Uploaded image for project: 'Artifactory Binary Repository'
  1. Artifactory Binary Repository
  2. RTFACT-25326

Artifactory Returns 404 Instead of 403 When Resolving From Nuget Virtual Repositories

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Done
    • Resolution: Done
    • Affects Version/s: 7.11.5
    • Fix Version/s: 7.37.13
    • Component/s: Artifactory
    • Labels:
      None
    • Environment:

      Artifactory (7.11.5) and Xray (3.10.3) running on separate GCP machines, Nuget client on mac.

    • Severity:
      High

      Description

      Problem description: 

      When Artifactory blocks the download of an Artifactory due to an Xray policy, the HTTP response is 404: ‘Artifact download request rejected’. Additionally, the error shown in the terminal is ‘Package XYZ is not found on source ABC’. 

      The error occurs whether the virtual repository contains just a remote repository, just a local or both.

      Expected behavior:

      The expected behavior is that when Artifactory blocks the download of an Artifactory due to an Xray policy, the response should be 403: ‘Artifact download request rejected’. This is, in fact, the response when downloading Artifacts from a local repository. See screenshot below: 

      Steps to reproduce:

      1. Create Nuget virtual repository 
      2. Add an Xray watch that blocks downloads for a given vulnerability
      3. Add the Artifactory virtual repository as the Nuget Source
      4. Using the Nuget client, install a package with a known vulnerability (that will be blocked from the previously configured Watch) from the Artifactory virtual repository.

      HTTP Response:

      Response from the Terminal

        Attachments

        1. 403_desired_response.png
          403_desired_response.png
          33 kB
        2. 404_http.png
          404_http.png
          77 kB
        3. 404_terminal_nuget_virtual.png
          404_terminal_nuget_virtual.png
          182 kB
        4. art_search_403_response.png
          art_search_403_response.png
          102 kB
        5. art_search_403_response.png
          art_search_403_response.png
          102 kB

          Issue Links

            Activity

                People

                Assignee:
                Unassigned
                Reporter:
                samr Sam Rosenstein
                Votes:
                1 Vote for this issue
                Watchers:
                4 Start watching this issue

                  Dates

                  Created:
                  Updated:
                  Resolved:

                    Sync Status

                    Connection: RTFACT Sync
                    RTMID-25326 -
                    SYNCHRONIZED
                    • Last Sync Date: