95
questions
-1
votes
0
answers
66
views
Snyk vulnerability for sending unsanitized HTML from Nodejs server
I have a route in node.js express server, which hits to a remote html document and returns the content of remote html document as 'text/html' in response.
Snyk complains this saying: "Unsanitized ...
1
vote
1
answer
94
views
Failed to download or update Snyk dependencies. "code":"UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
I am trying to install snyk extension on VScode. i am getting this error message in output window of VSCode
[Error] Failed to download or update Snyk dependencies. {"code":"...
0
votes
2
answers
95
views
Snyk denial of service: utp:[email protected] > io.grpc:[email protected] > io.netty:[email protected]
I've encountered a vulnerability after running the Snyk open source security management tool and am not sure how to resolve it.
I believe this is related to a library pulled in by the Android Gradle ...
0
votes
0
answers
220
views
How can I fix "CVE-2023-42364 busybox/busybox Use After Free" vulnerability in node:alpine for Next.js application?
I have the following Dockerfile for my Next.js application:
FROM node:alpine AS base
# 2) Install dependencies only when needed.
FROM base AS deps
# 3) Install packages with no cache
RUN apk add --...
0
votes
0
answers
34
views
Implementing a Scheduled Code Scan on AWS CodeCommit with Snyk
I am currently using AWS CodeCommit for my version control system and Snyk for scanning my codebase for vulnerabilities. I am interested in setting up a weekly scheduled scan of my codebase with Snyk.
...
0
votes
1
answer
287
views
Unsanitized input from an HTTP parameter flows into django.http.HttpResponse
In my python (django) project, I have following code snippet
someError = request.GET.get('error', None)
if someError is not None:
self.logger.exception(f'Authorization failed ...
1
vote
0
answers
174
views
Snyk test fails when executed via Jenkins
We are getting the following error when running the Jenkins job to test our React Native code base for vulnerabilities.
Snyk installation is UP-TO-DATE
Testing for known issues...
> /Users/...
0
votes
0
answers
651
views
Invalid OCI archive error for snyk/actions/docker@master
I am trying to implement the following workflow for my image which was built successfully:
# Step 1: Build a Docker image
- name: Build a Docker image
run: docker build --no-cache -f ./Dockerfile --...
0
votes
0
answers
85
views
Login with AJAX and Open Redirect Vulnerability
I have a ASP.NET Core 8 MVC project where user login is an AJAX request that if successfull redirects user to "home" (or another internal page).
This situation made SNYK trigger an "...
-1
votes
1
answer
126
views
How to pass gradle project properties for snyk test of gradle project
In case we pass environment variable for values of a gradle's project property
say in build.gradle say, we use:
url "https://${nexusDomain}/repository/gvhvid-maven-public"
then running snyk ...
1
vote
1
answer
668
views
Snyk doesn't check vulnerabilities in main code files
I added my github projects to snyk.io portal to check vulnerabilities. Sadly, snyk is only checking files ending with the .json, .yml, .txt etc. It's not checking vulnerabilities in typescript, js, ...
0
votes
2
answers
350
views
How do I configure my .snyk file to fail the build automatically if the setting to ignore a particular vulnerability has passed its expiry?
I have a .snyk policy file which is supposed to ignore vulnerabilities until a given date:
version: v1.25.0
ignore:
<REDACTED>:
- '*':
reason: >-
This ...
0
votes
1
answer
697
views
Snyk report medium severity for license
after running pipeline on a java project I get some vulnerability related to license but I do not get what is the issue. Below the report:
EPL-1.0 license
Dual license: EPL-1.0, LGPL-2.1
What is ...
1
vote
0
answers
29
views
`snyk-scm-contributor-count` failing to retrieve project list from github
I am trying to retrieve a contributor count using Snyk's snyk-scm-contributor-count to count the list of contributors. However when I run this:
snyk-scm-contributor-count github-enterprise --token ...
1
vote
0
answers
362
views
AntiForgeryToken suggested by SNYK tool
I'm solving some issues shown at SNYK tool (https://snyk.io/). I've got this issue:
Anti-forgery token validation disabled. This ASP.NET MVC action should
use an anti-forgery validation attribute. ...
0
votes
1
answer
105
views
Snyk reporting vulnerabilities in Apache-Beam 2.52.0
We have Snyk integrated with our Python repository to identify any vulnerabilities in any of the libraries we are using. I am trying to add the dependency of apache-beam 2.52.0 (latest version) to ...
