secureCodeBox / secureCodeBox/secureCodeBox
👨🔬 Cross check the OASIS SARIF format with the SCB generic DAST Finding Format
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 988
- Forks
- 184
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 42
Description
The OASIS introduced a standard format for Static Analysis Results (SAST) which means a lot of SAST scanners recently adopted this as a common result format. Sadly as for now there is no comparable standard for DAST scanners. But maybe it's a good inspiration and starting point to cross check this standard with the generic secureCodeBox Findings Result Format used for all integrated DAST scanners by now.
Additional Context
- Original Source & Documentation
- GitHub Support: https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/uploading-a-sarif-file-to-github
- GitLab Support: https://gitlab.com/gitlab-org/gitlab/-/issues/118496
- SARIF Validator: https://sarifweb.azurewebsites.net/Validation
- FindBugs Example: https://github.com/ShiftLeftSecurity/sast-scan/blob/master/test/data/findsecbugs-report.sarif
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the secureCodeBox Findings Result Format documentation and the linked OASIS SARIF 2.1.0 specification, then use the SARIF Validator and referenced examples to compare the formats. Done should include a documented cross-check identifying how the formats align and where they differ.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100