Sarif - any way to parameterize the output file name?

[bwitonskiOT]

Opening issue on behalf of Nikola Aleksandrov [email protected] and ValueEdge ticket 11A1620012:

Hello team,

If we use the option "SSCToGitHub" the SARIF output is generated with the output file name as "gh-fortify-sast.sarif", this is fine and it is working as expected.

The Output file name is hard coded inside the file ".\config\SSCToGitHub.yml" like below:

...

sarif.output: ${export.dir}/gh-fortify-sast.sarif

...

Is there any way to parameterize the output file name?

The scenario will be like below:

PROJECTNAME="WebGoat"

Start loop for each VERSION in: "10, 20, 30, 40, 50"

Generate SARIF: java -jar FortifyVulnerabilityExporter.jar SSCToGitHub --ssc.baseUrl= --ssc.user= --ssc.password= --ssc.version.name="{PROJECTNAME}:${VERSION}"

Hint: the output file name should be generated with the name ${PROJECTNAME}_${VERSION}.sarif

End loop

After the loop, the below SARIF files should be created in the current folder.

WebGoat_10.sarif

WebGoat_20.sarif

WebGoat_30.sarif

WebGoat_40.sarif

WebGoat_50.sarif

is it possible?