json output for lock files and Dockerfiles does not include line numbers #4394
Replies: 1 comment 13 replies
-
|
It is not a lock file, but Dockerfile, right? |
Beta Was this translation helpful? Give feedback.
-
|
@DmitriyLewen @knqyf263 Neither dependencies in lock files nor issues in Dockerfiles show line numbers when using |
Beta Was this translation helpful? Give feedback.
-
|
@DmitriyLewen yes @tbutler-qontigo Please see the above comment. Some checks don't have line numbers. |
Beta Was this translation helpful? Give feedback.
-
|
@knqyf263 agreed, but in all cases where they have line numbers in a |
Beta Was this translation helpful? Give feedback.
-
|
AFAIR, SARIF doesn't allow empty line numbers, so we just put dummy values to SARIF. The empty value is technically correct. I think we can leave JSON as is. |
Beta Was this translation helpful? Give feedback.
-
|
Let me rephrase then "in all cases where there is a valid line number available, as it appears in a SARIF report or when |
Beta Was this translation helpful? Give feedback.
-
Description
Cloning your example repo, https://github.com/knqyf263/trivy-ci-test.git, if I output results in JSON format then the issues do not include start/end lines but if I output the results in SARIF format then they do.
e.g. JSON
{ "Type": "Dockerfile Security Check", "ID": "DS026", "AVDID": "AVD-DS-0026", "Title": "No HEALTHCHECK defined", "Description": "You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.", "Message": "Add HEALTHCHECK instruction in your Dockerfile", "Namespace": "builtin.dockerfile.DS026", "Query": "data.builtin.dockerfile.DS026.deny", "Resolution": "Add HEALTHCHECK instruction in Dockerfile", "Severity": "LOW", "PrimaryURL": "https://avd.aquasec.com/misconfig/ds026", "References": [ "https://blog.aquasec.com/docker-security-best-practices", "https://avd.aquasec.com/misconfig/ds026" ], "Status": "FAIL", "Layer": {}, "CauseMetadata": { "Provider": "Dockerfile", "Service": "general", "Code": { "Lines": null } } }vs SARIF:
{ "ruleId": "DS026", "ruleIndex": 39, "level": "note", "message": { "text": "Artifact: Dockerfile\nType: dockerfile\nVulnerability DS026\nSeverity: LOW\nMessage: Add HEALTHCHECK instruction in your Dockerfile\nLink: [DS026](https://avd.aquasec.com/misconfig/ds026)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "Dockerfile", "uriBaseId": "ROOTPATH" }, "region": { "startLine": 1, "startColumn": 1, "endLine": 1, "endColumn": 1 } }, "message": { "text": "Dockerfile" } } ] }Desired Behavior
Both JSON format and SARIF format include the start/end line and start/end column information where available.
It works for Misconfigurations but vulnerabilities, at least for lock files, do not include this information when in JSON format.
Actual Behavior
No start/end line information is included in the output - see the example above
Reproduction Steps
Target
Filesystem
Scanner
Vulnerability
Output Format
JSON
Mode
Standalone
Debug Output
Operating System
Windows 10
Version
Checklist
trivy --resetBeta Was this translation helpful? Give feedback.
All reactions