diff --git a/prowler/lib/outputs/sarif/sarif.py b/prowler/lib/outputs/sarif/sarif.py index d6eb207b2e..0ba2f16a8d 100644 --- a/prowler/lib/outputs/sarif/sarif.py +++ b/prowler/lib/outputs/sarif/sarif.py @@ -1,4 +1,5 @@ from json import dump +from typing import Optional from prowler.config.config import prowler_version from prowler.lib.logger import logger @@ -92,7 +93,7 @@ class SARIF(Output): } location = self._build_location(finding) - if location: + if location is not None: result["locations"] = [location] results.append(result) @@ -134,14 +135,17 @@ class SARIF(Output): ) @staticmethod - def _build_location(finding: Finding) -> dict: + def _build_location(finding: Finding) -> Optional[dict]: """Build a SARIF physicalLocation from a Finding. Uses resource_name as the artifact URI and resource_line_range (stored in finding.raw for IaC findings) for line range info. + + Returns: + A SARIF location dict, or None if resource_name is empty. """ if not finding.resource_name: - return {} + return None location = { "physicalLocation": { @@ -157,10 +161,11 @@ class SARIF(Output): try: start_line = int(parts[0]) end_line = int(parts[1]) - location["physicalLocation"]["region"] = { - "startLine": start_line, - "endLine": end_line, - } + if start_line >= 1 and end_line >= 1: + location["physicalLocation"]["region"] = { + "startLine": start_line, + "endLine": end_line, + } except (ValueError, IndexError): pass # Malformed line range — skip region, keep location diff --git a/tests/lib/outputs/sarif/sarif_test.py b/tests/lib/outputs/sarif/sarif_test.py index 8568af421d..368021df9e 100644 --- a/tests/lib/outputs/sarif/sarif_test.py +++ b/tests/lib/outputs/sarif/sarif_test.py @@ -288,6 +288,18 @@ class TestSARIF: ] assert "region" not in location + def test_location_with_zero_line_numbers(self): + finding = generate_finding_output( + status="FAIL", + resource_name="main.tf", + ) + finding.raw = {"resource_line_range": "0:0"} + sarif = SARIF(findings=[finding], file_path=None) + location = sarif.data[0]["runs"][0]["results"][0]["locations"][0][ + "physicalLocation" + ] + assert "region" not in location + def test_only_pass_findings(self): findings = [ generate_finding_output(status="PASS"),