report

package
v0.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 21, 2026 License: BSD-3-Clause Imports: 13 Imported by: 0

Documentation

Overview

Package report renders scan results as text, JSON or SARIF.

Index

Constants

View Source 
const (
	RuleRuntimeWeb     = "CVE-2026-109618/php-runtime-web"
	RuleRuntimeCLI     = "CVE-2026-109618/php-runtime-cli"
	RuleImage          = "CVE-2026-109618/php-image"
	RuleRuntimeUnknown = "php2shell/php-runtime-unknown"
	RuleImageUnknown   = "php2shell/php-image-unknown"
)

Rule IDs. Each starts with the first CVE so importers that take a CVE from the rule ID (DefectDojo does) record it; both CVEs are in every message and tag list. A runtime that serves web requests and an image reference rank critical, the CLI high, and an unknown verdict is informational: it asks for a check.

Variables

This section is empty.

Functions

func JSON 

func JSON(w io.Writer, r *Report) error

JSON writes the full report. Empty lists are written as [] rather than null.

func SARIF 

func SARIF(w io.Writer, r *Report) error

SARIF writes vulnerable and unknown results as SARIF 2.1.0, which DefectDojo and most code-scanning tools import.

func Text 

func Text(w io.Writer, r *Report, showFixed, showSkipped bool)

Text writes a human-readable report.

Types

type RefFinding 

type RefFinding struct {
	File      string        `json:"file"`
	Line      int           `json:"line"`
	Kind      string        `json:"kind"`
	Image     string        `json:"image"`
	Status    assess.Status `json:"status"`
	Severity  string        `json:"severity"`
	Reason    string        `json:"reason"`
	Platforms []string      `json:"platforms,omitempty"`
	Fix       string        `json:"fix,omitempty"`
}

RefFinding is the verdict for an image reference in source code (a Dockerfile FROM line, a Compose or Kubernetes image, a CI container).

type Report 

type Report struct {
	Tool    string   `json:"tool"`
	Version string   `json:"version"`
	CVEs    []string `json:"cves"`
	// DataSnapshot is when the distribution fix data was collected.
	DataSnapshot string    `json:"data_snapshot"`
	Targets      []*Target `json:"targets"`
}

Report is the whole run.

type Target 

type Target struct {
	Name     string               `json:"target"`
	Type     string               `json:"type"` // "filesystem", "image" or "repository"
	Digest   string               `json:"digest,omitempty"`
	Platform string               `json:"platform,omitempty"`
	Root     string               `json:"root,omitempty"` // SARIF paths are relative to it
	OS       *knowledge.OSRelease `json:"os,omitempty"`
	Files    int                  `json:"files_scanned"`
	Findings []assess.Finding     `json:"findings"`
	Refs     []RefFinding         `json:"references,omitempty"`
	// RefsChecked counts image references examined in a repository scan,
	// including those that are not PHP.
	RefsChecked int           `json:"references_checked,omitempty"`
	Skipped     []source.Skip `json:"skipped"`
	// Problems lists package databases that could not be read fully.
	Problems []string `json:"problems,omitempty"`
	// Incomplete says why the scan could not finish (a registry failed). The
	// results are shown but are not the whole picture, and the exit status is 2.
	Incomplete string `json:"incomplete,omitempty"`
	Error      string `json:"error,omitempty"`
}

Target is one scanned thing: a directory, an image or a source repository.

func (*Target) Count 

func (t *Target) Count(st assess.Status) int

Count returns how many findings and references have status st.

func (*Target) Gaps 

func (t *Target) Gaps() int

Gaps counts skipped items that are real coverage gaps, not deliberate exclusions.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.