Output SARIF format is confusing / broken

[yuligesec]

• Format fix
• Format test / validation

 -se, -sarif-export string     file to export results in SARIF format

Although nuclei supports exporting to sarif format, it does not conform to the rules of sarif format, and the output result should be placed in the results field. But not.

It is confusing, like this.

...
"results": [
        {
          "ruleId": "tech-detect-95410662745f9d47610c389af7d617774a98aa0c",
          "ruleIndex": 0,
          "level": "note",
          "message": {
            "text": "http://127.0.0.1:18080"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "README.md"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "message": {
                "text": "http://127.0.0.1:18080"
              }
            }
          ]
        },
...

Sarif Viewer can't view it and get any useful information!

[ehsandeep]

@yuligesec thanks for reporting this. Could you also specify what tool you used to view/validate sarif format?

[ehsandeep]

From https://github.com/schniggie/vuln-mgmt/actions/runs/3383544249 (projectdiscovery/nuclei-action#43)

Unable to upload "nuclei.sarif" as it is not valid SARIF:
- instance.runs[0].tool.driver.rules[0].help requires property "text"
- instance.runs[0].tool.driver.rules[1].help requires property "text"
- instance.runs[0].tool.driver.rules[2].help requires property "text"
- instance.runs[0].tool.driver.rules[3].help requires property "text"
- instance.runs[0].tool.driver.rules[4].help requires property "text"
- instance.runs[0].tool.driver.rules[5].help requires property "text"
- instance.runs[0].tool.driver.rules[6].help requires property "text"
- instance.runs[0].tool.driver.rules[7].help requires property "text"
- instance.runs[0].tool.driver.rules[8].help requires property "text"
- instance.runs[0].tool.driver.rules[9].help requires property "text"
- instance.runs[0].tool.driver.rules[10].help requires property "text"

[yuligesec]

@yuligesec thanks for reporting this. Could you also specify what tool you used to view/validate sarif format?

For example : vscode extension Sarif Viewer

[schniggie]

how can I assist here? really want this to work :)

[tarunKoyalwar]

nuclei sarif is generated using https://github.com/owenrumney/go-sarif which seems to be the core problem .
This issue will be blocked until https://github.com/projectdiscovery/sarif is available

[tarunKoyalwar]

@schniggie , PR is in progress with lot of improvements . you can try it using https://github.com/projectdiscovery/nuclei/tree/issue-2608-fix-sarif branch

[ehsandeep]

@schniggie @yuligesec this is now fixed in the dev version with #2925, next release of nuclei is planned for Monday.