Skip to content

Markdown table syntax regression in Sarif report #217

Description

@bm402

Hello 👋

The markdown syntax in the Sarif reports produced by docker scout cves --format sarif has broken since v1.19.0.

The summary table at the end of the CVE description (found in the report at runs.tool.driver.rules.help.markdown) is no longer a valid markdown table.

Example of table in report generated by v1.18.4:

|                |                                                                                  |
|----------------|----------------------------------------------------------------------------------|
| Package        | pkg:maven/ch.qos.logback/logback-core@1.5.32                                     |
| Affected range | <=1.5.32                                                                         |
| Fixed version  | 1.5.33                                                                           |
| CVSS Score     |                                                                              1.2 |
| CVSS Vector    | CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/RE:L/U:Green |

The same table in report generated by v1.19.0 onwards:

|                                                                                                                                                                 |
|Package                                                                                                            pkg:maven/ch.qos.logback/logback-core@1.5.32  |
|Affected range                                                                                                     <=1.5.32                                      |
|Fixed version                                                                                                      1.5.33                                        |
|[[CVSS Score 1.2] [CVSS Vector CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/RE:L/U:Green]]                                                |

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions