search

google / osv-scanner

Vulnerability scanner written in Go which uses the data provided by https://osv.dev
https://google.github.io/osv-scanner/
Apache License 2.0
6.27k stars 363 forks source link

Support recommended security-severity property in SARIF file export #762

Open graemechristie opened 10 months ago

graemechristie commented 10 months ago

The current rules in the exported Sarif file do not include the security-severity property. A per the docs below, this is recommended for security rules.

https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning#reportingdescriptor-object

Likewise, the precision property is also recommended and used in concert with the security severity to assess the impact of the recorded CVE's.

github-actions[bot] commented 4 months ago

This issue has not had any activity for 60 days and will be automatically closed in two weeks

github-actions[bot] commented 3 months ago

Automatically closing stale issue