fix: container sarif replace colon within location uri

When using sarif output and the Dockerfile is not specified, the path is used as the sarif results location uri. But the path can contain colon characters (e.g. between repo and tag) and GitHub Code Scanning seems to return an error in this case. This fix replaces the colon characters from the sarif results location uri with underscore characters. Issue: LUM-257
snyk · Jun 19, 2023 · e364a81 · e364a81
1 parent b965894
commit e364a81
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 6 deletions.
diff --git a/src/lib/formatters/get-sarif-result.ts b/src/lib/formatters/get-sarif-result.ts
@@ -18,7 +18,9 @@ export function getResults(testResult): sarif.Result[] {
         {
           physicalLocation: {
             artifactLocation: {
-              uri: testResult.displayTargetFile || testResult.path,
+              uri:
+                testResult.displayTargetFile ||
+                getArtifactLocationUriFromPath(testResult.path),
             },
             region: {
               startLine: vuln.lineNumber || 1,
@@ -42,3 +44,9 @@ export function getLevel(vuln: AnnotatedIssue) {
       return 'note';
   }
 }
+
+function getArtifactLocationUriFromPath(path: string): string {
+  // Github Code Scanning returns an error when the results location uri from the uploaded sarif file contains a colon
+  // E.g. alpine:3.18.0 is not valid, but alpine_3.18.0 is valid
+  return path.replace(/:/g, '_');
+}
diff --git a/test/jest/unit/lib/formatters/get-sarif-result.spec.ts b/test/jest/unit/lib/formatters/get-sarif-result.spec.ts
@@ -5,7 +5,7 @@ describe('Retrieving sarif result', () => {
   it('should use the test results path as the location uri when target file is not present', () => {
     let result = getResults(
       getTestResult({
-        path: 'alpine:3.18.0',
+        path: 'alpine',
       }),
     );
     expect(result).toEqual([
@@ -19,7 +19,7 @@ describe('Retrieving sarif result', () => {
         locations: [
           {
             physicalLocation: {
-              artifactLocation: { uri: 'alpine:3.18.0' },
+              artifactLocation: { uri: 'alpine' },
               region: { startLine: 1 },
             },
           },
@@ -44,7 +44,7 @@ describe('Retrieving sarif result', () => {
         locations: [
           {
             physicalLocation: {
-              artifactLocation: { uri: 'alpine:3.18.0' },
+              artifactLocation: { uri: 'alpine_3.18.0' },
               region: { startLine: 1 },
             },
           },
@@ -54,7 +54,7 @@ describe('Retrieving sarif result', () => {
 
     result = getResults(
       getTestResult({
-        path: 'alpine:3.18.0',
+        path: 'alpine@sha256:c0669ef34cdc14332c0f1ab0c2c01acb91d96014b172f1a76f3a39e63d1f0bda',
         displayTargetFile: null,
       }),
     );
@@ -69,7 +69,7 @@ describe('Retrieving sarif result', () => {
         locations: [
           {
             physicalLocation: {
-              artifactLocation: { uri: 'alpine:3.18.0' },
+              artifactLocation: { uri: 'alpine@sha256_c0669ef34cdc14332c0f1ab0c2c01acb91d96014b172f1a76f3a39e63d1f0bda' },
               region: { startLine: 1 },
             },
           },