Doesn't show info into burp suite

[Rsl7UZ]

This tool finds issues via semgrep, but doesn't show info what kind of issue was.

So i even don't know what semgrepper found

[Rsl7UZ]

That's logs:

[1509257597]:SemScan Stop
[1509257597]:SemScan Start
[1509257597]:SemScan Stop
[1509257597]:SemScan Start
               
               
┌─────────────┐
│ Scan Status │
└─────────────┘
  Scanning 1 file tracked by git with 200 Code rules:
                                                                                                                        
  Language      Rules   Files          Origin   Rules                                                                   
 ─────────────────────────────        ────────────────                                                                  
  js              187       1          Custom     200                                                                   
  ts              187       1                                                                                           
  <multilang>       1       1                                                                                           
  html              1       1                                                                                           
                                                                                                                        
{
  "$schema": "https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/blob/master/dist/sast-report-format.json",
  "scan": {
    "analyzer": {
      "id": "semgrep",
      "name": "Semgrep",
      "url": "https://semgrep.dev",
      "vendor": {
        "name": "Semgrep"
      },
      "version": "1.78.0"
    },
    "end_time": "2024-12-23T15:09:18",
    "scanner": {
      "id": "semgrep",
      "name": "Semgrep",
      "url": "https://semgrep.dev",
      "vendor": {
        "name": "Semgrep"
      },
      "version": "1.78.0"
    },
    "start_time": "2024-12-23T15:09:09",
    "status": "success",
    "type": "sast",
    "version": "1.78.0"
  },
  "version": "15.0.4",
  "vulnerabilities": []
}

[domwhewell-sage]

+1 for this, here are my logs from scanning https://ginandjuice.shop/

{
  "$schema": "https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/blob/master/dist/sast-report-format.json",
  "version": "15.0.4",
  "scan": {
    "start_time": "2025-02-03T12:34:57",
    "end_time": "2025-02-03T12:34:57",
    "analyzer": {
      "id": "semgrep",
      "name": "Semgrep",
      "url": "https://semgrep.dev",
      "version": "1.106.0",
      "vendor": {
        "name": "Semgrep"
      }
    },
    "scanner": {
      "id": "semgrep",
      "name": "Semgrep",
      "url": "https://semgrep.dev",
      "version": "1.106.0",
      "vendor": {
        "name": "Semgrep"
      }
    },
    "version": "1.106.0",
    "status": "success",
    "type": "sast"
  },
  "vulnerabilities": [
    {
      "id": "72bcac0e-9df0-29d7-e701-bef367baed55",
      "category": "secret_detection",
      "cve": "/mnt/c/Users/user/AppData/Local/Temp/SemgrepBurpPlugin/P1MVNWqrLEQd2ntCmsSc30TxDFTZIi17pK6DZb9I+do=:0e5b3c72bfb0dbf9c38ea0e09be3ed8dc4824330470c38b57ca46b2d5fe45343:mnt.c.dev.semgrep-rules.javascript.browser.security.insecure-document-method",
      "message": "User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities",
      "description": "User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities",
      "severity": "High",
      "scanner": {
        "id": "semgrep",
        "name": "Semgrep",
        "vendor": {
          "name": "Semgrep"
        }
      },
      "location": {
        "file": "/mnt/c/Users/userAppData/Local/Temp/SemgrepBurpPlugin/P1MVNWqrLEQd2ntCmsSc30TxDFTZIi17pK6DZb9I+do=",
        "start_line": 21,
        "end_line": 21
      },
      "identifiers": [
        {
          "type": "semgrep_type",
          "name": "Semgrep - mnt.c.dev.semgrep-rules.javascript.browser.security.insecure-document-method",
          "value": "mnt.c.dev.semgrep-rules.javascript.browser.security.insecure-document-method",
          "url": "not available"
        }
      ],
      "flags": [
        {
          "type": "flagged-as-likely-false-positive",
          "origin": "Semgrep",
          "description": "This finding is from a low confidence rule."
        }
      ],
      "details": {
        "confidence": {
          "type": "text",
          "name": "confidence",
          "value": "LOW"
        }
      },
      "raw_source_code_extract": [
        "            .then(res => document.getElementById(\"stockCheckResult\").innerHTML = res)\n"
      ],
      "commit": {
        "date": "1970-01-01T00:00:00Z",
        "sha": "0000000"
      }
    },
    {
      "id": "2a34f2b3-d74c-3fb9-ecdd-8c313e2362b2",
      "category": "secret_detection",
      "cve": "/mnt/c/Users/user/AppData/Local/Temp/SemgrepBurpPlugin/P1MVNWqrLEQd2ntCmsSc30TxDFTZIi17pK6DZb9I+do=:0e5b3c72bfb0dbf9c38ea0e09be3ed8dc4824330470c38b57ca46b2d5fe45343:mnt.c.dev.semgrep-rules.javascript.browser.security.insecure-innerhtml",
      "message": "User controlled data in a `document.getElementById(\"stockCheckResult\").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities",
      "description": "User controlled data in a `document.getElementById(\"stockCheckResult\").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities",
      "severity": "High",
      "scanner": {
        "id": "semgrep",
        "name": "Semgrep",
        "vendor": {
          "name": "Semgrep"
        }
      },
      "location": {
        "file": "/mnt/c/Users/user/AppData/Local/Temp/SemgrepBurpPlugin/P1MVNWqrLEQd2ntCmsSc30TxDFTZIi17pK6DZb9I+do=",
        "start_line": 21,
        "end_line": 21
      },
      "identifiers": [
        {
          "type": "semgrep_type",
          "name": "Semgrep - mnt.c.dev.semgrep-rules.javascript.browser.security.insecure-innerhtml",
          "value": "mnt.c.dev.semgrep-rules.javascript.browser.security.insecure-innerhtml",
          "url": "not available"
        }
      ],
      "flags": [
        {
          "type": "flagged-as-likely-false-positive",
          "origin": "Semgrep",
          "description": "This finding is from a low confidence rule."
        }
      ],
      "details": {
        "confidence": {
          "type": "text",
          "name": "confidence",
          "value": "LOW"
        }
      },
      "raw_source_code_extract": [
        "            .then(res => document.getElementById(\"stockCheckResult\").innerHTML = res)\n"
      ],
      "commit": {
        "date": "1970-01-01T00:00:00Z",
        "sha": "0000000"
      }
    }
  ]
}

And here are the extension errors

org.json.JSONException: Duplicate key "category" at 1870 [character 1871 line 1]
	at org.json.JSONTokener.syntaxError(JSONTokener.java:501)
	at org.json.JSONObject.<init>(JSONObject.java:242)
	at org.json.JSONTokener.nextValue(JSONTokener.java:418)
	at org.json.JSONArray.<init>(JSONArray.java:105)
	at org.json.JSONTokener.nextValue(JSONTokener.java:425)
	at org.json.JSONObject.<init>(JSONObject.java:245)
	at org.json.JSONObject.<init>(JSONObject.java:404)
	at burp.CustomScanIssue.getIssueDetail(CustomScanIssue.java:77)
	at burp.Zfks.detail(Unknown Source)
	at burp.Zipj.getIssueDetail(Unknown Source)
	at burp.Zomt.<init>(Unknown Source)
	at burp.Zqv7.run(Unknown Source)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:572)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
	at java.base/java.lang.Thread.run(Thread.java:1570)
org.json.JSONException: Duplicate key "category" at 2969 [character 2970 line 1]
	at org.json.JSONTokener.syntaxError(JSONTokener.java:501)
	at org.json.JSONObject.<init>(JSONObject.java:242)
	at org.json.JSONTokener.nextValue(JSONTokener.java:418)
	at org.json.JSONArray.<init>(JSONArray.java:105)
	at org.json.JSONTokener.nextValue(JSONTokener.java:425)
	at org.json.JSONObject.<init>(JSONObject.java:245)
	at org.json.JSONObject.<init>(JSONObject.java:404)
	at burp.CustomScanIssue.getIssueDetail(CustomScanIssue.java:77)
	at burp.Zfks.detail(Unknown Source)
	at burp.Zipj.getIssueDetail(Unknown Source)
	at burp.Zomt.<init>(Unknown Source)
	at burp.Zqv7.run(Unknown Source)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:572)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
	at java.base/java.lang.Thread.run(Thread.java:1570)

[goliwok]

Issue is not directly causes by burp extension. If you run the same command with semgrep in cli, you will see two categories (--gitlab-secrets always add "category": "sast") which cause extension crash:

semgrep  --config  ./rules/* ./semgrep-rules/javascript/node-crypto/security/create-de-cipher-no-iv.js --gitlab-secrets

...
    "vulnerabilities": [
        {
            "category": "secret_detection",
            "category": "sast",
            "commit": {
...

--gitlab-secrets output format can be replaced by --sarif to get similar results. Then, code in getIssueDetail should be adjusted to match json path.