Add purls in sarif report #2254
Conversation
Signed-off-by: George Liontos <george.liontos@forallsecure.com>
Signed-off-by: George Liontos <george.liontos@forallsecure.com>
grype/presenter/sarif/presenter.go
Outdated
| @@ -122,6 +122,7 @@ func (pres *Presenter) sarifRules() (out []*sarif.ReportingDescriptor) { | |||
| // For GitHub reportingDescriptor object: | |||
| // https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning#reportingdescriptor-object | |||
| "security-severity": pres.securitySeverityValue(m), | |||
| "purls": [...]string{m.Package.PURL}, | |||
There was a problem hiding this comment.
Thanks for the updates here @GeorgeLS. We should probably only add this field if we have a non-empty PURL instead of creating arrays of empty strings, like this results in -- in other words: I think the tests would be reverted because we shouldn't see "purls": [""],, and we should add something that validates when a PURL is set, it is output as expected.
There was a problem hiding this comment.
Yeah you are right. I will change asap. 🙏
Signed-off-by: George Liontos <george.liontos@forallsecure.com>
There was a problem hiding this comment.
This looks really close -- is there a possibility of getting a test added to validate that Syft is properly outputting this purls field? I can look at adding a test, but it will be at least a few days before I can get to it. A quick look makes me think we could adjust the packages returned here to include a specific one with a PURL
| if len(m.Package.PURL) != 0 { | ||
| descriptor.Properties["purls"] = [...]string{m.Package.PURL} | ||
| } |
There was a problem hiding this comment.
Idiomatic go would probably look like this (note changing from declaring an array: [...] to a slice: []):
if m.Package.PURL != "" {
descriptor.Properties["purls"] = []string{m.Package.PURL}
}
There was a problem hiding this comment.
Again, thanks a lot for the review and your time.
Sorry for the back and forth but I'm not a golang programmer.
I will add a test and update the code.
Hello there!
Seems like that
purlsare missing from Sarif reports ofgrype.I attempted adding those in the Sarif report. In order to do that I had to copy the
deriveBomReffunction that is being used in CycloneDx as well.I tried making
deriveBomRefa member function ofPackagetype in order to avoid duplication but I couldn't build the project locally.Thanks,
George