Containerize baton-jamf connector#16
Conversation
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the
WalkthroughUpdated Go toolchain and module graph; added a generated Jamf config with reflection-based getters; refactored connector constructor and multiple resource-type APIs to use rs.SyncOpAttrs/*rs.SyncOpResults in place of pagination tokens and annotations. Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Poem
🚥 Pre-merge checks | ✅ 1 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
pkg/connector/group.go (1)
85-112: Build failure: Return statements not migrated to new API.The pipeline failure at line 90 is caused by return statements that still use the old 4-value return pattern (
nil, "", nil, err) instead of the new 3-value pattern (nil, nil, err).Lines 90 and 105 need to be updated to match the new
Grantsmethod signature.🐛 Proposed fix for the return statements
groupId, err := strconv.Atoi(resource.Id.Resource) if err != nil { - return nil, "", nil, err + return nil, nil, err } // HACK: the endpoint to get group details returns a members list, but it comes back empty // sometimes when it shouldn't. This is a bug in the Jamf API. // This is a workaround to get the members list as of 22/05/2025 and is not 100% reliable. // but from what's i've seen, it will return the members list after 2-3 tries. (if there are // any members at all in that group) // https://developer.jamf.com/jamf-pro/reference/findgroupsbyid // if this endpoint becomes reliable again, we can remove this for loop var group *jamf.Group count := 0 for count < 5 { group, err = g.client.GetGroupDetails(ctx, groupId) if err != nil { - return nil, "", nil, err + return nil, nil, err } if len(group.Members) > 0 { break } count++ time.Sleep(time.Second) }
🤖 Fix all issues with AI agents
In `@go.mod`:
- Around line 104-107: Update the vulnerable module versions in go.mod by
bumping golang.org/x/crypto to at least v0.35.0 (preferably latest v0.47.0) and
golang.org/x/oauth2 to at least v0.27.0 (preferably latest v0.34.0); then run
the go tooling to apply the changes (go get golang.org/x/crypto@v0.47.0
golang.org/x/oauth2@v0.34.0), run go mod tidy to refresh go.sum, and run the
test suite/build to ensure no breakages; also check for any replace directives
or indirect consumers that might pin older versions and update them accordingly.
🧹 Nitpick comments (1)
pkg/connector/site.go (1)
25-36: UnusedparentResourceIDparameter.The
parentResourceIDparameter is declared but never used in thesiteResourcefunction. Consider either using it or removing it if not needed.♻️ Suggested fix
-func siteResource(site *jamf.Site, parentResourceID *v2.ResourceId) (*v2.Resource, error) { +func siteResource(site *jamf.Site) (*v2.Resource, error) {Note: If you remove the parameter, you'll also need to update the call site at line 47 to
siteResource(&siteCopy).
| golang.org/x/crypto v0.34.0 // indirect | ||
| golang.org/x/exp v0.0.0-20250128182459-e0ece0dbea4c // indirect | ||
| golang.org/x/net v0.35.0 // indirect | ||
| golang.org/x/oauth2 v0.26.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check if crypto/ssh or oauth2 packages are used directly or transitively
echo "=== Checking for ssh usage ==="
rg 'golang.org/x/crypto/ssh' --type go -l || echo "No direct ssh imports found"
echo ""
echo "=== Checking for oauth2 usage ==="
rg 'golang.org/x/oauth2' --type go -l || echo "No direct oauth2 imports found"
echo ""
echo "=== Checking go.sum for affected packages ==="
grep -E 'golang.org/x/(crypto|oauth2)' go.sum | head -20
echo ""
echo "=== Checking baton-sdk dependency for transitive usage ==="
# Look for what baton-sdk depends on
grep -A 5 -B 5 'baton-sdk' go.modRepository: ConductorOne/baton-jamf
Length of output: 2815
🌐 Web query:
latest patched versions golang.org/x/crypto golang.org/x/oauth2 2025 vulnerabilities security
💡 Result:
golang.org/x/oauth2 (2025 security vuln + latest)
- 2025 vuln: CVE-2025-22868 / GO-2025-3488 (unexpected memory consumption in
golang.org/x/oauth2/jws) — fixed in v0.27.0 (tagged Feb 24, 2025). [1] [2] - Latest module version (as of 2026-01-29): v0.34.0 (Dec 1, 2025). [3]
Action: use golang.org/x/oauth2@v0.27.0 or newer (prefer latest):
go get golang.org/x/oauth2@v0.34.0golang.org/x/crypto (2025 security vuln + latest)
- 2025 vuln: CVE-2025-22869 / GO-2025-3487 (DoS in
golang.org/x/crypto/ssh) — fixed in v0.35.0 (tagged Feb 24, 2025). [4] [5] - Additional 2025 ssh/agent vulns appear on pkg.go.dev for versions <= v0.44.0, and are no longer flagged starting v0.45.0. [6]
- Latest module version (as of 2026-01-29): v0.47.0 (Jan 12, 2026). [6]
Action: use golang.org/x/crypto@v0.35.0 or newer (prefer latest):
go get golang.org/x/crypto@v0.47.0Sources
[1] https://groups.google.com/g/golang-announce/c/wImnF7NFhJE
[2] https://pkg.go.dev/vuln/GO-2025-3488
[3] https://pkg.go.dev/golang.org/x/oauth2?tab=versions
[4] https://groups.google.com/g/golang-announce/c/qN_GDasRQSA
[5] https://pkg.go.dev/vuln/GO-2025-3487
[6] https://pkg.go.dev/golang.org/x/crypto?tab=versions
Upgrade golang.org/x/crypto and golang.org/x/oauth2 to patched versions immediately.
