Support SARIF output

[mrtc0]

This pull request supports the SARIF output option.

SARIF is also supported on GitHub Code Scanning. Upload the resulting report to GitHub so you can view your audit on GitHub. More details here.

The SARIF report generated by gosec -fmt=sarif ... has the following format:

details

{
	"$schema": "https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0-rtm.4.json",
	"version": "2.1.0",
	"runs": [
		{
			"tool": {
				"driver": {
					"name": "gosec",
					"informationUri": "https://github.com/securego/gosec/",
					"rules": [
						{
							"id": "G401 (CWE-326)",
							"name": "Use of weak cryptographic primitive",
							"shortDescription": {
								"text": "Use of weak cryptographic primitive"
							},
							"fullDescription": {
								"text": "Use of weak cryptographic primitive"
							},
							"help": {
								"text": "Use of weak cryptographic primitive\nSeverity: MEDIUM\nConfidence: HIGH\nCWE: https://cwe.mitre.org/data/definitions/326.html"
							},
							"properties": {
								"tags": [
									"CWE-326",
									"MEDIUM"
								]
							}
						},
						{
							"id": "G501 (CWE-327)",
							"name": "Blocklisted import crypto/md5: weak cryptographic primitive",
							"shortDescription": {
								"text": "Blocklisted import crypto/md5: weak cryptographic primitive"
							},
							"fullDescription": {
								"text": "Blocklisted import crypto/md5: weak cryptographic primitive"
							},
							"help": {
								"text": "Blocklisted import crypto/md5: weak cryptographic primitive\nSeverity: MEDIUM\nConfidence: HIGH\nCWE: https://cwe.mitre.org/data/definitions/327.html"
							},
							"properties": {
								"tags": [
									"CWE-327",
									"MEDIUM"
								]
							}
						},
						{
							"id": "G104 (CWE-703)",
							"name": "Errors unhandled.",
							"shortDescription": {
								"text": "Errors unhandled."
							},
							"fullDescription": {
								"text": "Errors unhandled."
							},
							"help": {
								"text": "Errors unhandled.\nSeverity: LOW\nConfidence: HIGH\nCWE: https://cwe.mitre.org/data/definitions/703.html"
							},
							"properties": {
								"tags": [
									"CWE-703",
									"LOW"
								]
							}
						}
					]
				}
			},
			"results": [
				{
					"ruleId": "G401 (CWE-326)",
					"ruleIndex": 0,
					"level": "warning",
					"message": {
						"text": "Use of weak cryptographic primitive"
					},
					"locations": [
						{
							"physicalLocation": {
								"artifactLocation": {
									"uri": "main.go"
								},
								"region": {
									"startLine": 31,
									"startColumn": 10,
									"endColumn": 10
								}
							}
						}
					]
				},
				{
					"ruleId": "G501 (CWE-327)",
					"ruleIndex": 1,
					"level": "warning",
					"message": {
						"text": "Blocklisted import crypto/md5: weak cryptographic primitive"
					},
					"locations": [
						{
							"physicalLocation": {
								"artifactLocation": {
									"uri": "main.go"
								},
								"region": {
									"startLine": 31,
									"startColumn": 10,
									"endColumn": 10
								}
							}
						},
						{
							"physicalLocation": {
								"artifactLocation": {
									"uri": "main.go"
								},
								"region": {
									"startLine": 4,
									"startColumn": 2,
									"endColumn": 2
								}
							}
						}
					]
				},
				{
					"ruleId": "G104 (CWE-703)",
					"ruleIndex": 2,
					"level": "warning",
					"message": {
						"text": "Errors unhandled."
					},
					"locations": [
						{
							"physicalLocation": {
								"artifactLocation": {
									"uri": "main.go"
								},
								"region": {
									"startLine": 31,
									"startColumn": 10,
									"endColumn": 10
								}
							}
						},
						{
							"physicalLocation": {
								"artifactLocation": {
									"uri": "main.go"
								},
								"region": {
									"startLine": 4,
									"startColumn": 2,
									"endColumn": 2
								}
							}
						},
						{
							"physicalLocation": {
								"artifactLocation": {
									"uri": "main.go"
								},
								"region": {
									"startLine": 27,
									"startColumn": 2,
									"endColumn": 2
								}
							}
						}
					]
				}
			]
		}
	]
}

Examples, including GitHub Workflow, are available at https://github.com/mrtc0/gosec-sarif-sample .

[codecov-io]

Codecov Report

Merging #539 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master     #539   +/-   ##
=======================================
  Coverage   70.81%   70.81%           
=======================================
  Files           9        9           
  Lines         562      562           
=======================================
  Hits          398      398           
  Misses        143      143           
  Partials       21       21           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update a4746e1...8555e68. Read the comment docs.

[ccojocar]

Thanks for this contribution. It looks great!