Add --format flag support to create-evidence

[ehl-jf]

Pull Request Template

Description

Adds a --format flag (json | table) to the create-evidence command, so the result of an evidence creation can be rendered in a structured form on stdout. This brings create-evidence in line with the output-format pattern used by other JFrog CLI commands and makes it easier to consume the response programmatically (JSON) or read it interactively (table).

When --format is omitted, the command's existing output is unchanged.

Related Issue

https://jfrog-int.atlassian.net/browse/JGC-479

Testing

• Tests added/updated
• All tests pass locally

Unit tests cover the JSON and table renderers, including multi-response output and handling of an unsupported format.

Checklist

• PR description is clear and concise, and it includes the proposed solution/fix
• Code follows project style guidelines
• Documentation updated (if applicable)

[github-actions]

📗 Scan Summary

• Frogbot scanned for vulnerabilities and found 2 issues

Scan Category	Status	Security Issues
Software Composition Analysis	✅ Done	Not Found
Contextual Analysis	✅ Done	-
Static Application Security Testing (SAST)	✅ Done	2 Issues Found 2 Low
Secrets	✅ Done	-
Infrastructure as Code (IaC)	✅ Done	Not Found

---

🐸 JFrog Frogbot

[github-actions]

key

at evidence/create/create_base.go (line 321)

🎯 Static Application Security Testing (SAST) Vulnerability

Severity	Finding
Low	Untrusted stored input used in file paths, allowing access to unintended files.

Full description

Vulnerability Details

Rule ID:	go-stored-path-traversal

Overview

Stored Path Traversal is a type of vulnerability that arises when user-controlled
input, such as file names or paths, is stored by the application and later used
without proper validation or sanitization to perform file operations. This can
allow an attacker to traverse directories and access or overwrite sensitive files
on the filesystem, potentially compromising the security and integrity of the
application or system.

Vulnerable example

func serveFile(w http.ResponseWriter, r *http.Request) {
    row := db.QueryRow("SELECT file_path FROM files WHERE id = 12")
    row.Scan(&filePath)
    http.ServeFile(w, r, filePath)
}

In this example, the serveFile function serves a file based on the file query
parameter provided by the user. However, in a real-world scenario, the filePath
variable might be retrieved from a stored source, such as a database or configuration
file, instead of being directly obtained from the request URL. The vulnerability
arises if the stored filePath is not properly validated or sanitized before being
used to serve files. Attackers could manipulate the stored filePath to perform
directory traversal attacks, potentially accessing sensitive files outside the
intended directory structure.

Remediation

To mitigate stored path traversal vulnerabilities, it is essential to validate
and sanitize user-controlled input before using it to construct file paths or
perform file operations. In this example, we can validate the file name to ensure
it does not contain directory traversal sequences before serving the file.

func serveFile(w http.ResponseWriter, r *http.Request) {
    row := db.QueryRow("SELECT file_path FROM files WHERE id = ?", r.URL.Query().Get("id"))
    row.Scan(&filePath)
+    // Validate file path to prevent directory traversal
+    if strings.Contains(filePath, "..") {
+        http.Error(w, "Invalid file path", http.StatusBadRequest)
+        return
+    }
    http.ServeFile(w, r, filePath)
}

Code Flows

Vulnerable data flow analysis result

↘️ os.ReadFile(filepath.Join("../..", tt.keyPath)) (at evidence/create/create_base_test.go line 194)

↘️ keyContent (at evidence/create/create_base_test.go line 194)

↘️ keyContent (at evidence/create/create_base_test.go line 196)

↘️ string(keyContent) (at evidence/create/create_base_test.go line 196)

↘️ createAndSignEnvelope(tt.payloadJson, string(keyContent), tt.keyId) (at evidence/create/create_base_test.go line 196)

↘️ key (at evidence/create/create_base.go line 317)

↘️ key (at evidence/create/create_base.go line 321)

---

🐸 JFrog Frogbot

[github-actions]

key

at evidence/create/create_base.go (line 323)

🎯 Static Application Security Testing (SAST) Vulnerability

Severity	Finding
Low	Untrusted stored input used in file paths, allowing access to unintended files.

Full description

Vulnerability Details

Rule ID:	go-stored-path-traversal

Overview

Stored Path Traversal is a type of vulnerability that arises when user-controlled
input, such as file names or paths, is stored by the application and later used
without proper validation or sanitization to perform file operations. This can
allow an attacker to traverse directories and access or overwrite sensitive files
on the filesystem, potentially compromising the security and integrity of the
application or system.

Vulnerable example

func serveFile(w http.ResponseWriter, r *http.Request) {
    row := db.QueryRow("SELECT file_path FROM files WHERE id = 12")
    row.Scan(&filePath)
    http.ServeFile(w, r, filePath)
}

In this example, the serveFile function serves a file based on the file query
parameter provided by the user. However, in a real-world scenario, the filePath
variable might be retrieved from a stored source, such as a database or configuration
file, instead of being directly obtained from the request URL. The vulnerability
arises if the stored filePath is not properly validated or sanitized before being
used to serve files. Attackers could manipulate the stored filePath to perform
directory traversal attacks, potentially accessing sensitive files outside the
intended directory structure.

Remediation

To mitigate stored path traversal vulnerabilities, it is essential to validate
and sanitize user-controlled input before using it to construct file paths or
perform file operations. In this example, we can validate the file name to ensure
it does not contain directory traversal sequences before serving the file.

func serveFile(w http.ResponseWriter, r *http.Request) {
    row := db.QueryRow("SELECT file_path FROM files WHERE id = ?", r.URL.Query().Get("id"))
    row.Scan(&filePath)
+    // Validate file path to prevent directory traversal
+    if strings.Contains(filePath, "..") {
+        http.Error(w, "Invalid file path", http.StatusBadRequest)
+        return
+    }
    http.ServeFile(w, r, filePath)
}

Code Flows

Vulnerable data flow analysis result

↘️ os.ReadFile(filepath.Join("../..", tt.keyPath)) (at evidence/create/create_base_test.go line 194)

↘️ keyContent (at evidence/create/create_base_test.go line 194)

↘️ keyContent (at evidence/create/create_base_test.go line 196)

↘️ string(keyContent) (at evidence/create/create_base_test.go line 196)

↘️ createAndSignEnvelope(tt.payloadJson, string(keyContent), tt.keyId) (at evidence/create/create_base_test.go line 196)

↘️ key (at evidence/create/create_base.go line 317)

↘️ key (at evidence/create/create_base.go line 323)

---

🐸 JFrog Frogbot