Fix SARIF uri and add default value in README

Author: airadier

README.md

@@ -18,7 +18,7 @@ This action performs analysis on a specific container image and posts the result
 | `severity-at-least`          | Filtering option to only report vulnerabilities with at least the specified severity. Can take `critical`, `high`, `medium`, `low`, `negligible` or `any`. Default value "any" for no filtering. For example, if `severity-at-least` is set to `medium`, only Medium, High or Critical vulnerabilities will be reported. | `any`                     |
 | `package-types`              | Comma-separated list of package types to include in the report (e.g. `java,javascript`). Only vulnerabilities found in these types of packages will be included. If empty, no inclusion filter is applied.                                                                                                               |                           |
 | `not-package-types`          | Comma-separated list of package types to exclude from the report (e.g. `os`). Vulnerabilities found in these types of packages will be excluded. If empty, no exclusion filter is applied.                                                                                                                               |                           |
-| `exclude-accepted`           | Set to `true` to exclude vulnerabilities that have accepted risks (`acceptedRisks`). Useful to focus only on unresolved findings.                                                                                                                                                                                        |                           |
+| `exclude-accepted`           | Set to `true` to exclude vulnerabilities that have accepted risks (`acceptedRisks`). Useful to focus only on unresolved findings.                                                                                                                                                                                        | `false`                   |
 | `group-by-package`           | Enable grouping the vulnerabilities in the SARIF report by package. Useful if you want to manage security per package or condense the number of findings.                                                                                                                                                                |                           |
 | `standalone`                 | Enable standalone mode. Do not depend on Sysdig backend for execution, avoiding the need of specifying 'sysdig-secure-token' and 'sysdig-secure-url'. Recommended when using runners with no access to the internet. May require to specify custom `cli-scanner-url` and `db-path`.                                      |                           |
 | `db-path`                    | Specify the directory for the vulnerabilities database to use while scanning. Useful when running in standalone mode.                                                                                                                                                                                                    |                           |

dist/index.js

@@ -202,7 +202,7 @@ function vulnerabilities2SARIFResByPackage(data: Report): [SARIFRule[], SARIFRes
           {
             physicalLocation: {
               artifactLocation: {
-                uri: `file:///${data.result.metadata.pullString}`,
+                uri: `file:///${sanitizeImageName(data.result.metadata.pullString)}`,
                 uriBaseId: "ROOTPATH"
               }
             },
@@ -220,6 +220,12 @@ function vulnerabilities2SARIFResByPackage(data: Report): [SARIFRule[], SARIFRes
 }
 
 
+function sanitizeImageName(imageName: string) {
+  // Replace / and : with -
+  return imageName.replace(/[\/:]/g, '-');
+}
+
+
 function vulnerabilities2SARIFRes(data: Report): [SARIFRule[], SARIFResult[]] {
   let results: SARIFResult[] = [];
   let rules: SARIFRule[] = [];
@@ -275,7 +281,7 @@ function vulnerabilities2SARIFRes(data: Report): [SARIFRule[], SARIFResult[]] {
             {
               physicalLocation: {
                 artifactLocation: {
-                  uri: data.result.metadata.pullString,
+                  uri: `file:///${sanitizeImageName(data.result.metadata.pullString)}`,
                   uriBaseId: "ROOTPATH"
                 }
               },