error converting SARIF from Semgrep CLI

[semgrep-shichao]

HI SCW team,

I tried to integrate SCW to my github action to process SARIF generated from Semgrep CLI, and I got the following:

Run SecureCodeWarrior/github-action-add-sarif-contextual-training@v1.15
  with:
    inputSarifFile: ./results.json
    outputSarifFile: ./processed-sarifs
  env:
    SEMGREP_APP_TOKEN: ***
/usr/bin/docker exec  5568dc96a9a97d3367760e569ff2664efabbaf480c545f32be86260f7f142d4e sh -c "cat /etc/*release | grep ^ID"
./results.json
Error Error: Received error response
    at /__w/_actions/SecureCodeWarrior/github-action-add-sarif-contextual-training/v1.15/directLinking.js:29:1
    at processTicksAndRejections (node:internal/process/task_queues:95:5)
    at processRule (/__w/_actions/SecureCodeWarrior/github-action-add-sarif-contextual-training/v1.15/sarifProcessors/ruleProcessor.js:50:1)
    at Object.processRun (/__w/_actions/SecureCodeWarrior/github-action-add-sarif-contextual-training/v1.15/sarifProcessors/ruleProcessor.js:88:1)
    at run (/__w/_actions/SecureCodeWarrior/github-action-add-sarif-contextual-training/v1.15/runner.js:47:1)
Error Error: Received error response
    at /__w/_actions/SecureCodeWarrior/github-action-add-sarif-contextual-training/v1.15/directLinking.js:29:1
    at processTicksAndRejections (node:internal/process/task_queues:95:5)
    at processRule (/__w/_actions/SecureCodeWarrior/github-action-add-sarif-contextual-training/v1.15/sarifProcessors/ruleProcessor.js:50:1)
    at Object.processRun (/__w/_actions/SecureCodeWarrior/github-action-add-sarif-contextual-training/v1.15/sarifProcessors/ruleProcessor.js:88:1)
    at run (/__w/_actions/SecureCodeWarrior/github-action-add-sarif-contextual-training/v1.15/runner.js:47:1)
Error Error: Received error response
    at /__w/_actions/SecureCodeWarrior/github-action-add-sarif-contextual-training/v1.15/directLinking.js:29:1
    at processTicksAndRejections (node:internal/process/task_queues:95:5)
    at processRule (/__w/_actions/SecureCodeWarrior/github-action-add-sarif-contextual-training/v1.15/sarifProcessors/ruleProcessor.js:50:1)
    at Object.processRun (/__w/_actions/SecureCodeWarrior/github-action-add-sarif-contextual-training/v1.15/sarifProcessors/ruleProcessor.js:88:1)
    at run (/__w/_actions/SecureCodeWarrior/github-action-add-sarif-contextual-training/v1.15/runner.js:47:1)

my GH action yaml is here:

https://github.com/semgrep-sc-CI/semgrep-int-SCW/blob/main/.github/workflows/semgrep.yml

[semgrep-shichao]

sample SARIF output from Semgrep CLI
results.json

[cwong-scw]

Hi @semgrep-shichao,

Thanks for reporting this! Despite the errors being logged, this should actually be working as expected. Are you seeing the Semgrep issues in the Code Scanning area of Github Security and has SCW content been appended in the content area? If you are able to provide a screenshot of one of the findings (e.g. for javascript.express.web.tainted-redirect-express.tainted-redirect-express) that would be very helpful to confirm. Please feel free to redact the screenshots if needed but if you can expand the description section so we can see if our content was appended correctly that would be greatly appreciated.

We realise that error message is unnecessarily noisy and confusing and will update the action to suppress this. The error is actually just a result of a 404 when the API is unable to map the requested CWE reference internally, and the action will just skip these and move on with processing the remaining results in the SARIF file. Apologies for the confusion caused by the errors and thank you for your understanding.