Skip to content

jfrog-cli 2.50.2 - SARIF file Missing physicalLocation.artifactLocation.uri #2270

Open

Description

Describe the bug

GitHub Advanced Security requires a 'physicalLocation.artifactLocation.uri' value. GHAS will fail to load the SARIF results if this data is not provided.

The SARIF file from jfrog-cli 2.50.2 scans is missing this value (previous releases have loaded, but I don't have any of them available to confirm).

Each result location must provide the property 'physicalLocation.artifactLocation.uri'. GitHub Advanced Security code scanning will not display a result whose location does not provide the URI of the artifact that contains the result.

Current behavior

SARIF file generated by jfrog-cli 2.50.2 fails the validation using the GHAS ingestion rules ( https://sarifweb.azurewebsites.net/Validation )

Reproduction steps

Generate SARIF file from 2.50.2
Run through the https://sarifweb.azurewebsites.net/Validation page with the GitHub ingestion rules enabled

Expected behavior

Clean results from SARIF Web validation

JFrog CLI version

jf version 2.50.2

Operating system type and version

Centos 8

JFrog Artifactory version

Enterprise Plus 7.55.10 rev 75510900

JFrog Xray version

{"xray_version":"3.65.2","xray_revision":"bca527a"}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions