reference Flags

--sarif-output

Accepted by
opengrep scan, opengrep ci
Value
FILE
See also
--sarif, --output, --opengrep-ignore-pattern

Writes the SARIF document that --sarif prints to FILE, in addition to the output on standard output.

Unlike the other formats, the SARIF file includes the findings that a nosemgrep comment suppresses, each marked with a suppression of kind inSource. Standard output and the other output files leave them out.

The flag can be repeated to write several files. The file is written even when the scan finds nothing.

Examples

A suppressed finding in the SARIF file

rule.yaml
rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING
app.py
eval(1)  # nosemgrepeval(2)
Command and result
$ opengrep scan -q --config rule.yaml --sarif-output findings.sarif app.py
app.py

  warn  find-eval
  found eval

     2: eval(2)
$ jq . findings.sarif
{
  "version": "2.1.0",
  "runs": [
    {
      "invocations": [
        {
          "executionSuccessful": true,
          "toolExecutionNotifications": []
        }
      ],
      "results": [
        {
          "fingerprints": {
            "matchBasedId/v1": "cc2ee9ac3b87e874db7ede72562f586db0607e44a6ebc8879fc1772bd2699a2f302d90e0cf6bde9dce450cb0891646fb0b3d70263351681e1d2e48ca0d26d960_0"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "app.py",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "endColumn": 8,
                  "endLine": 1,
                  "snippet": {
                    "text": "eval(1)  # nosemgrep"
                  },
                  "startColumn": 1,
                  "startLine": 1
                }
              }
            }
          ],
          "message": {
            "text": "found eval"
          },
          "properties": {},
          "ruleId": "find-eval",
          "suppressions": [
            {
              "kind": "inSource"
            }
          ]
        },
        {
          "fingerprints": {
            "matchBasedId/v1": "cc2ee9ac3b87e874db7ede72562f586db0607e44a6ebc8879fc1772bd2699a2f302d90e0cf6bde9dce450cb0891646fb0b3d70263351681e1d2e48ca0d26d960_1"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "app.py",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "endColumn": 8,
                  "endLine": 2,
                  "snippet": {
                    "text": "eval(2)"
                  },
                  "startColumn": 1,
                  "startLine": 2
                }
              }
            }
          ],
          "message": {
            "text": "found eval"
          },
          "properties": {},
          "ruleId": "find-eval"
        }
      ],
      "tool": {
        "driver": {
          "name": "Opengrep",
          "rules": [
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "found eval"
              },
              "help": {
                "markdown": "found eval",
                "text": "found eval"
              },
              "id": "find-eval",
              "name": "find-eval",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Opengrep Finding: find-eval"
              }
            }
          ],
          "semanticVersion": "X.Y.Z"
        }
      }
    }
  ],
  "$schema": "https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/schemas/sarif-schema-2.1.0.json"
}

The text output shows only line 2. The SARIF file has both findings, and the one on line 1 carries a suppression of kind inSource.