fix(govulncheck): reject SARIF reports with a clear error pointing to the SARIF scan type#15087
Merged
Maffooch merged 1 commit intoJun 26, 2026
Conversation
… the SARIF scan type
The Govulncheck Scanner parsers only handle govulncheck's native JSON output.
When a govulncheck SARIF report (govulncheck -format sarif) is uploaded to a
Govulncheck Scanner scan type, V1 crashed with an opaque KeyError ('Vulns') and
V2 silently returned 0 findings.
Detect a SARIF document (top-level 'runs' key) in both parsers and raise a
ValueError instructing the user to use the generic 'SARIF' scan type instead.
Add a note to the Govulncheck docs page. Refs DefectDojo#15033.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Maffooch
approved these changes
Jun 26, 2026
dogboat
approved these changes
Jun 26, 2026
paulOsinski
approved these changes
Jun 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The Govulncheck Scanner parsers only handle govulncheck's native JSON output
(
govulncheck -format json). When a govulncheck SARIF report(
govulncheck -format sarif) is uploaded to a Govulncheck Scanner scan type:Govulncheck Scanner(V1) crashed with an opaqueKeyError: 'Vulns'Govulncheck Scanner V2silently returned 0 findingsBoth detect a SARIF document (top-level
runskey) and now raise a clearValueErrortelling the user to import govulncheck SARIF output via the genericSARIF scan type instead.
A note was added to the Govulncheck docs page documenting this.
Why not parse SARIF here?
The generic SARIF parser already imports govulncheck SARIF correctly (findings,
severities, descriptions). Duplicating SARIF handling in the govulncheck parser
to gain only
component_name/CVE — andcomponent_versionisn't even present ingovulncheck SARIF — isn't worth the maintenance surface. The right fix is to fail
fast with guidance toward the correct scan type.
Testing
unittests/tools/test_govulncheck_parser.py: addedtest_parse_sarif_is_rejectedto both the V1 and V2 test classes.
unittests/scans/govulncheck/issue_15033_sarif.json(trimmedgovulncheck SARIF, one result per severity level).
Refs #15033
🤖 Generated with Claude Code