Restriction preventing use of both --report-csv and --report-json

Hi,

I drafted the following a few days ago but at that time a problem with my account meant that I was unable to add as a comment to a previous issue. As this now covers two closed issues (references added) and has a separate request I hope this the an appropriate way to raise this.

Original example (#174, resolved in version 2.4.1)

In version 2.4.0 there is an output which explains what happened here: Command: log4j2-scan.exe --report-json --report-path out.json c:\ Output (v.2.4.0): Cannot write report file. File already exists: c:\out.json i.e. the CSV was written first and the JSON file couldn’t be created

Example 2 (#203, resolved in version 2.6.1)

I mention this because in version 2.4.0 --report-json --report-dir Reports creates both JSON and CSV (due to unique names): Command: log4j2-scan.exe --report-json --report-dir Reports C:\

Whereas, because --report-dir still implies --report-csv, version 2.4.1 advises: Output (v2.4.1): Error: Cannot use both --report-csv and --report-json options. Choose one.

Changing tack slightly… The reason for raising this issue…

Example 3 (this issue)

Whilst testing version 2.4.0 with the following command the output was beautiful, wonderful work! Command: log4j2-scan.exe --all-drives --scan-log4j1 --scan-logback --scan-zip --report-csv --report-json --no-empty-report >> %COMPUTERNAME%_log4j2_scan_report.txt

Testing again with version 2.4.1, the same error is presented: Output (v2.4.1): Error: Cannot use both --report-csv and --report-json options. Choose one.

Request

Would it be possible/appropriate to remove this check? https://github.com/logpresso/CVE-2021-44228-Scanner/blob/3d82e03432188085d73e43356cefa515a6cf4245/src/main/java/com/logpresso/scanner/Configuration.java#L323-L325

Because due to the other alterations [in version 2.4.1 and 2.6.1]:

• --report-json --report-path out.json would work as intended (#174)
• --report-path would still imply --report-csv if neither report type was specifically requested
• --report-dir would still imply --report-csv if neither report type was specifically requested

https://github.com/logpresso/CVE-2021-44228-Scanner/blob/3d82e03432188085d73e43356cefa515a6cf4245/src/main/java/com/logpresso/scanner/Configuration.java#L327-L332

This would allow us to continue to create both types of reports whilst we determine how we plan to consume the data.

Thank you for your time and consideration.

[sds83uk]

Thank you! This is now working as requested:

Create named report files

1. --report-path Test1.csv OUTPUT: created CSV (as --report-path “Implies --report-csv.”)

2. --report-path Test2.csv --report-csv OUTPUT: created CSV

3. --report-path Test3.csv --report-csv --report-json OUTPUT: Cannot use both --report-csv and --report-json options if --report-path is specified. Choose one.

4. --report-path Test4.json --report-json OUTPUT: created JSON

Note: Above tests fail if file already exists, i.e. “Error: File already exists - …\Test1.csv”

Create timestamped report files in specified output directory:

File name = log4j2_scan_report_yyyyMMdd_HHmmss

1. --report-dir OutputDir OUTPUT: created CSV (as --report-dir “Implies --report-csv.”)

2. --report-dir OutputDir --report-csv OUTPUT: created CSV

3. --report-dir OutputDir --report-csv --report-json OUTPUT: created CSV and JSON

4. --report-dir OutputDir --report-json OUTPUT: created JSON

5. --report-csv OUTPUT: created CSV

6. --report-json OUTPUT: created JSON

[xeraph]

@sds83uk Thank you for detail test report!