jsonfinder

jsonfinder is a small command-line tool that searches many JSON files in parallel and prints the paths of files that match one or more filters. It was designed to be piped into other tools and to be used in large repositories of JSON (vulnerability data, manifests, metadata, etc).

• Only outputs matching file paths (one-per-line) to stdout — perfect for piping.
• Supports regex (=~), equality (==, !=), numeric and version-like comparisons (<, >, <=, >=).
• Can read a list of files from stdin or discover .json files recursively under --dir.
• Processes files in parallel (--parallel) for speed.

This utility has been primarily tested on cvelistV5 from CVEProject content.

Features

• Dot-path traversal (e.g. containers.cna.descriptions.value), automatically explores arrays.
• Multiple --filter options are combined with AND logic.
• Regex filters use Python's re.search.
• Version-like comparisons split non-digit separators and compare integer tokens (e.g. 14.7 < 15.0.1).

Install / Usage

• Clone the repo and make the script executable:

  git clone <your-repo-url>
  cd jsonfinder
  chmod +x jsonfinder.py
  

• Show help:

  ./jsonfinder.py -h
  

• Examples:
• Recursively search a directory with two filters:

  ./jsonfinder.py --dir /path/to/jsons --parallel 12
  --filter "containers.cna.descriptions.value=~malicious image"
  --filter "containers.cna.affected.vendor=~Apple"
  

• Pipe a file list into jsonfinder:

  find /path -name '*.json' | ./jsonfinder.py --parallel 6 --filter "foo.bar==baz"
  

• Only one filter (version compare):

  ./jsonfinder.py --dir /vulns --filter "containers.cna.affected.versions.lessThan<14.7"
  

Filter syntax

Each --filter has the form:

<dot.path><op><value>

Operators:

• =~ — regex match (Python re.search)
• == — exact equality
• != — not equal (true if any found value != comparator)
• <, >, <=, >= — numeric or version-like comparisons

Examples:

• --filter "a.b.c=~some pattern"
• --filter "vendor==Apple"
• --filter "version<2.0.1"

Behavior & notes

• Multiple --filter options are treated as AND: a file must satisfy them all.
• Arrays are automatically traversed: if a path segment leads to a list, every element is checked.
• If you run the script with no arguments, it prints the helper menu and exits (convenient when discovered via automation).
• The script prints errors to stderr only if --verbose is set.

Contributing

Contributions, bug reports and feature requests are welcome. Suggested future enhancements:

• Add OR/complex expression groups.
• Support JSONPath or JMESPath for more expressive filters.
• Allow exporting matched JSON snippets instead of only paths.

📜 License & Attribution

Any use, reproduction, or modification of this software must give clear and visible credit to Thireus and the jsonfinder tool.
See the LICENSE file for more details.