Skip to content

SARIF output is missing names on rules breaking GitLab parsing #599

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
jameshartig opened this issue Oct 23, 2023 · 1 comment · Fixed by #600
Closed

SARIF output is missing names on rules breaking GitLab parsing #599

jameshartig opened this issue Oct 23, 2023 · 1 comment · Fixed by #600
Assignees
@another-rex

Comments

@jameshartig
Copy link

We are using the SARIF output and then converting it to GitLab's own SAST format. One issue we ran into is that GitLab requires a "name" on vulnerabilities which come from the reportingDescriptor (rule):
image

GitLab's conversion code just takes the name field off the rule.

Can the name field be added to the rule to fix this?
@another-rex another-rex mentioned this issue Oct 24, 2023
Merged
another-rex added a commit that referenced this issue Oct 24, 2023
@another-rex
Add name field to sarif rule output (#600)
c00f630 
Fixes #599
@another-rex
Copy link
Collaborator

Thanks for bringing this up! I added the name field, and it will be included in the release this week.

@Porkepix Porkepix mentioned this issue Oct 25, 2023
Merged
another-rex added a commit to another-rex/osv-scanner that referenced this issue Oct 26, 2023
@another-rex @G-Rath
Minor fixes (#6)
803e35a 
* Add name field to sarif rule output (google#600)

Fixes google#599

* fix: trim leading and trailing newlines off SARIF output (google#606)

I don't know a lot about SARIF so maybe these are required but that
would be surprising to me whereas trimming these off make it a bit
consistent for editors and such.

Obviously if these are required then lets close this PR

* Update release pipeline (google#602)

Update the release pipeline to have it be manually triggered, and create
a tag itself if checks and scans are successful.

It looks something like this:

![image](https://github.com/google/osv-scanner/assets/106129829/8258a7d3-3438-46f7-82cd-49c2b4056ecf)

The release doc has been updated to follow this new workflow.

* chore: don't trim trailing whitespace on fixture snapshots (google#608)

This makes it easier to work with for IDEs

* Prepare for 1.4.2 release (google#609)

* Update jekyll feed, for some reason renovatebot can't figure out how to update this

* Fix documentation for github action

* Set upload tag name

---------

Co-authored-by: Gareth Jones <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@another-rex another-rex

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add name field to sarif rule output another-rex/osv-scanner
2 participants
@jameshartig @another-rex