SO_PARSER_NAME - Fix SARIF values

[Lucassino]

Hello, every SO_PARSER_NAME are defined as "Sarif" which doesn't works as expected in Github actions. After some analysis, the correct values should be "SARIF".

HTTPError: 400 Client Error: Bad Request for url: [http://my-backend:5000/api/import/file_upload_observations_by_name/)
Response: "message":"Parser Sarif does not exist"

My suggestion is change the values of entrypoints_"TOOL".sh to SARIF

From tools, i found:
Bandit, Checkov, Eslint, Gitleaks, Kics, Semgrep, TFSec

[Lucassino]

Some demonstration using CURL

curl -v -X POST http://my-backend:5000/api/import/file_upload_observations_by_name/      -H "Authorization: APIToken api_token_x"      -F "[email protected]"      -F "product_name=my-product"      -F "parser_name=Sarif"
Note: Unnecessary use of -X or --request, POST is already inferred.
*   Trying 54.76.129.82:5000...
* Connected to emy-backend (54.76.129.82) port 5000 (#0)
> POST /api/import/file_upload_observations_by_name/ HTTP/1.1
> Host: my-backend:5000
> User-Agent: curl/7.81.0
> Accept: */*
> Authorization: APIToken api_token_x
> Content-Length: 611484
> Content-Type: multipart/form-data; boundary=------------------------c6bda0ff93416359
> 
* We are completely uploaded and fine
* Mark bundle as not supporting multiuse
< HTTP/1.1 400 Bad Request
< Server: undisclosed
< Date: Tue, 12 Nov 2024 16:27:38 GMT
< Connection: keep-alive
< Content-Type: application/json
< Allow: POST, OPTIONS
< Cross-Origin-Embedder-Policy: require-corp
< Cross-Origin-Opener-Policy: same-origin
< Cross-Origin-Resource-Policy: same-site
< Cache-Control: no-cache, no-store, must-revalidate, private
< Permissions-Policy: geolocation=() camera=(), microphone=()
< Content-Security-Policy: frame-ancestors 'self'; default-src 'self'; base-uri 'none'; script-src 'self'; form-action 'self'; object-src 'none'
< X-Frame-Options: DENY
< Content-Length: 42
< Vary: origin
< X-Content-Type-Options: nosniff
< Referrer-Policy: strict-origin-when-cross-origin
< 
* Connection #0 to host my-backend left intact
{"message":"Parser Sarif does not exist"}

[Lucassino]

Correct one:

curl -v -X POST http://my-backend:5000/api/import/file_upload_observations_by_name/      -H "Authorization: APIToken api_token_x"      -F "[email protected]"      -F "product_name=my-product"      -F "parser_name=SARIF"
Note: Unnecessary use of -X or --request, POST is already inferred.
*   Trying 52.209.177.20:5000...
* Connected to my-backend (52.209.177.20) port 5000 (#0)
> POST /api/import/file_upload_observations_by_name/ HTTP/1.1
> Host: my-backend:5000
> User-Agent: curl/7.81.0
> Accept: */*
> Authorization: APIToken api_token_x
> Content-Length: 293554
> Content-Type: multipart/form-data; boundary=------------------------88c4edc02f4f42be
> 
* We are completely uploaded and fine
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Server: undisclosed
< Date: Tue, 12 Nov 2024 16:41:01 GMT
< Connection: keep-alive
< Content-Type: application/json
< Allow: POST, OPTIONS
< Cross-Origin-Embedder-Policy: require-corp
< Cross-Origin-Opener-Policy: same-origin
< Cross-Origin-Resource-Policy: same-site
< Cache-Control: no-cache, no-store, must-revalidate, private
< Permissions-Policy: geolocation=() camera=(), microphone=()
< Content-Security-Policy: frame-ancestors 'self'; default-src 'self'; base-uri 'none'; script-src 'self'; form-action 'self'; object-src 'none'
< X-Frame-Options: DENY
< Content-Length: 164
< Vary: origin
< X-Content-Type-Options: nosniff
< Referrer-Policy: strict-origin-when-cross-origin
< 
* Connection #0 to host my-backend left intact
{"observations_new":55,"observations_updated":0,"observations_resolved":0,"license_components_new":0,"license_components_updated":0,"license_components_deleted":66}

[StefanFl]

Hi @Lucassino, I don't get a notification for discussions and there is no badge about new entries in the UI, so it took a few days to see it.

Great find, thank you for that. It is dependant on the database. It works for MySQL, which I use in my productive environment, but it doesn't work with PostgreSQL.

I will copy your post into an issue at the actions/templates repository and release a fix.

[Lucassino]

Thanks @StefanFl .

Kind regards.