You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
When finding a vulnerability having a CWE, jake 1.4.1 seems to assume the CWE ID is numerical, and fails with a ValueError.
To Reproduce
Steps to reproduce the behavior:
Run a docker container with image python:3.6-slim: docker run --rm -it --name jaketest python:3.6-slim bash
Inside the container, install and activate a virtual environment. The version of pip inside that environment will be 18.1 which has known vulnerabilities.
Expected behavior
Jake produces a vulnerability report. In the same environment as above, this worked with jake==1.1.5.
Screenshots
Jake Version: 1.4.1
Put your Python dependencies in a chokehold
🐍 Collected 26 packages from your environment ━━━━━━━━━━━━━━━━━━ 100% 0:00:00
🐍 Successfully queried OSS Index for package and vulnerability info ━━━━━━━━━━━━━━━━━━ 100% 0:00:00
🐍 Sane number of results from OSS Index ━━━━━━━━━━━━━━━━━━ 100% 0:00:00
🐍 Munching & crunching data... ━━╺━━━━━━━━━━━━━━━ 12% 0:00:01
Traceback (most recent call last):
File "/venv/bin/jake", line 11, in <module>
sys.exit(main())
File "/venv/lib/python3.6/site-packages/jake/app.py", line 124, in main
JakeCmd().execute()
File "/venv/lib/python3.6/site-packages/jake/app.py", line 69, in execute
exit_code: int = command.execute(arguments=self._arguments)
File "/venv/lib/python3.6/site-packages/jake/command/__init__.py", line 45, in execute
return self.handle_args()
File "/venv/lib/python3.6/site-packages/jake/command/oss.py", line 137, in handle_args
cwes=[int(oic_vulnerability.get_cwe())] if oic_vulnerability.get_cwe() else None,
ValueError: invalid literal for int() with base 10: 'CWE-22'
Desktop (please complete the following information):
OS: Linux x86-64
Python Version: 3.6.15
Version: 1.4.1
The text was updated successfully, but these errors were encountered:
Describe the bug
When finding a vulnerability having a CWE, jake 1.4.1 seems to assume the CWE ID is numerical, and fails with a ValueError.
To Reproduce
Steps to reproduce the behavior:
docker run --rm -it --name jaketest python:3.6-slim bash
jake ddt
ValueError: invalid literal for int() with base 10: 'CWE-22'
, see https://gitlab.com/j2c-bce/helloworld-fastapi/-/jobs/2028565003 for an exampleExpected behavior
Jake produces a vulnerability report. In the same environment as above, this worked with jake==1.1.5.
Screenshots
Desktop (please complete the following information):
The text was updated successfully, but these errors were encountered: