david-a-wheeler / flawfinder

a static analysis tool for finding vulnerabilities in C/C++ source code

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Invalid helpUri generated

FlorianKleemiss opened this issue · comments

Integrating flawfinder in my github repo I revieved a .sarif report generated, that has the following entry:

{
  "$schema": "https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0-rtm.5.json",
  "version": "2.1.0",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "Flawfinder",
          "version": "2.0.19",
          "informationUri": "https://dwheeler.com/flawfinder/",
          "rules": [
            {
[...]
              "id": "FF1057",
              "name": "misc/InitializeCriticalSection",
              "shortDescription": {
                "text": "Exceptions can be thrown in low-memory situations."
              },
              "defaultConfiguration": {
                "level": "warning"
              },
              "helpUri": ")",
              "relationships": []
            },

Uploading the result .sarif file caused an error in the workflow:

{
    "property": "instance.runs[0].tool.driver.rules[3].helpUri",
    "message": "does not conform to the \"uri\" format",
    "schema": {
      "description": "A URI where the primary documentation for the report can be found.",
      "type": "string",
      "format": "uri"
    },
    "instance": ")",
    "name": "format",
    "argument": "uri",
    "stack": "instance.runs[0].tool.driver.rules[3].helpUri does not conform to the \"uri\" format"
  }
Error: Unable to upload "/home/runner/work/wfn2fchk/wfn2fchk/flawfinder_results.sarif" as it is not valid SARIF:
- instance.runs[0].tool.driver.rules[3].helpUri does not conform to the "uri" format

Thank you for looking into this!

Possible dups of this: #67 and #78