Sarif json is not escaping \n on results.message.text

[DmitriyLewen]

Discussed in #5559

^{Originally posted by pragmaticivan November 13, 2023}

Description

Sarif format is not correctly escaping. It's using \n instead of \\n. This is breaking decoders such as json.NewDecoder(reader).Decode(sarifStruct).

{
          "ruleId": "DS002",
          "ruleIndex": 0,
          "level": "error",
          "message": {
            "text": "Artifact: Dev.dockerfile\nType: dockerfile\nVulnerability DS002\nSeverity: HIGH\nMessage: Specify at least 1 USER command in Dockerfile with non-root user as argument\nLink: [DS002](https://avd.aquasec.com/misconfig/ds002)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "Dev.dockerfile",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "message": {
                "text": "Dev.dockerfile"
              }
            }
          ]
        },

Desired Behavior

{
          "ruleId": "DS002",
          "ruleIndex": 0,
          "level": "error",
          "message": {
            "text": "Artifact: Dev.dockerfile\\nType: dockerfile\\nVulnerability DS002\\nSeverity: HIGH\nMessage: Specify at least 1 USER command in Dockerfile with non-root user as argument\\nLink: [DS002](https://avd.aquasec.com/misconfig/ds002)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "Dev.dockerfile",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "message": {
                "text": "Dev.dockerfile"
              }
            }
          ]
        },

It should be escaping with \\n instead.

Actual Behavior

Adds \n in the json string value.

Reproduction Steps

1. generate a sarif file with example above.
2. Decode with json decoder (go)
3. Error: `parse error: invalid character '\n' in string literal`
...

Target

Filesystem

Scanner

Misconfiguration

Output Format

SARIF

Mode

Standalone

Debug Output

There's no error on trivy side, only when parsing the SARIF json.

Operating System

Github Action (Ubuntu)

Version

0.14.0

Checklist

• Run trivy image --reset
• Read the troubleshooting