feat: adding sarif file extension validation support #217
Conversation
kehoecj
added
OSS Community Contribution
| return false, errors.New("error - schema isn't a string") | ||
| } | ||
|
|
||
| loadedSchema := gojsonschema.NewReferenceLoader(schemaURL.(string)) |
There was a problem hiding this comment.
This will fail in airgapped environments or corporate networks without a proxy. I think we need a separate error if it can't download the schema from the URL. The current error is error: error - schema isn't valid: https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/sarif-schema-2.1.0.json which is confusing
There was a problem hiding this comment.
That's a great point.
What do you think if we add an additional function that will verify that the schema's hostname is resolvable and try to establish a TCP connection prior to loading it?
If it's not resolvable or the connection can't be established, we might return with an error that indicates that schema couldn't be loaded.
There was a problem hiding this comment.
What do you think if we add an additional function that will verify that the schema's hostname is resolvable and try to establish a TCP connection prior to loading it? If it's not resolvable or the connection can't be established, we might return with an error that indicates that schema couldn't be loaded.
I like that approach
kehoecj
added
pr-action-requested
There was a problem hiding this comment.
@arthurflame Looks good! Please take care of the golint-ci findings and resolve conflicts from the dependency changes in main
As discussed in this PR #183:
schemais specifiedContent of .sarif files was taken from these samples.