Failing exit code when vulns found

[bdw429s]

How do we feel about returning a non-zero exit code from the CLI process when at least one vuln is found? Then this could be used as part of an automated process which would fail when vulns were found without needing to parse the output text and depend on what wording displays. This could be done as the default behavior, or add a command line switch to enable it.

[rarkins]

Hi @bdw429s I think we could make this the default behavior. BTW were you interested in contributing this or any of your other ideas you've raised? Are you still using this for log4j hunting only or have you coopted it for another use?

[bdw429s]

Hi @rarkins , thanks for the reply. I'm not a Go developer so I'm not in a position to contribute. I'm a CFML dev (JVM language) who makes open source tools and there's been a lot of interest in Log4j vuln scanners-- especially since both major CF engines still used log4j 1.x when Log4Shell came out. I've played around with sevearl log4j vuln scanners and wrapped up your project inside a module of my own to make it a little easier for CF devs using CommandBox to use your scanner with a single OS-agnostic install.
https://www.forgebox.io/view/commandbox-log4j-detect

I tossed in a couple interesting features in my wrapper project above such as

• scan a list of paths
• scanning all drives
• and returning a failing exit code (based on words in the output)

I had a few ideas along the way and just thought I would pass them along to you in your ticket tracker in case you were still hacking on this. I know a few devs who will be using this for compliance scans for a while.