Artifactory XRAY fails when scanning images containing golang packages due to indexer compression ratio limitations-Golang-php.cn

Home

Backend Development

Golang

Artifactory XRAY fails when scanning images containing golang packages due to indexer compression ratio limitations

WBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWB

Feb 09, 2024 am 09:30 AM

由于索引器压缩比限制，Artifactory XRAY 在扫描包含 golang 包的图像时失败

Artifactory XRAY fails when scanning images containing golang packages due to indexer compression ratio limitations. This issue may lead to vulnerabilities not being discovered, thereby increasing the risk of system attacks. The Artifactory XRAY team is actively working on resolving this issue and expects to release a fix in the next release. Until then, users are advised to be aware of this issue when scanning images with Artifactory XRAY and take additional measures to ensure the security of their systems. PHP editor Apple will continue to pay attention to the progress of this issue and provide readers with relevant updates in a timely manner.

Question content

Recently encountered an XRAY problem when scanning docker images containing golang packages, and intercepted the following errors

TarOpener.DeepArchiveScan) --- Caused by: total bytes limit reached with the following values

I have researched this issue and it is caused by the xray limitation of the index packet compression ratio, which is to prevent zip bomb attacks (https://jfrog.com/help/r/xray-why-am-i -getting-a-total-bytes-limit-reached-error-when-indexing-a-package-in-xray/xray-why-am-i-getting-a-total-bytes-limit-reached-in-xray An error occurred while indexing the package).

I'm always pushing limits. This works for a while, but it seems like every time golang is updated, the size of the zip file gets bigger and bigger.

Has anyone implemented a long-term solution to this problem or has a new idea that doesn't just set the limit to an extreme cap value? I basically have to almost double every time?

Workaround

Golang has inserted the pax-bad-hdr-large.tar.bz2 file into its package, which is a test for zip bomb attacks.

A value of 4600 should resolve this file compression ratio.

The above is the detailed content of Artifactory XRAY fails when scanning images containing golang packages due to indexer compression ratio limitations. For more information, please follow other related articles on the PHP Chinese website!

Statement

This article is reproduced at:stackoverflow. If there is any infringement, please contact admin@php.cn delete

How do you use the pprof tool to analyze Go performance?Mar 21, 2025 pm 06:37 PM

The article explains how to use the pprof tool for analyzing Go performance, including enabling profiling, collecting data, and identifying common bottlenecks like CPU and memory issues.Character count: 159

How do you write unit tests in Go?Mar 21, 2025 pm 06:34 PM

The article discusses writing unit tests in Go, covering best practices, mocking techniques, and tools for efficient test management.

How do I write mock objects and stubs for testing in Go?Mar 10, 2025 pm 05:38 PM

This article demonstrates creating mocks and stubs in Go for unit testing. It emphasizes using interfaces, provides examples of mock implementations, and discusses best practices like keeping mocks focused and using assertion libraries. The articl

How can I define custom type constraints for generics in Go?Mar 10, 2025 pm 03:20 PM

This article explores Go's custom type constraints for generics. It details how interfaces define minimum type requirements for generic functions, improving type safety and code reusability. The article also discusses limitations and best practices

Explain the purpose of Go's reflect package. When would you use reflection? What are the performance implications?Mar 25, 2025 am 11:17 AM

The article discusses Go's reflect package, used for runtime manipulation of code, beneficial for serialization, generic programming, and more. It warns of performance costs like slower execution and higher memory use, advising judicious use and best

How can I use tracing tools to understand the execution flow of my Go applications?Mar 10, 2025 pm 05:36 PM

This article explores using tracing tools to analyze Go application execution flow. It discusses manual and automatic instrumentation techniques, comparing tools like Jaeger, Zipkin, and OpenTelemetry, and highlighting effective data visualization

How do you use table-driven tests in Go?Mar 21, 2025 pm 06:35 PM

The article discusses using table-driven tests in Go, a method that uses a table of test cases to test functions with multiple inputs and outcomes. It highlights benefits like improved readability, reduced duplication, scalability, consistency, and a

How do you specify dependencies in your go.mod file?Mar 27, 2025 pm 07:14 PM

The article discusses managing Go module dependencies via go.mod, covering specification, updates, and conflict resolution. It emphasizes best practices like semantic versioning and regular updates.

See all articles