nccgroup / sobelow

Security-focused static analysis for the Phoenix Framework
Apache License 2.0
1.66k stars 92 forks source link

Formatting as json with `-f json` causes crash. #89

Closed alex0112 closed 3 years ago

alex0112 commented 3 years ago

Description:

Running sobelow with the option to output a JSON report (mix sobelow -f json) produces an exception.

Steps to reproduce:



### Environment Information:
- Sobelow Version: `v0.11.1` (Tried with both published hex package, and build from master branch on github)
- Operating System: MacOS Catalina 10.15.7, error also occurs on a Debian based docker image.

### Notes:
Digging in to the stack trace a little indicates that [`Sobelow.print_output/0`](https://github.com/nccgroup/sobelow/blob/master/lib/sobelow.ex#L142) makes a call to `Sobelow.FindingLog.json/1` which attempts to call [`Jason.encode!/1`](https://github.com/nccgroup/sobelow/blob/master/lib/sobelow/finding_log.ex#L22) but is unable to find `Jason` within the scope of the current module. When building the module or running the install command provided by the README, `Jason` is being installed as a dependency. However, `Jason` is not being `alias`ed into the `FindingLog` module definition, which may be causing the issue.
GriffinMB commented 3 years ago

Hey! Thanks for opening this issue. It looks like I missed a README update - as of 11.0, you should install Sobelow with mix escript.install hex sobelow. The Changelog has some additional details. Let me know if that fixes your issue, and I will update the README now.

alex0112 commented 3 years ago

Installing with mix escript.install got it running again. Thank you!