Templates for grype output. HTML template #724

myrkytyn · 2022-04-13T15:59:59Z

Hi! Does someone have templates for grype? I need to scan my images to human-readable format HTML.

I think will be great if we can have a directory with templates for grype project.

freedom-isnotanarchy · 2022-04-13T18:06:30Z

(1) ((directory with templates)): Yes, great idea !
(2) Here is 1 grype template that I use:
"0-FILE:"#"PACKAGE:"#"VULNERABILITY:"#"SEVERITY:"#"Is Fixed:"#"Version Found:"#"Version Fixed:"#"Type:"#"Namespace:"#"Package URL:"#"Vulnerability Source:"#"Description:"#"URLS:" {{- range .Matches}} "__FILENAME__"#"{{.Artifact.Name}}"#"{{.Vulnerability.ID}}"#"{{.Vulnerability.Severity}}"#"{{.Vulnerability.Fix.State}}"#"'{{.Artifact.Version}}"#"{{.Vulnerability.Fix.Versions}}"#"{{.Artifact.Type}}"#"{{.Vulnerability.Namespace}}"#"{{.Artifact.PURL}}"#"{{.Vulnerability.DataSource}}"#"{{.Vulnerability.Description}}"#"{{.Vulnerability.URLs}}" {{- end}}

samcro1967 · 2022-04-16T20:14:40Z

Is the correct usage to redirect the output to an html file for viewing in a browser in a human readable format? It generates the html files with the output, but it is not formatted in any way. Guessing I a not doing this correctly or am missing something.

grype -c grype.yaml -o template -t custom.template --scope all-layers --only-fixed sbom:./sboms/$CONTAINER.json > ./results/${TIMESTAMP}_$CONTAINER.html

adriens · 2022-04-16T21:34:22Z

Sorry for asking here, but it's also template related.

Is there any markdown ready to use template ?... I'd like to psot-process it with pandoc to build a ready to use automated documentation toolchain... human redable.

BTW : that would fix the html generation.

ida-greuelr · 2022-05-27T12:16:54Z

Inspired from the html output of https://sourceforge.net/projects/command-output-to-html-table/ I created a simple html table template. Works fine for me, is human readable and interactive:

<!DOCTYPE html>
<html>

<head>
  <meta name="viewport" content="width=device-width, initial-scale=1" charset="ISO-8859-1">
  <title>Grype</title>
  <script>
    function myFunction() {
      // Declare variables 
      var input, filter, table, tr, td, i;
      input = document.getElementById("myInput");
      filter = input.value.toUpperCase();
      table = document.getElementById("myTable");
      tr = table.getElementsByTagName("tr");

      // Loop through all table rows, and hide those who do not match the search query
      for (i = 1; i < tr.length; i++) {
        td = tr[i].getElementsByTagName("td");
        for (j = 0; j < td.length; j++) {
          var tdata = td[j];
          if (tdata) {
            if (tdata.innerHTML.toUpperCase().indexOf(filter) > -1) {
              tr[i].style.display = "";
              break;
            } else {
              tr[i].style.display = "none";
            }
          }
        }
      }
    }
  </script>

  <style type="text/css">
    table,
    th,
    td {
      border: 1px solid black; // changing-colors
      // word-wrap: break-word;
    }

    tr:first-child {
      font-weight: bold;
    }

    tr:nth-child(even) {
      background: #eef
    }

    // changing-colors
    tr:nth-child(odd) {
      background: #fee
    }

    // changing-colors

    * {
      box-sizing: border-box;
    }

    #myInput {
      background-image: url("search.png");
      background-position: left center;
      background-repeat: no-repeat;
      width: 94%;
      font-size: 16px;
      padding: 8px 20px 8px 40px;
      border: 2px solid Tomato; // changing-colors
      margin-bottom: 18px;
    }

    #myTable {
      border-collapse: collapse;
      border: 1px solid #ddd; // changing-colors
      width: 100%;
      margin-top: 18px;
      // Remove the // in front of the below two lines, to get fixed-width
      // table-layout: fixed;
      // word-wrap: break-word;
      // font-size: 18px;
    }

    #myTable th,
    #myTable td {
      text-align: left;
      padding: 12px;
    }

    #myTable tr {
      border-bottom: 1px solid #ddd; // changing-colors
    }

    #myTable tr:first-child:hover,
    #myTable tr:hover {
      background-color: rgb(4, 112, 155); // changing-colors
    }

    #myTable tr:first-child {
      background-color: rgb(4, 112, 155); // changing-colors
      font-weight: bold;
    }
  </style>
</head>

<body>
  <h2 style="text-align:center;background-color:DodgerBlue;color:White;">Identified Vulnerabilites</h2>
  <input type="text" id="myInput" onkeyup="myFunction()" placeholder="Search in all Fields...."
    title="Type in a Search String" autofocus="autofocus">
  <table id="myTable">
    <tr>
      <th>NAME</th>
      <th>INSTALLED</th>
      <th>TYPE</th>
      <th>VULNERABILITY</th>
      <th>SEVERITY</th>
      <th>DESCRIPTION</th>
      <th>STATE</th>
      <th>FIXED IN</th>
    </tr>
{{- range .Matches}}
    <tr>
      <td>"{{.Artifact.Name}}"</td>
      <td>"{{.Artifact.Version}}"</td>
      <td>"{{.Artifact.Type}}"</td>
      <td>"{{.Vulnerability.ID}}"</td>
      <td>"{{.Vulnerability.Severity}}"</td>
      <td>"{{.Vulnerability.Description}}"</td>
      <td>"{{.Vulnerability.Fix.State}}"</td>
      <td>"{{.Vulnerability.Fix.Versions}}"</td>
    </tr>
{{- end}}
  </table>
</body>

