Convert-to-SARIF Mode

Overview

• Convert an existing SAST report to SARIF format

• Main usage is to help trim down a large SAST report (i.e. Fortify FPR) that contains the result of multiple repositories to a smaller SARIF report that is focused on a single repository.

• Uses the --code-path-patterns parameter to filter and perform the splitting of the report

Convert-to-SARIF Mode - Usage

To check what options are available under the convert-to-sarif mode, run:

npx @mobb.ai/cli@latest convert-to-sarif --help

Here is the output of the help file:

mobbdev convert-to-sarif

Convert an existing SAST report to SARIF format.

Options:
  --input-file-path     Original SAST report file path                                               [string] [required]
  --input-file-format   SAST report file type                                         [required] [choices: "FortifyFPR"]
  --output-file-path    Output SARIF report file path                                                [string] [required]
  --code-path-patterns  Glob-like patterns. Any code node with this pattern makes the issue be included.         [array]
  --help                Show help                                                                              [boolean]

Examples:
  npx mobbdev@latest convert-to-sarif --input-file-path         convert an existing SAST report to SARIF format
  /path/to/vuln-report.fpr --input-file-format FortifyFPR
  --output-file-path /path/to/vuln-report.sarif
  --code-path-patterns **/*.ts --code-path-patterns **/*.js

FortifyFPR is currently the only supported value for --input-file-format.

The output is SARIF 2.1.0. Each Fortify vulnerability becomes one SARIF result, and the code path nodes — including nodes referenced indirectly through the FPR's node pool — become that result's locations.

On success the command exits 0 and writes the output file, printing nothing. For the errors it can return, see Convert-to-SARIF errors.

Example

To convert a Fortify FPR report to SARIF, run the convert-to-sarif command. Example:

npx @mobb.ai/cli@latest convert-to-sarif \
  --input-file-path /path/to/vuln-report.fpr \
  --input-file-format FortifyFPR \
  --output-file-path /path/to/vuln-report.sarif \
  --code-path-patterns **/*.ts \
  --code-path-patterns **/*.js

Use case - Chaining with Analyze Mode

The idea is to chain this command together with npx @mobb.ai/cli@latest analyze to perform the fix analysis on the target repository. I.e.

npx @mobb.ai/cli@latest convert-to-sarif \
  --input-file-path fortify.fpr \
  --input-file-format FortifyFPR \
  --output-file-path projectABC-report.sarif \
  --code-path-patterns "projectABC/**"

npx @mobb.ai/cli@latest analyze \
  --scan-file projectABC-report.sarif \
  --repo https://github.com/mobb-dev/projectABC