Errors with "/bin/" in summary of the Jira Issue get caught by WAF, failing HTTP request to Snyk API when creating new vulnerabilities

[tonur]

When this tool encounters a project with a vulnerability that has a title of "/bin/" in the title in Snyk, it will fail creating the issue with a nondescript error code, as shown below:

*** ERROR *** Please check the format config file unexpected end of JSON input
open : no such file or directory
*** ERROR *** Could not read file at location: . Please ensure the file exists and is formatted correctly.
ERROR: open: no such file or directory

This is misleading, since it is not a JSON error, but rather a HTTP Error code 403 response, since I can reproduce this error in the Snyk Web UI by finding the project in question, obtained from the above log (the last "Step 1/4 - Retrieving project <PROJECT_UUID>" message) and pressing the "Create a Jira Issue" for the vulnerability for this. This will just print out "Failed to create the Jira issue" and log a network request error with the 403 response code as shown below:

POST https://app.snyk.io/org/<MY_ORGANIZATION>/project/<PROJECT_UUID>/issue/SNYK-GOLANG-GITHUBCOMGOGITGOGITV5-6150754/jira/new

With the response content of:

Access Denied
You don't have permission to access "http://app.snyk.io/org/<MY_ORGANIZATION>/project/<PROJECT_UUID>/issue/SNYK-GOLANG-GITHUBCOMGOGITGOGITV5-6150754/jira/new" on this server.

Reference #18.e6e22517.1713957523.146c0bb9

https://errors.edgesuite.net/18.e6e22517.1713957523.146c0bb9

Suggestion:

1:
Handle HTTP errors relating to the Web Application Firewall, which fails with HTTP Error code 403, likely to prevent Path Traversal attacks.

Perhaps continue with the rest of the tasks after this failure and perhaps print out the failed task in the end?

2:
Otherwise, a solution could be to change the summary of the To Be Created Jira Issue, to sanitize and remove illegal character combinations. For example, what worked for this specific issue was to replace the "/bin/" part of the issue summary to something like "bin", like so:
Original: <APP_ORG_NAME>/deployment.apps/<APP_NAME>:/usr/local/bin/<APP_NAME> - Path Traversal in github.com/go-git/go-git/v5
Sanitized: <APP_ORG_NAME>/deployment.apps/<APP_NAME>:/usr/local_bin_<APP_NAME> - Path Traversal in github.com/go-git/go-git/v5

I tested this sanitazion, and successfully created a Jira Issue with the following cURL:
curl 'https://app.snyk.io/org/<MY_ORGANIZATION>/project/<PROJECT_UUID>/issue/SNYK-GOLANG-GITHUBCOMGOGITGOGITV5-6150754/jira/new' -X POST --data-raw '{"projectId":"x","issueTypeId":"x","assignee":null,"summary":"<APP_ORG_NAME>/deployment.apps/<APP_NAME>:/usr/local_bin_<APP_NAME> - Path Traversal in github.com/go-git/go-git/v5", ...}'

A weird thing, the summary cannot contain "/bin/" but the description can contain "/bin/" just fine? Strange behavior.

[tonur]

The error seem to come from https://github.com/snyk-tech-services/jira-tickets-for-new-vulns/blob/develop/utils.go#L371 where it seems to expect that error files are created?
But in my case, I got an error but no error file. This seems strange.
Edit: It turns out the reason I got the error of:

ERROR Please check the format config file unexpected end of JSON input
no such file or directory
Could not read file at location: .
Please ensure the file exists and is formatted correctly.
ERROR no such file or director

was because I ran the binary in a Docker Image, and I think it was missing some permissions to write the ErrorsFile. This is a separate problem, and I will create another issue for this with a suggestion to print out a failure message if the ErrorsFile cannot be read/found in the "writeErrorFile" function here: https://github.com/snyk-tech-services/jira-tickets-for-new-vulns/blob/develop/utils.go#L371
The errors are not handled, and this makes sense, since it usually does not make sense to print errors when trying to read error messages.

[tonur]

I actually don't know if this Path Traversal attacks prevention is happening on Snyk's or JIRA's end. Since it is the subject in the JSON body that it fails on, I guess it is JIRA?
I will create a Pull Request to sanitize the subject no matter what, since this is an issue regardless.