</html>

Copy/paste into a file like html.tmpl and run for example:

grype docker:ubuntu:focal -o template -t html.tmpl > grype.html

Praise the sourceforge project for its html layout 🥇 !

spiffcs · 2022-06-01T13:22:03Z

@ida-greuelr this is awesome!

spiffcs · 2022-07-08T19:20:54Z

Closing this issue with the template provided if anyone else objects or has related pr to file under issue just tag me and we can sort it

spiffcs · 2022-07-08T19:20:55Z

Closing this issue with the template provided if anyone else objects or has related pr to file under issue just tag me and we can sort it

adriens · 2022-07-13T03:38:59Z

Hi, can I access the name to the input scanned object (docker image, file, directory,...) through a variable from within the template ❔ That would be very usefiul.

Should I create a dedicated issue ?

adriens · 2022-07-13T11:40:18Z

Forget my previous question cf documentation :

Grype's template processing uses the same data models as the json output format — so if you're wondering what data is available as you author a template, you can use the output from grype -o json as a reference.

adriens · 2022-07-18T23:25:03Z

@ida-greuelr , to put the template in security and start some mode devs on templates, I created this https://dev.to/optnc/grype-0420-is-out-and-hello-grype-contribs-3g4i

We'll work on imprving templates and some other stuffs.

rtarquini · 2023-02-24T14:31:16Z

I'm having trouble understanding how the json names map back to the template. I was trying to extract the artifact path using .Artifact.Locations.Path, but that throws the error below

ERROR unable to show grype-vulnerability-scanning-finished event: unable to show vulnerability report: unable to execute supplied template: template: html.tmpl:131:22: executing "html.tmpl" at <.Artifact.Locations.Path>: can't evaluate field Path in type []source.Coordinates

kzantow · 2023-02-24T16:08:27Z

@rtarquini .Artifact.Locations is a slice (list/array), so you'll need to use a loop construct, I think it would be something like:

{{- range .Artifact.Locations}}
  {{.Path}}
{{- end}}

mike-19 · 2023-03-15T09:15:54Z

@kzantow {{.Path}} will not work and will result in the same error; this is primarily due to improper definitions in the data model referenced here in #963

This should work

{{- range .Artifact.Locations}}
  {{(index .Artifact.Locations 0).Path}}
{{- end}}

kzantow · 2023-03-15T13:35:05Z

@mike-19 ah, I forgot about that RealPath detail. But note you would only want to use {{(index .Artifact.Locations 0).Path}} if you are just getting the first element, the {{- range... stuff is for iterating over each element. So if you just want the first element, you can use: {{(index .Artifact.Locations 0).RealPath}} if you want all locations, you can use {{- range $i, $e := .Artifact.Locations}}{{- if $i}}, {{- end}}{{$e.RealPath}}{{- end}} I tested both of these out and they do work.

OnceUponALoop · 2024-04-15T23:30:17Z

I created a new fancy html template with some filtering using datatables.js. It's available as a gist here

spiffcs · 2024-04-16T15:13:32Z

Wow thanks for the PR @OnceUponALoop! Let me give this a look and we'll include it under our template folder. This is excellent!

myrkytyn added the enhancement New feature or request label Apr 13, 2022

spiffcs closed this as completed Jul 8, 2022

adriens mentioned this issue Jul 13, 2022

📊 grype output > add dedicated section that tells on what the analysis was run #826

Closed

TonyLovesDevOps mentioned this issue Jan 8, 2024

Add information on using template output to config file example. TonyLovesDevOps/grype#1

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Templates for grype output. HTML template #724

Templates for grype output. HTML template #724

myrkytyn commented Apr 13, 2022

freedom-isnotanarchy commented Apr 13, 2022

samcro1967 commented Apr 16, 2022

adriens commented Apr 16, 2022

ida-greuelr commented May 27, 2022

spiffcs commented Jun 1, 2022

spiffcs commented Jul 8, 2022

spiffcs commented Jul 8, 2022

adriens commented Jul 13, 2022

adriens commented Jul 13, 2022 •

edited

Loading

adriens commented Jul 18, 2022

rtarquini commented Feb 24, 2023

kzantow commented Feb 24, 2023

mike-19 commented Mar 15, 2023 •

edited

Loading

kzantow commented Mar 15, 2023 •

edited

Loading

OnceUponALoop commented Apr 15, 2024

spiffcs commented Apr 16, 2024

Templates for grype output. HTML template #724

Templates for grype output. HTML template #724

Comments

myrkytyn commented Apr 13, 2022

freedom-isnotanarchy commented Apr 13, 2022

samcro1967 commented Apr 16, 2022

adriens commented Apr 16, 2022

ida-greuelr commented May 27, 2022

spiffcs commented Jun 1, 2022

spiffcs commented Jul 8, 2022

spiffcs commented Jul 8, 2022

adriens commented Jul 13, 2022

adriens commented Jul 13, 2022 • edited Loading

adriens commented Jul 18, 2022

rtarquini commented Feb 24, 2023

kzantow commented Feb 24, 2023

mike-19 commented Mar 15, 2023 • edited Loading

kzantow commented Mar 15, 2023 • edited Loading

OnceUponALoop commented Apr 15, 2024

spiffcs commented Apr 16, 2024

adriens commented Jul 13, 2022 •

edited

Loading

mike-19 commented Mar 15, 2023 •

edited

Loading

kzantow commented Mar 15, 2023 •

edited

Loading