice, check out my comment

Comment thread commands/audit/audit.go Outdated
Comment thread commands/audit/audit.go Outdated
@eranturgeman eranturgeman added the safe to test Approve running integration tests on a pull request label Aug 17, 2026
@github-actions github-actions Bot removed the safe to test Approve running integration tests on a pull request label Aug 17, 2026

@attiasas attiasas left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@eranturgeman eranturgeman added the safe to test Approve running integration tests on a pull request label Aug 17, 2026
@github-actions github-actions Bot removed the safe to test Approve running integration tests on a pull request label Aug 17, 2026
@github-actions

Copy link
Copy Markdown
Contributor

👍 Frogbot scanned this pull request and did not find any new security issues.


@eranturgeman
eranturgeman merged commit 6ed2fda into jfrog:dev Aug 17, 2026
65 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

improvement Automatically generated release notes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants