Snyk Code (SAST)

snyk code test --sarif-file-output=snyk-code.sarif

{
  "$schema": "https://json.schemastore.org/sarif-2.1.0-rtm.4.json",
  "version": "2.1.0",
  "runs": [
    {
      "tool": { "driver": { "name": "SnykCode", "rules": [ /* rule definitions */ ] } },
      "results": [ /* findings */ ]
    }
  ]
}

{
  "id": "javascript/sqlInjection",
  "name": "SQL Injection",
  "shortDescription": { "text": "SQL Injection" },
  "fullDescription": { "text": "..." },
  "properties": {
    "tags": ["security", "CWE-89"],
    "categories": ["Injection"],
    "exampleCommitFixes": [ /* anonymised before/after diffs */ ]
  }
}

# Every finding flattened
jq '.runs[].results[] | {
      ruleId,
      level,
      file: .locations[0].physicalLocation.artifactLocation.uri,
      line: .locations[0].physicalLocation.region.startLine,
      message: .message.text
    }' snyk-code.sarif

# Group by rule for "what kinds of issue do we have?"
jq '[.runs[].results[].ruleId]
    | group_by(.)
    | map({rule: .[0], count: length})
    | sort_by(-.count)' snyk-code.sarif

# Filter to errors only
jq '.runs[].results[] | select(.level == "error")' snyk-code.sarif

# Trace the codeFlow for one finding — source → sink path
jq '.runs[].results[0].codeFlows[0].threadFlows[0].locations[]
    | {
        file: .location.physicalLocation.artifactLocation.uri,
        line: .location.physicalLocation.region.startLine,
        message: .location.message.text
      }' snyk-code.sarif

# Findings ordered by Snyk's internal priority score
jq '[.runs[].results[]
     | {ruleId, score: .properties.priorityScore, file: .locations[0].physicalLocation.artifactLocation.uri}]
    | sort_by(-.score)' snyk-code.sarif

# Stable fingerprints — track the same finding across commits
jq '.runs[].results[] | {
      fp: .fingerprints,
      ruleId,
      file: .locations[0].physicalLocation.artifactLocation.uri
    }' snyk-code.sarif

# 1. Get the ruleId for the most-fired rule (or read it off the report)
RULE=$(jq -r '[.runs[].results[].ruleId] | group_by(.) | sort_by(-length) | .[-1][0]' snyk-code.sarif)

# 2. Open the rule docs page in your browser
# security.snyk.io/rules/<lang>/<rule-id>  — e.g. security.snyk.io/rules/javascript/sqlInjection
echo "https://security.snyk.io/rules/${RULE}"

# 3. Read the codeFlow trace for an instance — find the source
jq --arg r "$RULE" '.runs[].results[]
    | select(.ruleId == $r)
    | .codeFlows[0].threadFlows[0].locations[0]
    | {file: .location.physicalLocation.artifactLocation.uri,
       line: .location.physicalLocation.region.startLine,
       source_msg: .location.message.text}' snyk-code.sarif

# 4. Assess: can an attacker reach the source? Is the input on the path controllable?

{
  "ruleId": "javascript/sqlInjection",
  "level": "error",
  "message": { "text": "Untrusted user input flows into a SQL query construction" },
  "locations": [{
    "physicalLocation": {
      "artifactLocation": { "uri": "src/api/search.js" },
      "region": { "startLine": 24 }
    }
  }],
  "codeFlows": [{
    "threadFlows": [{
      "locations": [
        {
          "location": {
            "physicalLocation": {
              "artifactLocation": { "uri": "src/api/search.js" },
              "region": { "startLine": 18 }
            },
            "message": { "text": "(req.query.q)" }
          }
        },
        {
          "location": {
            "physicalLocation": {
              "artifactLocation": { "uri": "src/api/search.js" },
              "region": { "startLine": 24 }
            },
            "message": { "text": "db.query(`SELECT * FROM users WHERE name LIKE '%${q}%'`)" }
          }
        }
      ]
    }]
  }],
  "properties": { "priorityScore": 850 }
}

// src/api/search.js
app.get('/api/search', (req, res) => {
  const q = req.query.q;
  db.query(`SELECT * FROM users WHERE name LIKE '%${q}%'`, (err, rows) => {
    res.json(rows);
  });
});

app.get('/api/search', (req, res) => {
  const q = req.query.q;
  db.query(
    "SELECT * FROM users WHERE name LIKE ?",
    [`%${q}%`],
    (err, rows) => res.json(rows)
  );
});