[BUG] Sarif format not working

[pragmaticivan]

[BUG] Sarif format not working

[pragmaticivan]

Great!!!

[haya14busa]

I just released the new version.

[pragmaticivan]

{
    "id": "DS002",
    "name": "Misconfiguration",
    "shortDescription": {
      "text": "Image user should not be \u0026#39;root\u0026#39;"
    },
    "fullDescription": {
      "text": "Running containers with \u0026#39;root\u0026#39; user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a \u0026#39;USER\u0026#39; statement to the Dockerfile."
    },
    "defaultConfiguration": {
      "level": "error"
    },
    "helpUri": "https://avd.aquasec.com/misconfig/ds002",
    "help": {
      "text": "Misconfiguration DS002\nType: Dockerfile Security Check\nSeverity: HIGH\nCheck: Image user should not be 'root'\nMessage: Specify at least 1 USER command in Dockerfile with non-root user as argument\nLink: [DS002](https://avd.aquasec.com/misconfig/ds002)\nRunning containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.",
      "markdown": "**Misconfiguration DS002**\n| Type | Severity | Check | Message | Link |\n| --- | --- | --- | --- | --- |\n|Dockerfile Security Check|HIGH|Image user should not be 'root'|Specify at least 1 USER command in Dockerfile with non-root user as argument|[DS002](https://avd.aquasec.com/misconfig/ds002)|\n\nRunning containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile."
    },
    "properties": {
      "precision": "very-high",
      "security-severity": "8.0",
      "tags": [
        "misconfiguration",
        "security",
        "HIGH"
      ]
    }
  }

There seems to be a problem with JSON Decoder on DS002\nType: the /n is not valid and it's breaking the decoder.

[pragmaticivan]

ref: aquasecurity/trivy#5559

[pragmaticivan]

I've tested with a valid sarif file, still doesn't produce anything.

[pragmaticivan]

Command:

echo -n "$(cat ./trivy-config-terraform-module-scan.sarif)" | reviewdog -f=sarif -diff="git diff FETCH_HEAD"

no output produced

[irgaly]

Note:

Trivy SARIF sample
https://github.com/aquasecurity/trivy-sarif-demo/blob/d1968305c1133a0efd42bde85cd3bbefa68aa960/debug-trivy-results.sarif

[irgaly]

I have tested with an Trivy SARIF result https://github.com/aquasecurity/trivy-sarif-demo/blob/d1968305c1133a0efd42bde85cd3bbefa68aa960/debug-trivy-results.sarif, and fix it by PR #1653.

[erawhctim]

Any ETA on when #1653 might be available in a new release?