Add SARIF support

[stevespringett]

SARIF should be able to describe vulnerable components even though its' original purpose was representing source code vulnerabilities.

Recently, the Dependency-Check project implemented SARIF support with the intended use case that the resulting file would be published to GitHub (which now supports SARIF) and can process and display results directly in GitHub.

This enhancement request is to add support for generating SARIF via an API. This would dynamically generate the SARIF (via pebble), and the resulting file would be downloaded.

[stevespringett]

Refer to jeremylong/DependencyCheck#3081

[RunFox]

Hello!
Is any updates?

[nscuro]

@RunFox Not implemented so far. But it seems like a nice "good first issue" candidate for new contributors to work on. :)

Note on implementation: The existing /api/v1/finding/<PROJECT_UUID> endpoint should be extended to support an Accept: application/sarif+json header. If that header is provided, return the findings in SARIF format. Otherwise, return findings in the existing, DT-specific JSON format. https://www.iana.org/assignments/media-types/application/sarif+json

[aravindparappil46]

Hi folks,
I have created a PR for this enhancement: #3561
Would appreciate any feedback! (Some eyes on the sarif.peb would be great!)

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.