Failed to parse input fileresults.json

[MatinaStamelakiTR]

Hi,
When using the Veracode plugin in Github, veracode/veracode-pipeline-scan-results-to-sarif is failing with the error "Failed to parse input fileresults.json" when applied to python project, (no issue for node projects). I found out that for python projects the generated results.json file doesn't contain flaw_match in findings, while for node projects there is flaw_match in findings. bou.ts file that is handling results.json is not taking into account that flaw_match may not be there. Are there any plans for a fix?

[githubrlloyd]

Thanks for the feedback. It looks like the flaw matching in our pipeline scan service doesn't have the hash values for Python, causing this error. We're looking at this and hope to have an update to the pipeline scan service that will address this issue. Will close this issue as soon as we've resolved it.

Hi @githubrlloyd is there any update to this issue? I've tried to integrate this action with my Python project and facing the same issue. I also tried to use the master version instead of any particular tag and still facing the same.

[brendanlafond]

Hi all - This isn't a Python related problem. This is happening with 0.1.6 version only. Looks like a flaw in the latest code adding the word "file" prefixing pipeline-results variable. It's happening for my PHP project too, which works with 0.1.5. Interesting note is that it worked without the finding-rule-level variable the first time I ran it.

Working Code:
uses: veracode/veracode-pipeline-scan-results-to-sarif@v0.1.5
with:
pipeline-results-json: results.json
finding-rule-level: "4:3:1"

Failing Code:
uses: veracode/veracode-pipeline-scan-results-to-sarif@v0.1.6
with:
pipeline-results-json: results.json
finding-rule-level: "4:3:1"

Error: Failed to parse input fileresults.json

[gs-scooter]

I am experiencing this exact issue on the latest version (1.0.5). I'm really stunned that this has not been addressed in over a year and a half. Do we need to downgrade to 0.1.5? Please advise.

[AngelRicardezWGU]

I'm having this issue with 1.0.5, what happen if i downgrade to 0.1.5? how many new updates i will be loosing? haha, are you planning to do something about this?

[mangesh-sadashiv-yadav-db]

Can confirm that we are still having the issue .is this already resolved or downgrade is the only option?

[wesco-prathapmotupalli]

Only for Python code, veracode/veracode-pipeline-scan-results-to-sarif@v0.1.6 and above are still failing to parse input file results.json
we are not able to upgrade veracode-pipeline-scan-results-to-sarif from 0.1.5 to 1.0.6. Kindly fix this issue

[brendanlafond]

There's a fix for this action to counter the missing flaw_match in v1.0.7.

[nwimber-wgu]

As of v2.0.4, this issue has reappeared, though I'm not sure if it's because of the missing flaw_match or some new problem that has similar symptoms. 1.0.9 appears to be the last working version from my testing, so possibly the fix in 1.0.7 was accidentally reverted post 2.0.0?

[wescoPete]

we are also having this issue again in v2.0.4. 2.0.3 works fine

[ZachEndWesco]

Hi looks like this issue is still present in 2.0.5, to me it looks like a 'no results' sarrif isn't generated properly when there are no issues found leading to upload errors. I got around this by adding a check to see if the json results were an empty array and if so generating the no results serif myself.

[ZachEndWesco]

in converter.ts is there a reason you just return nothing like this? am I understanding something wrong by thinking this should return a no result sarrif log? I think this is leading to a bug where if the scan was successful and there is 0 results found it sets as undefined causing the json parsing to fail and thus the sarrif upload fails. If this is not the intended behavior id be happy to make a pr to improve the error handling here