XRAY-156662 - Get configuration by workspace

[VidrevichMichael]

• All tests passed. If this feature is not already covered by the tests, I added new tests.
• This pull request is on the dev branch.
• I used gofmt for formatting the code before submitting the pull request.
• Update documentation about new features / new supported technologies

---

[attiasas]

Nice work!, check out my comments.

Should we add annotation in the comments/PR with the workspace? we should consider adding a log somewhere maybe if not present already in the logs

Don't forget to report to tech writer about the changes and new option

[attiasas]

you need to wait for the official release of cli-security

[github-actions]

📗 Scan Summary

• Frogbot scanned for vulnerabilities and found 5 issues

Scan Category	Status	Security Issues
Software Composition Analysis	✅ Done	5 Issues Found 4 High 1 Medium
Contextual Analysis	✅ Done	-
Static Application Security Testing (SAST)	✅ Done	Not Found
Secrets	✅ Done	Not Found
Infrastructure as Code (IaC)	✅ Done	Not Found

📦 Vulnerable Dependencies

Severity	ID	Contextual Analysis	Dependency Path
High	CVE-2021-4435	Missing Context	-
High	CVE-2020-8131	Not Covered	-
High	CVE-2019-5448	Not Covered	-
High	CVE-2019-10773	Not Covered	-
Medium	CVE-2019-15608	Not Covered	-

🔖 Details

[ CVE-2021-4435 ] yarn 1.0.0

Vulnerability Details

Contextual Analysis:	Missing Context
CVSS V3:	7.8

An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.

[ CVE-2020-8131 ] yarn 1.0.0

Vulnerability Details

Contextual Analysis:	Not Covered
CVSS V3:	7.5

Arbitrary filesystem write vulnerability in Yarn 1.21.1 and earlier allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.

[ CVE-2019-5448 ] yarn 1.0.0

Vulnerability Details

Contextual Analysis:	Not Covered
CVSS V3:	8.1

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.

[ CVE-2019-10773 ] yarn 1.0.0

Vulnerability Details

Contextual Analysis:	Not Covered
CVSS V3:	7.8

In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.

[ CVE-2019-15608 ] yarn 1.0.0

Vulnerability Details

Contextual Analysis:	Not Covered
CVSS V3:	5.9

The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack. This issue is fixed in 1.19.0.

---

🐸 JFrog Frogbot