Questions tagged [snyk]
Snyk is a service that analyzes your code to help find and fix security vulnerabilities in your applications, containers, infrastructure-as-code, and cloud environments.
79
questions
1
vote
1
answer
141
views
NPM Installing dependency I do not want and it is a vulnerability, how can I remove it?
I am currently seeing a vulnerability reporting on my docker image for a package I do not want.
The package is found here: https://snyk.io/advisor/npm-package/monorepo-symlink-test
In my node_modules ...
1
vote
1
answer
51
views
npm - a package's 6th level dependency is shown to be using outdated version by snyk
In my node.js project, I have dependency on packageA. Since this package is archived now, I had to override one of it's dependencies (not sure if this is relevant). My package.json looks like this-
......
3
votes
1
answer
126
views
How to run multiple Snyk commands in a GitHub Actions workflow?
I'm setting up a GitHub Actions workflow to perform security scans on my Node.js project using Snyk. I want to run multiple Snyk commands within the same job of the workflow, but I'm not sure how to ...
1
vote
1
answer
72
views
How to address CWE-502 for Swift's Codable
Snyk.io has alerted me to a CWE-502 issue with a Swift class that implements Codable.
Deserialization of untrusted data (CWE-502), is when the application
deserializes untrusted data without ...
1
vote
1
answer
67
views
'snyk-scm-contributors-count' is not recognized as an internal or external command, operable program or batch file
I have Synk CLI installed on my local and yet snyk-scm-contributors-count is not found.
I haven't found the correct documentation for it. Trying to see if anyone else having similar issues.
2
votes
1
answer
101
views
Can snyk be configured to ignore all issues for a particular maven dependency?
I would like to clarify some moments regarding snyk ignore.
Is it possible to configure .snyk file to ignore all kinds of issues for a particular maven dependency.
https://docs.snyk.io/snyk-cli/...
1
vote
0
answers
109
views
curl vulnerabilities reported against a container image that runs a dotnetcore process [closed]
We're running a dotnetcore web application on a Debian 11.7-slim image in AWS ECS+Fargate. Snyk Container is reporting that curl 7.74 is present on the image and suffers from "CVE-2023-23914 - ...
3
votes
3
answers
221
views
How to sanitize api response server side?
I have an Express Request Handler that takes a request, which includes user form input (email), makes a request to another one of my (trusted) endpoints (via newFunctionWithRequest), and then returns ...
1
vote
1
answer
41
views
Snyk issue status in API - ignore, open, resolve
Is there any way in Snyk to run an API query for getting the status of a specific issue (ignored, open, resolved, etc.)?
2
votes
1
answer
80
views
Does Snyk offer management for Open Source License Compliance? If yes, is it possible to generate reports based on the licences being used?
Does Snyk offer management for Open Source License Compliance? If yes, is it possible to generate reports based on the licences being used?
I was wondering if Snyk is able to offer any management and ...
4
votes
0
answers
60
views
Retrieving Snyk's vulnerability alerts in Splunk
How could one retrieve Snyk's vulnerabilities into Splunk?
I am thinking the Splunk OpenTelemetry Collector could be a good integration point, but willing to know if someone has a parser before ...
2
votes
1
answer
129
views
Automatically open Jira ticket for issues in Snyk
I would like to be able to open tickets automatically from Snyk to Jira for new issues found. Based on new or existing vulnerabilities.
And I would like to be able to create Jira tickets for issues ...
1
vote
1
answer
32
views
Snyk SCA (Software Composition Analysis) and continuous monitoring
Does Snyk support doing SCA + continuous monitoring of the findings when configuring an SCM integration?
How would it work and what are the different steps to configure to get regular scans as we ...
1
vote
1
answer
82
views
Snyk and Automatic Pull request
Does Snyk send PRs automatically when integrating from the SCM (Github, Gitlab...) ?
I tried the Fix PR with Snyk and that worked - now I'd like to automate the PR
2
votes
1
answer
42
views
What is the breaking change criteria with Snyk
What is the criteria for choosing what upgrade involves a breaking change at Snyk when it comes to the Fix pull/merge request.
For example, Pillow v8.1.2 to v9.2.0
I tried to upgrade the pillow ...
4
votes
1
answer
200
views
How can Snyk push notifications to MS Teams?
Snyk has native integrations to Slack, ServiceNow, Jira and others
But no integration to MS Teams
How can a team get Snyk notifications pushed to MS Teams?
0
votes
1
answer
158
views
How to solve ReDOS pointed out by snyk
I'm new to frontend programming.
