reference Flags

--sarif

Accepted by
opengrep scan, opengrep ci
See also
--json, --output, --dataflow-traces, --gitlab-sast, --gitlab-secrets, --junit-xml, --sarif-output, metadata

Prints the findings as SARIF 2.1.0, the format read by GitHub code scanning and many other tools. The document has version, $schema and one entry in runs, which holds tool, with the rules and their metadata, results, with the findings and their locations and fingerprints, and invocations. The SARIF properties of a rule come from its metadata.

--dataflow-traces adds the path of the tainted data to each result, as a codeFlows entry.

--sarif-output writes the same document to a file, in addition to the output on standard output. Only one format can be printed to standard output.

Examples

The shape of the document

rule.yaml
rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING
app.py
eval(1)
Command and result
$ opengrep scan --config rule.yaml --sarif app.py 2>/dev/null | jq .
{
  "version": "2.1.0",
  "runs": [
    {
      "invocations": [
        {
          "executionSuccessful": true,
          "toolExecutionNotifications": []
        }
      ],
      "results": [
        {
          "fingerprints": {
            "matchBasedId/v1": "cc2ee9ac3b87e874db7ede72562f586db0607e44a6ebc8879fc1772bd2699a2f302d90e0cf6bde9dce450cb0891646fb0b3d70263351681e1d2e48ca0d26d960_0"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "app.py",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "endColumn": 8,
                  "endLine": 1,
                  "snippet": {
                    "text": "eval(1)"
                  },
                  "startColumn": 1,
                  "startLine": 1
                }
              }
            }
          ],
          "message": {
            "text": "found eval"
          },
          "properties": {},
          "ruleId": "find-eval"
        }
      ],
      "tool": {
        "driver": {
          "name": "Opengrep",
          "rules": [
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "found eval"
              },
              "help": {
                "markdown": "found eval",
                "text": "found eval"
              },
              "id": "find-eval",
              "name": "find-eval",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Opengrep Finding: find-eval"
              }
            }
          ],
          "semanticVersion": "X.Y.Z"
        }
      }
    }
  ],
  "$schema": "https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/schemas/sarif-schema-2.1.0.json"
}