2
votes
1
answer
2k
views
org.yaml.snakeyaml.representer.Representer: method <init>()V not found in mvn java
I am getting this error after updating my pom dependency.
from snakeyaml 1.3 >>>>> snakeyaml 2.0
and
spring-boot to 2.7.10
Error
org.springframework.beans.factory....
0
votes
0
answers
93
views
Jenkins Snyk plugin issue, artifacts are not found
I have a jenkins pipeline.
I am using Snyk security plugin
I have the following code
the following step to build and create a report file and publish it as artefact
stage('Snyk Scan') {
steps ...
0
votes
1
answer
73
views
Audit of all user-initiated activity within a Snyk org/group
Task: Perform audit of all user-initiated activity within a Snyk org/group
Steps that I followed:
I referred this document: https://docs.snyk.io/snyk-admin/manage-users-in-organizations-and-groups/...
1
vote
1
answer
916
views
NPM Installing dependency I do not want and it is a vulnerability, how can I remove it?
I am currently seeing a vulnerability reporting on my docker image for a package I do not want.
The package is found here: https://snyk.io/advisor/npm-package/monorepo-symlink-test
In my node_modules ...
1
vote
1
answer
290
views
npm - a package's 6th level dependency is shown to be using outdated version by snyk
In my node.js project, I have dependency on packageA. Since this package is archived now, I had to override one of it's dependencies (not sure if this is relevant). My package.json looks like this-
......
3
votes
1
answer
905
views
How to run multiple Snyk commands in a GitHub Actions workflow?
I'm setting up a GitHub Actions workflow to perform security scans on my Node.js project using Snyk. I want to run multiple Snyk commands within the same job of the workflow, but I'm not sure how to ...
1
vote
1
answer
184
views
How to address CWE-502 for Swift's Codable
Snyk.io has alerted me to a CWE-502 issue with a Swift class that implements Codable.
Deserialization of untrusted data (CWE-502), is when the application
deserializes untrusted data without ...
1
vote
1
answer
319
views
'snyk-scm-contributors-count' is not recognized as an internal or external command, operable program or batch file
I have Synk CLI installed on my local and yet snyk-scm-contributors-count is not found.
I haven't found the correct documentation for it. Trying to see if anyone else having similar issues.
3
votes
1
answer
1k
views
Can snyk be configured to ignore all issues for a particular maven dependency?
I would like to clarify some moments regarding snyk ignore.
Is it possible to configure .snyk file to ignore all kinds of issues for a particular maven dependency.
https://docs.snyk.io/snyk-cli/...
3
votes
3
answers
2k
views
How to sanitize api response server side?
I have an Express Request Handler that takes a request, which includes user form input (email), makes a request to another one of my (trusted) endpoints (via newFunctionWithRequest), and then returns ...
1
vote
1
answer
250
views
Snyk issue status in API - ignore, open, resolve
Is there any way in Snyk to run an API query for getting the status of a specific issue (ignored, open, resolved, etc.)?
2
votes
1
answer
339
views
Does Snyk offer management for Open Source License Compliance? If yes, is it possible to generate reports based on the licences being used?
Does Snyk offer management for Open Source License Compliance? If yes, is it possible to generate reports based on the licences being used?
I was wondering if Snyk is able to offer any management and ...
4
votes
0
answers
218
views
Retrieving Snyk's vulnerability alerts in Splunk
How could one retrieve Snyk's vulnerabilities into Splunk?
I am thinking the Splunk OpenTelemetry Collector could be a good integration point, but willing to know if someone has a parser before ...
2
votes
1
answer
354
views
Automatically open Jira ticket for issues in Snyk
I would like to be able to open tickets automatically from Snyk to Jira for new issues found. Based on new or existing vulnerabilities.
And I would like to be able to create Jira tickets for issues ...
1
vote
1
answer
133
views
Snyk SCA (Software Composition Analysis) and continuous monitoring
Does Snyk support doing SCA + continuous monitoring of the findings when configuring an SCM integration?
How would it work and what are the different steps to configure to get regular scans as we ...
2
votes
1
answer
502
views
Snyk and Automatic Pull request
Does Snyk send PRs automatically when integrating from the SCM (Github, Gitlab...) ?
I tried the Fix PR with Snyk and that worked - now I'd like to automate the PR
2
votes
1
answer
84
views
What is the breaking change criteria with Snyk
What is the criteria for choosing what upgrade involves a breaking change at Snyk when it comes to the Fix pull/merge request.
For example, Pillow v8.1.2 to v9.2.0
I tried to upgrade the pillow ...
