Report hashes of jars that we can resolve to dependencies - #338
Conversation
![aikido-pr-checks[bot]](https://avatars.githubusercontent.com/in/898896?s=60&v=4){kind=small}
| if (!packages.isEmpty()) { | ||
| return new JarScanResult(packages, null); | ||
| } | ||
| try (InputStream input = new BufferedInputStream(outerJar.getInputStream(nestedJar))) { |
There was a problem hiding this comment.
The nested JAR is read completely once for package scanning and again for SHA-1 calculation. Compute the digest during the initial pass to avoid doubling I/O for unresolved archives.
Details
✨ AI Reasoning
The initial scan consumes the entire nested archive while looking for Maven metadata. When no packages are found, the code opens the same archive again and reads it from start to finish for hashing. This doubles disk or archive-stream work for every unresolved nested JAR and can be avoided by computing the digest during the first pass.
🔧 How do I fix it?
Move constant work outside loops. Use StringBuilder instead of string concatenation in loops. Cache compiled regex patterns. Use hash-based lookups instead of nested loops. Batch database operations instead of N+1 queries.
Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
Can't use std lib because we support several java versions
| RoutesStore.clear(); | ||
| UsersStore.clear(); | ||
| RuntimePackagesStore.clear(); | ||
| JavaArtifactsStore.clear(); |
There was a problem hiding this comment.
🟡 Medium - Artifact hashes are dropped permanently when a heartbeat fails
The new Java artifact inventory is cleared before the heartbeat is sent, so any network error or non-successful heartbeat response discards every collected hash from memory. Those hashes are only queued once per JAR location because observed locations are deduplicated permanently, so the collector will not recreate them after a transient outage. A temporary API failure therefore leaves the backend with a permanently incomplete artifact inventory until the process restarts or a new JAR is loaded.
Show fix
Do not delete JavaArtifactsStore before the heartbeat has been accepted. Instead, drain artifacts atomically only after a successful report, or keep a retry buffer and reinsert unsent artifacts when the heartbeat fails so transient API outages cannot permanently lose the one-time scan results.
More info - Reply on this comment to give feedback or ignore the issue.
Codecov Report❌ Patch coverage is 📢 Thoughts on this report? Let us know! |
1 participant
No description provided.