palantir / log4j-sniffer

A tool that scans archives to check for vulnerable log4j versions

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Add more details to human-readable output

nmiyake opened this issue · comments

The current human-readable output prints the path to the file or archive in which an issue is detected and a short summary of the issues that were found.

However, in some instances this information is not sufficient -- for example, if there is partial bytecode match in a class file in an archive, then having the information about the path/name of the class file within the archive is important (rather than just the path to the archive itself). It could also be helpful to explicitly list the issues that were not found rather than just those that were. The overall goal is for the human-readable output to provide enough output for an end user to fully understand what caused the vulnerability/issue to be flagged and to understand the causes to the most specific degree possible.

#45 very partially addresses this - it adds all the different permutations of matches to the final output line