How to Convert Json value into Sarif format

[mohdrashid1]

Below is my Output which i want to convert into Sarif format

im trying in github action

Vulnerablilites:

{ "id": "66c5b89700fbf372c2f1f182", "method": "post", "path": "/user", "type": "API-DP9-2024", "severity": "High", "label": "Bot Data Modification", "impact": "Vulnerablity" }

Here is i try

sarif_output=$(cat <<EOF
{
  "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
  "version": "2.1.0",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "Custom Vulnerability Scanner",
          "version": "1.0",
          "informationUri": "https://example.com/tool-info",
          "rules": [
            {
              "id": "API-DP9-2024",
              "name": "Bot Data Modification",
              "shortDescription": {
                "text": "This rule identifies API endpoints vulnerable to bot data modification."
              },
              "fullDescription": {
                "text": "Bot Data Modification vulnerabilities occur when an API endpoint allows unauthorized data modification by automated systems."
              },
              "helpUri": "https://example.com/rules/API-DP9-2024",
              "defaultConfiguration": {
                "level": "error"
              }
            }
          ]
        }
      },
      "results": [
        {
          "ruleId": "API-DP9-2024",
          "level": "error",
          "message": {
            "text": "Vulnerability Report: Bot Data Modification on POST /user Endpoint."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "user",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "startLine": 1
                }
              }
            }
          ]
        }
      ]
    }
  ]
}
EOF
)

Got Error failed

Error details: instance is not allowed to have the additional property ""
Error: Unable to upload "./vulnerabilities-results.sarif" as it is not valid SARIF:
- instance is not allowed to have the additional property ""

[sthagen]

To support the poster in creating valid SARIF from their JSON it would be helpful which validator was used that reported the error messages from the question.

Other than that:

Schema URL

The latest SARIF v2.1.0 specification at https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/sarif-v2.1.0-errata01-os-complete.html

Lists as "Additional artifacts": The SARIF schema: https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/sarif-schema-2.1.0.json.

So, I would expect a SARIF instance file to refer to that URL: https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/sarif-schema-2.1.0.json

Validators

https://sarifweb.azurewebsites.net/Validation

When taking the valid JSON part from your question (without the shell Rococo) the validation without requesting additional ingestion rules at https://sarifweb.azurewebsites.net/Validation does succeed.

When requesting "Azure DevOps ingestion rules" in that validator form (anchored at lines 5, 7, 30 twice):

1. ADO1014: runs[0]: This 'run' object does not provide an 'automationDetails' property. This property is required by the Azure DevOps Advanced Security service.
2. ADO1018: runs[0].tool.driver: This 'driver' object does not provide a 'fullName' value. This property is required by the Azure DevOps Advanced Security service.
3. ADO1015: runs[0].results[0]: This 'result' object does not provide a 'partialFingerprints' dictionary. This property is required by the Azure DevOps Advanced Security service.
4. ADO1017: runs[0].results[0]: This 'result' object does not provide a 'partialFingerprints' dictionary. This property is required by the Azure DevOps Advanced Security service.

When requesting "GitHub ingestion rules" at line 14:

1. SARIF2012: runs[0].tool.driver.rules[0].name: 'Bot Data Modification' is not a Pascal-case identifier. For uniformity of experience across all tools that produce SARIF, the friendly name should be a single Pascal-case identifier, for example, 'ProvideRuleFriendlyName'.

Selecting "Additional suggestions" yields 7 (not shown here).

Hope this helps