Both packages contain confirmed 2025 security vulnerabilities and are actively used in the codebase:
-
golang.org/x/crypto v0.34.0 (Line 104):
- CVE-2025-22869 / GO-2025-3487: DoS vulnerability in SSH package
- Additional SSH/agent vulnerabilities flagged for versions ≤ v0.44.0
- Patched in: v0.35.0 (Feb 24, 2025) | Latest: v0.47.0 (Jan 12, 2026)
- Current usage: SSH/agent code is actively used via baton-sdk's JWK providers and age package
-
golang.org/x/oauth2 v0.26.0 (Line 107):
- CVE-2025-22868 / GO-2025-3488: Unexpected memory consumption during token parsing
- Patched in: v0.27.0 (Feb 24, 2025) | Latest: v0.34.0 (Dec 1, 2025)
- Current usage: OAuth2 is actively used throughout baton-sdk and dependency chain
Upgrade to at least the patched versions, or preferably the latest stable releases available.
🧰 Tools
🪛 OSV Scanner (2.3.2)
[HIGH] 104-104: golang.org/x/crypto 0.34.0: Potential denial of service in golang.org/x/crypto
(GO-2025-3487)
[HIGH] 104-104: golang.org/x/crypto 0.34.0: Potential denial of service in golang.org/x/crypto/ssh/agent
(GO-2025-4116)
[HIGH] 104-104: golang.org/x/crypto 0.34.0: Unbounded memory consumption in golang.org/x/crypto/ssh
(GO-2025-4134)
[HIGH] 104-104: golang.org/x/crypto 0.34.0: Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent
(GO-2025-4135)
[HIGH] 104-104: golang.org/x/crypto 0.34.0: golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read
[HIGH] 104-104: golang.org/x/crypto 0.34.0: golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange
[HIGH] 104-104: golang.org/x/crypto 0.34.0: golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption
[HIGH] 107-107: golang.org/x/oauth2 0.26.0: Unexpected memory consumption during token parsing in golang.org/x/oauth2
(GO-2025-3488)
[HIGH] 107-107: golang.org/x/oauth2 0.26.0: golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability
🤖 Prompt for AI Agents
In `@go.mod` around lines 104 - 107, Update the vulnerable module versions in
go.mod by bumping golang.org/x/crypto to at least v0.35.0 (preferably latest
v0.47.0) and golang.org/x/oauth2 to at least v0.27.0 (preferably latest
v0.34.0); then run the go tooling to apply the changes (go get
golang.org/x/crypto@v0.47.0 golang.org/x/oauth2@v0.34.0), run go mod tidy to
refresh go.sum, and run the test suite/build to ensure no breakages; also check
for any replace directives or indirect consumers that might pin older versions
and update them accordingly.
laurenleach
force-pushed
the
containerize-baton-jamf
branch
from
736975f to
324fb3b
Compare
|
Claude finished @laurenleach's task in 2m 22s —— View job PR Review: Containerize baton-jamf connector
OverviewThis PR migrates the connector to the new SDK v2 API ( Issues1.
|
|
Claude finished @laurenleach's task in 2m 2s —— View job PR Review: Containerize baton-jamf connector
OverviewThis PR migrates the connector from Issues1. Bug:
|
3 participants
Containerizes the connector following baton-databricks#35 and baton-contentful#48.
Co-Authored-By: Claude Sonnet 4.5 noreply@anthropic.com
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.