search

nccgroup / sobelow

Security-focused static analysis for the Phoenix Framework
Apache License 2.0
1.66k stars 92 forks source link

Enable SARIF Report Output #77

Closed josepalafox closed 3 years ago

josepalafox commented 3 years ago

Add SARIF as a supported output format.

SARIF is an oasis standard JSON format that aims to standardize the format of security alerts so that the data is normalized and can be integrated into a number of other tools.

GitHub supports the SARIF format and enables developers of open source projects and public repositories to view security alerts directly in the GitHub UI.

https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/uploading-a-sarif-file-to-github

GriffinMB commented 3 years ago

I need to clean up the help text a bit and improve the sarif tests, but this is now working as expected: https://github.com/GriffinMB/phx_demo/security/code-scanning/4?query=ref%3Arefs%2Fheads%2Fmaster

I should be able to close this out before the end of the weekend.

GriffinMB commented 3 years ago

This is done. Commit here: https://github.com/nccgroup/sobelow/commit/51aa8aaa38eda9b646e20d1178b0344c05e5a79b