@fabasoad/sarif-to-slack 0.1.1 → 0.2.1

package/test-data/sarif/snyk-swift.sarif

@@ -0,0 +1,112 @@
+{
+  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+  "version": "2.1.0",
+  "runs": [
+    {
+      "tool": {
+        "driver": {
+          "name": "Snyk Open Source",
+          "properties": {
+            "artifactsScanned": 21
+          },
+          "rules": [
+            {
+              "id": "SNYK-SWIFT-VAPORVAPOR-5950373",
+              "shortDescription": {
+                "text": "Medium severity - Improper Handling of Exceptional Conditions vulnerability in github.com/vapor/vapor"
+              },
+              "fullDescription": {
+                "text": "(CVE-2023-44386) github.com/vapor/vapor@4.83.2"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: swift\n* Vulnerable module: github.com/vapor/vapor\n* Introduced through: MyProject@unspecified and github.com/vapor/vapor@4.83.2\n### Detailed paths\n* _Introduced through_: MyProject@unspecified › github.com/vapor/vapor@4.83.2\n# Overview\n[vapor/vapor](https://github.com/vapor/vapor) is an a server-side Swift HTTP web framework.\n\nAffected versions of this package are vulnerable to Improper Handling of Exceptional Conditions due to the incorrect handling of `HTTP 1.x` request parsing errors, an attacker can trigger a precondition failure in `swift-nio` by misusing the API, causing an immediate termination of the server process.\n# Remediation\nUpgrade `vapor/vapor` to version 4.84.2 or higher.\n# References\n- [GitHub Commit](https://github.com/vapor/vapor/commit/090464a654b03148b139a81f8f5ac63b0856f6f3)\n- [GitHub Release](https://github.com/vapor/vapor/releases/tag/4.84.2)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-231",
+                  "swift"
+                ],
+                "cvssv3_baseScore": 5.3,
+                "security-severity": "5.3"
+              }
+            },
+            {
+              "id": "SNYK-SWIFT-VAPORVAPOR-6143589",
+              "shortDescription": {
+                "text": "Medium severity - Integer Overflow or Wraparound vulnerability in github.com/vapor/vapor"
+              },
+              "fullDescription": {
+                "text": "(CVE-2024-21631) github.com/vapor/vapor@4.83.2"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: swift\n* Vulnerable module: github.com/vapor/vapor\n* Introduced through: MyProject@unspecified and github.com/vapor/vapor@4.83.2\n### Detailed paths\n* _Introduced through_: MyProject@unspecified › github.com/vapor/vapor@4.83.2\n# Overview\n[vapor/vapor](https://github.com/vapor/vapor) is an a server-side Swift HTTP web framework.\n\nAffected versions of this package are vulnerable to Integer Overflow or Wraparound in the `vapor_urlparser_parse` function. An attacker can spoof the host by padding the port number with zeros, causing an integer overflow when the URL authority is parsed.\n# Remediation\nUpgrade `vapor/vapor` to version 4.90.0 or higher.\n# References\n- [GitHub Commit](https://github.com/vapor/vapor/commit/6db3d917b5ce5024a84eb265ef65691383305d70)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-1104",
+                  "swift"
+                ],
+                "cvssv3_baseScore": 6.5,
+                "security-severity": "6.5"
+              }
+            }
+          ]
+        }
+      },
+      "results": [
+        {
+          "ruleId": "SNYK-SWIFT-VAPORVAPOR-5950373",
+          "level": "warning",
+          "message": {
+            "text": "This file introduces a vulnerable github.com/vapor/vapor package with a medium severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "./Package.swift"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "github.com/vapor/vapor@4.83.2"
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-SWIFT-VAPORVAPOR-6143589",
+          "level": "warning",
+          "message": {
+            "text": "This file introduces a vulnerable github.com/vapor/vapor package with a medium severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "./Package.swift"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "github.com/vapor/vapor@4.83.2"
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}