Sarif output empty/non-existent

[tibbon]

Nuclei version:

3.1.10

Current Behavior:

No sarif file is output when I expect there to be one. This is happening locally on my Mac, and with GitHub Actions

Expected Behavior:

When I run nuclei with the -se nuclei.sarif flag, I expect a valid sarif file to be present at the end of the tests

Steps To Reproduce:

brew install nuclei
nuclei --version # 3.1.10
git clone [email protected]:projectdiscovery/nuclei.git
cd nuclei/integration_tests
nuclei -w workflow/basic.yaml -se nuclei.sarif

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v3.1.10

		projectdiscovery.io

[INF] Current nuclei version: v3.1.10 (latest)
[INF] Current nuclei-templates version: v9.7.6 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] Workflows loaded for current scan: 1
[WRN] Executing 2 unsigned templates. Use with caution.
[INF] No results found. Better luck next time!

ls -al # no nuclei.sarif file present

Other flags to output files like -me markdown_example or -je json_example appear to work properly and write a file with valid content. The -se nuclei.sarif does not appear to.

Anything else:

I've tried to read through the Golang code (not my strongest), dug around in issue trackers, checked in the GitHub action, and I can't seem to find anything. I'm wondering if there's something non-obvious about the type of examples that I'm running against, and their output?

[tibbon]

failOpen was kind enough to note in Discord that I didn't provide a target. With one however, I get similar results.

nuclei -w workflow/basic.yaml -se nuclei.sarif -target google.com

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v3.1.10

		projectdiscovery.io

[INF] Current nuclei version: v3.1.10 (latest)
[INF] Current nuclei-templates version: v9.7.6 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] Workflows loaded for current scan: 1
[WRN] Executing 2 unsigned templates. Use with caution.
[INF] Targets loaded for current scan: 1
[INF] Running httpx on input host
[INF] Found 1 URL from httpx
[INF] No results found. Better luck next time!

[olearycrew]

@tibbon I think that is because there are no results, as it says:

[INF] No results found. Better luck next time!

When there are results, there is a sarif file created:

[tibbon]

The problem that happens is if you're using the Nuclei GitHub Action, which generally does the upload-sarif step after running Nuclei, then that will error because there's no sarif file.

      - name: GitHub Security Dashboard Alerts update
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: nuclei.sarif

I've tried some tricks to try and get around that, such as skipping the step if there's no file, but that makes other things weird then, and in debug mode you see things like this:

ConfigurationError: Path does not exist: nuclei.sarif
    at run (/home/runner/work/_actions/github/codeql-action/v3/lib/upload-sarif-action.js:65:15)

I'm up for fixing the code (or documentation) myself, but I'm trying to figure out logically where that should happen in this stack of things.

[tibbon]

The way we're using Nuclei is to audit parts of our site, and if there are no problems, we don't expect there be any results. Ideally, there would be no results. When there are results, we get a ticket to go fix them.

[Mzack9999]

@tibbon Looks like there is a logic bug in the GH action as indeed if there is no sarif the step should just be ignored. I've create a GH issue at projectdiscovery/nuclei-action#85