4
votes
1
answer
688
views
How can Snyk push notifications to MS Teams?
Snyk has native integrations to Slack, ServiceNow, Jira and others
But no integration to MS Teams
How can a team get Snyk notifications pushed to MS Teams?
0
votes
1
answer
966
views
How to solve ReDOS pointed out by snyk
I'm new to frontend programming.
I'm charged to check vulnerabilities on an app.
I'm using Snyk which point out this portion of code as code security vulnerability:
const re = new RegExp('(' + query....
2
votes
1
answer
2k
views
How do we ignore folders in Snyk
How can I ignore/exclude folders or directories when scanning a project at Snyk, whether in CLI or in SCM scan?
It seems that an import of a Snyk Code or Snyk Open Source project don't behave in the ...
1
vote
0
answers
130
views
NTIA minimum SBOM requirement tool
I am trying to generate SBOM for Java, Python, ios(Swift) and Android (kotlin) project. I need to follow the NTIA guidelines for minimum element for SBOM (https://www.ntia.doc.gov/files/ntia/...
0
votes
2
answers
174
views
How to stay on top of OWASP dependencycheck reports
We are using OWASP dependency check. It's a great tool, but it reports lots of vulnerabilities. A big proportion of them is false positives. We can suppress them using the suppression file, but with ...
4
votes
1
answer
464
views
How can I plug Snyk vulnerability scans into JIRA so I get automatically created tickets when new vulns are discovered?
I'd like to configure my Snyk organization so that newly discovered vulnerabilities automatically generate a new ticket in Jira that I can assign to someone on my team to remediate.
Any idea how I can ...
1
vote
1
answer
324
views
Snyk Suggests higher version of dependent starters than the spring boot version
We are using Snyk for vulnerability checks in our build pipelines. The spring boot version that is being used in the project is 2.6.6 and the versions of all other dependencies are hence inherited. ...
0
votes
0
answers
142
views
Issue running Snyk test against a fresh firebase project
I am trying to get started with Snyk on my existing Firebase project and running into this error when trying snyk test:
Dependency firebase-admin was not found in package-lock.json. Your package.json ...
0
votes
2
answers
245
views
Snyk disabling an automatic test
I'm totally surprised but I looks like it's not possible to disable Snyk automatic tests. In my case Snyk integrated with bitbucket.
Snyk analyze code each time new commit is merged.
I want to test ...
5
votes
1
answer
781
views
Is it possible to solve org.jetbrains.kotlin:kotlin-stdlib vulnerability from OkHttp?
I'm using Snyk service to check my projects for vulnerabilities.
Projects with OkHttp dependency have one common vulnerability:
Vulnerable module: org.jetbrains.kotlin:kotlin-stdlib
Introduced through:...
1
vote
1
answer
3k
views
Ignore snyk code quality issue with .snyk file
Snyk finds some code quality issue that should be ignored. I'm using Snyk CLI:
"snyk code test"
✗ [High] Server-Side Request Forgery (SSRF)
Path: project/src/main/java/com/MyClass.java, ...
0
votes
1
answer
768
views
Ignore all instances of certain software license
I have a .snyk file with a number of entries like these:
'snyk:lic:maven:org.clojure:tools.analyzer.jvm:EPL-1.0':
- '*':
reason: 'ignore license issue'
expires: '2100-01-15T00:00:...
1
vote
2
answers
682
views
Snyk CLI for docker scan azure pipeline
I need to run snyk scan for Azure container and set it to fail only when there are new vulnerabilities found as compared to previous image.
I did follow the snyk-delta document to configure task in ...
0
votes
1
answer
513
views
How can I add a snyk badge to my private repository?
I want to add badges to a the readme file showing the green or red badges for the vulnerabilities detected by snyk. I am using snyk and have integrated it with my GitHub account.
Accroding to the snyk ...
1
vote
1
answer
395
views
Snyk server can be installed in a machine without internet?
I have been using sonarqube and now i want to use snyk but dont know if it is possible to install it in an machine locally and without internet access.
Snyk server can be install in an local machine ...
3
votes
1
answer
2k
views
Snyk vulnerability scan not recognizing overriden nested package dependencies
I am running the snyk test command on my project to identify vulnerabilities with third party libraries and came across the following vulnerabilities in [email protected] ->@svgr/webpack": &...
0
votes
1
answer
294
views
Snyk finds vulnaribilities in Simple Injector
In our .NET 6 apis we are using Simple Injector for dependency injection. With the latest version of Simple Injector, we observed that Snyk found five high-priority vulnerabilities and two medium ...