bower firewall demo - michaelmworthington/codesamples GitHub Wiki
This page walks through the steps to set up NXRM and a NodeJS Docker container to test Bower Firewall using https://registry.bower.io
See the official docs at https://help.sonatype.com/repomanager3/formats/bower-repositories
- Prerequisites
- Step 1. Create a new Proxy Repository in NXRM
- Step 2. Enable Firewall for the New Proxy Repo
- Step 3. Run Docker Image for the Dependency Manager
- Step 4. Set the environment to download packages from NXRM
- Step 5. Install a package
- Step 6. Browse NXRM to view it
- Step 7. View the Firewall Report
- Step 8. Test Quarantine
- Step 9. Notes
- IQ Server installed and running
- NXRM 3 installed and running and configured with the IQ Server
- Docker for Mac installed and running
Use https://registry.bower.io as the Remote URL. Accept default values for the remainder of the settings.
docker run -it --rm node bash
unlike the centos image used in the Yum Firewall Demo, this image runs the 'maven' command when starting the container, rather than plain 'bash'. since i want to run a couple maven commands, force docker to run bash.
cd /tmp
npm install -g bower
npm install -g bower-nexus3-resolver
Create ~/.bowerrc with the following contents:
{
"registry" : {
"search" : [ "http://host.docker.internal:8083/nexus/repository/bower-public" ]
},
"resolvers" : [ "bower-nexus3-resolver" ]
}
bower --allow-root install jquery
Observe the inbound requests to NXRM in the request.log file:
172.18.0.1 - - [10/Nov/2020:16:35:20 -0500] "GET /nexus/repository/bower-public/packages/jquery HTTP/1.1" 200 - 101 326 "node/v15.1.0 linux x64" [qtp15707558-368] host=host.docker.internal:8083 forwarded-proto=- forwarded-host=- forwarded-port=- forwarded-server=- "new-forwarded=-" "RUT=-" "foo=-"
172.18.0.1 - - [10/Nov/2020:16:35:20 -0500] "GET /nexus/repository/bower-public/jquery/versions.json HTTP/1.1" 200 - 1416 370 "-" [qtp15707558-368] host=host.docker.internal:8083 forwarded-proto=- forwarded-host=- forwarded-port=- forwarded-server=- "new-forwarded=-" "RUT=-" "foo=-"
172.18.0.1 - - [10/Nov/2020:16:35:23 -0500] "GET /nexus/repository/bower-public/jquery/3.5.1/package.tar.gz HTTP/1.1" 200 - 434402 2248 "-" [qtp15707558-368] host=host.docker.internal:8083 forwarded-proto=- forwarded-host=- forwarded-port=- forwarded-server=- "new-forwarded=-" "RUT=-" "foo=-"
Repo List
IQ Server Report
jquery 3.0.0-rc1 has CVE-2016-10707 with CVSS 7.5, so you'll need to have Quarantine enabled in the capability you created in step 2 and Proxy=Fail in your Security-High policy in IQ Server
bower --allow-root install jquery#3.0.0-rc1
Console Output
Repo List
IQ Server Report
You can reproduce the 403 - Quarantined error by clicking on the "Path" link: http://host.docker.internal:8083/nexus/repository/bower-registry.bower.io-proxy/jquery/3.0.0-rc1/package.tar.gz
| Not supported |
|---|