I'm charged to check vulnerabilities on an app.
I'm using Snyk which point out this portion of code as code security vulnerability:
const re = new RegExp('(' + query....
2
votes
1
answer
321
views
How do we ignore folders in Snyk
How can I ignore/exclude folders or directories when scanning a project at Snyk, whether in CLI or in SCM scan?
It seems that an import of a Snyk Code or Snyk Open Source project don't behave in the ...
0
votes
0
answers
52
views
NTIA minimum SBOM requirement tool
I am trying to generate SBOM for Java, Python, ios(Swift) and Android (kotlin) project. I need to follow the NTIA guidelines for minimum element for SBOM (https://www.ntia.doc.gov/files/ntia/...
0
votes
2
answers
49
views
How to stay on top of OWASP dependencycheck reports
We are using OWASP dependency check. It's a great tool, but it reports lots of vulnerabilities. A big proportion of them is false positives. We can suppress them using the suppression file, but with ...
4
votes
1
answer
131
views
How can I plug Snyk vulnerability scans into JIRA so I get automatically created tickets when new vulns are discovered?
I'd like to configure my Snyk organization so that newly discovered vulnerabilities automatically generate a new ticket in Jira that I can assign to someone on my team to remediate.
Any idea how I can ...
1
vote
1
answer
85
views
Snyk Suggests higher version of dependent starters than the spring boot version
We are using Snyk for vulnerability checks in our build pipelines. The spring boot version that is being used in the project is 2.6.6 and the versions of all other dependencies are hence inherited. ...
0
votes
0
answers
44
views
Issue running Snyk test against a fresh firebase project
I am trying to get started with Snyk on my existing Firebase project and running into this error when trying snyk test:
Dependency firebase-admin was not found in package-lock.json. Your package.json ...
0
votes
2
answers
55
views
Snyk disabling an automatic test
I'm totally surprised but I looks like it's not possible to disable Snyk automatic tests. In my case Snyk integrated with bitbucket.
Snyk analyze code each time new commit is merged.
I want to test ...
5
votes
1
answer
276
views
Is it possible to solve org.jetbrains.kotlin:kotlin-stdlib vulnerability from OkHttp?
I'm using Snyk service to check my projects for vulnerabilities.
Projects with OkHttp dependency have one common vulnerability:
Vulnerable module: org.jetbrains.kotlin:kotlin-stdlib
Introduced through:...
1
vote
1
answer
454
views
Ignore snyk code quality issue with .snyk file
Snyk finds some code quality issue that should be ignored. I'm using Snyk CLI:
"snyk code test"
✗ [High] Server-Side Request Forgery (SSRF)
Path: project/src/main/java/com/MyClass.java, ...
0
votes
1
answer
172
views
Ignore all instances of certain software license
I have a .snyk file with a number of entries like these:
'snyk:lic:maven:org.clojure:tools.analyzer.jvm:EPL-1.0':
- '*':
reason: 'ignore license issue'
expires: '2100-01-15T00:00:...
1
vote
2
answers
317
views
Snyk CLI for docker scan azure pipeline
I need to run snyk scan for Azure container and set it to fail only when there are new vulnerabilities found as compared to previous image.
I did follow the snyk-delta document to configure task in ...
0
votes
0
answers
80
views
Using Snyk-Delta for Azure container image scan
I am trying to configure synk-delta to fail SNYK security scan task only if new vulnerabilities are being introduced in ACR.
We need to run snyk scan for Azure container and set it to fail only when ...
0
votes
1
answer
201
views
How can I add a snyk badge to my private repository?
I want to add badges to a the readme file showing the green or red badges for the vulnerabilities detected by snyk. I am using snyk and have integrated it with my GitHub account.
Accroding to the snyk ...
0
votes
1
answer
62
views
Snyk server can be installed in a machine without internet?
I have been using sonarqube and now i want to use snyk but dont know if it is possible to install it in an machine locally and without internet access.
Snyk server can be install in an local machine ...
1
vote
1
answer
629
views
Snyk vulnerability scan not recognizing overriden nested package dependencies
I am running the snyk test command on my project to identify vulnerabilities with third party libraries and came across the following vulnerabilities in react-scripts@5.0.1 ->@svgr/webpack": &...
0
votes
1
answer
169
views
Snyk finds vulnaribilities in Simple Injector
In our .NET 6 apis we are using Simple Injector for dependency injection. With the latest version of Simple Injector, we observed that Snyk found five high-priority vulnerabilities and two medium ...
0
votes
0
answers
59
views
Information regarding XSS vulnerabilities reported by Snyk
In a need to introduce Test Management to help our QA engineering team , we are looking for some tools and have come across Kiwi TCMS . We are considering of onboarding the software to help our QA ...
0
votes
1
answer
61
views
Docker scan step is failing on pipeline with login error
I am trying to use docker scan command in gitlab CI. I am loggin in to docker hub using docker login command and after that I am running docker scan --accept-license :. On my local machine everything ...
19
votes
4
answers
34k
views
upgrade to SnakeYaml 1.31 in spring-boot-starter-parent 2.7.3
Have springboot project in which wanted to either exclude snakeyaml 1.30 or upgrade it 1.31 inorder to avoid fortify issue reporting
with snakeyaml 1.30 version there is security vulnerability
<...
0
votes
1
answer
393
views
I have Integrated Snyk Security Tool with Jenkins I am getting below Issue(I am Using DOTNET Core 3.0 Version project)
FATAL: Snyk Security scan failed.
java.lang.RuntimeException: An error occurred. Could not detect supported target files in C:\ProgramData\Jenkins\.jenkins\workspace\ZAPTest.
Please see our ...
1
vote
1
answer
93
views
Performing multiplication on a string (from calling toFixed) and a number error
I get an error on typescript using Snyk Code Quality:
Performing multiplication on a string (from calling toFixed) and a
number (from number literal 10) will trigger an implicit coercion of
the ...
0
votes
2
answers
385
views
Unable to resolve issues in devops CI-CD pipeline snyk scans
I have pushed a react solution into devops repository and created one pipeline for build and scans.
We are using snyk scan to scan the solution; here is the yaml code of snykscan:
scanSnyk: true
...
0
votes
1
answer
137
views
Can my application be vulnerable because of an oudated Docker image?
Currently, my company wants to ensure that everything is secure, and now I'm doing some tests to verify that our Docker containers achieve this.
My first concern comes in after I realized that after ...
2
votes
1
answer
806
views
How to ignore a vulnerability for a specific file
The following Snyk vulnerability is being reported when I run
% snyk code test
Testing /mydir ...
✗ [High] Cross-Site Request Forgery (CSRF)
Path: src/com/xxx/ConfigSecurity.java, line 22
...
1
vote
1
answer
2k
views
Could not detect supported target files in 'project directory'see documentation supported languages target, make sure you are in the right directory
I am new to Snyk and I have installed synk-cli and ran the command snyk monitor on the root directory of my project which contains two apps,
client == reactJS, server== python(Django), I have ...
1
vote
1
answer
303
views
integrating snyk with my azure pipeline security concerns
I am integrating Snyk with my Azure pipeline, but my concerns are:
1- is Snyk take a copy of my source code and save it on their servers, as I am connecting and giving authentication with an API key ...
0
votes
3
answers
192
views
Snyk Code Upload Results To Dashboard like Monitor
I'm trying to run Snyk on bitbucket pipeline. I'm running the pipes for composer and npm and things are working but I also want to run it for static code analysis. None of the documentation shows how ...
0
votes
0
answers
39
views
Bash running cli command over and over when exit code is 1 [duplicate]
I am working on a pre-commit hook bash script that makes use of a cli tool (snyk). Here is an example:
#!/usr/bin/env bash
echo "running snyk code test"
snyk code test
If I invoke the above ...
1
vote
1
answer
1k
views
Snyk monitor command is failing
I am running below SNYK command for standard WAS application.
snyk monitor --all-projects
It is failing because there is a war-src module which contains ${project.version} tag and this version is ...
0
votes
1
answer
61
views
Snyk For talend package
we are trying to scan talend package,
is there any documentation for scanning talend packages through snyk?
thanks
Sundar
2
votes
1
answer
1k
views
How to do Snyk code test in Jenkins pipeline?
I am helping our DevOps team integrate Snyk into the Jenkins pipelines for SAST. By default, it seems like this Snyk plugin is doing snyk test (which does open-source dependency scans) and appends the ...
0
votes
1
answer
440
views
Install Snyk in Jenkins "Global Tool Configuration" using groovy
I'm trying to add a Snyk installation to Jenkins using groovy. The plugin is installed and I can see the installation option in Global Tool Configuration:
The problem is the Descriptor is not ...
0
votes
1
answer
71
views
bug or genuine issue with identifying dependencies
I am quite confused by this message from Snyk. It seems I have all dependencies I need.
+ pip3 install -r requirements.txt
Requirement already satisfied: numpy==1.21.5 in ./venv/lib/python3.9/site-...