Sarif support

[gastonstrizzolo]

Hi, thanks for your amazing tool!
I was trying to add support for a sarif format. I am aware of the existence of #1797, but it looks stopped.
I forked and my idea was: from a known analyzer's parser (eslint) I adapted the parser to read .sarif files and generated a proper List of Reports. It works. It works in the UI too. (Maybe the big disagreement with the already reported issue is that here, the .sarif files are converted to plist files, and use the support that is already implemented for plist files)
As obvious, it should add things and not broke things, so I thought that add a tool as Semgrep (https://semgrep.dev/) with a sarif output format is a good idea. But I don't know where I have to add code so that report-converter recognizes a new tool as Semgrep
I have been reading the code, but I got lost trying to figure out where a new "Analyzer" should be added, would you help me?

[csordasmarton]

@gastonstrizzolo The code has already been prepared to this in #3462.

For sarif support what you need to do is to create a separate file (sarif.py) here: https://github.com/Ericsson/codechecker/tree/master/tools/report-converter/codechecker_report_converter/report/parser. You can check how the plist parser is implemented as an example.

After you are ready you have to make some changes in this file to register the sarif parser: https://github.com/Ericsson/codechecker/blob/master/tools/report-converter/codechecker_report_converter/report/report_file.py

A couple of months ago I started to do it but unfortunately I didn't have enough time to fully implement it. But you can see and re-use my changes from here: csordasmarton@4410e62

[dgutson]

Hi @csordasmarton , what @gastonstrizzolo did before was to add an analyzer that reads a sarif file and fills the report fields (as if it was a plist), and worked. What would the advantage be of adding a new parser and report? He based it on the ESLint analyzer which already processes a json file. Thanks.

[csordasmarton]

@dgutson There are multiple CodeChecker commands such as CodeChecker analyze, CodeChecker parse, CodeChecker cmd diff, CodeChecker store, CodeChecker server, report-converter which use the available parsers from the report_file module to read and write analyzer result files. Now it supports only plist format but this is the place where you have to introduce a new parser for sarif format. This way all the previously mentioned commands will be able to read/write analyzer result files in sarif or any other supported formats.

Also we have the report-converter tool which is able to convert static analyzer results to codechecker format (actually plist format). So if you want to support a new analyzer and to be able to parse/store the results this is the place where you have to introduce it.

[csordasmarton]

@gastonstrizzolo Unfortunately I have no longer working on this project, but @bruntib can help you if you have any problem. I paste your message written in email here so anyone can read it:

I have been having some issues trying to add support for a sarif format, and I will really appreciate some advice
I created and I have follow the guide from the sarif.py you provided me,
https://github.com/gastonstrizzolo/codechecker/blob/feature/sarif_support/tools/report-converter/codechecker_report_converter/report/parser/sarif.py
https://github.com/gastonstrizzolo/codechecker/blob/feature/sarif_support/tools/report-converter/codechecker_report_converter/report/report_file.py
The strange thing is the tool report-converter looks like throws appropriate output (.sarif files), but when I try to push them into the server to see them in the UI web, the logs told me that everything is OK, but the run in the UI web that was uploaded is empty
When I try to upload with "Codechecker store my_results ... --verbose debug", this it the end of the log

----=================----
[INFO][2022-04-25 19:46:11] {system} [63064] <140257264784000> - store.py:577 assemble_zip() - Compressing report zip file...
[INFO][2022-04-25 19:46:11] {system} [63064] <140257264784000> - store.py:586 assemble_zip() - Compressing report zip file done (71.2KiB / 9.0KiB).
[INFO][2022-04-25 19:46:11] {system} [63064] <140257264784000> - store.py:795 main() - Storing results to the server...
[INFO][2022-04-25 19:46:11] {system} [63064] <140257264784000> - store.py:809 main() - Storage finished successfully.

And the findings are printed in stdout, also "Codechecker parse my_results" works well, but at the time I have to upload to the server, something is broken and I don't know where
I have the server running with docker swarm, and this is some of the logs ('test' is the name of the product):

cc_codechecker.2.j0pu62bf29zv@my_pc    | [INFO 2022-04-25 22:46] - [::ffff:10.0.1.4]:38564 -- [Anonymous] POST /test/v6.47/CodeCheckerService@massStoreRun
cc_codechecker.2.j0pu62bf29zv@my_pc    | [INFO 2022-04-25 22:46] - [my_results] Unzip storage file...
cc_codechecker.2.j0pu62bf29zv@my_pc    | [INFO 2022-04-25 22:46] - [my_results] Unzip storage file done... (duration: 0.01 sec)
cc_codechecker.2.j0pu62bf29zv@my_pc    | [INFO 2022-04-25 22:46] - [my_results] Store source files...
cc_codechecker.2.j0pu62bf29zv@my_pc    | [INFO 2022-04-25 22:46] - [my_results] Storing 6 source file(s).
cc_codechecker.2.j0pu62bf29zv@my_pc    | [INFO 2022-04-25 22:46] - [my_results] Store source files done... (duration: 0.03 sec)
cc_codechecker.2.j0pu62bf29zv@my_pc    | [INFO 2022-04-25 22:46] - [my_results] Store reports...
cc_codechecker.2.j0pu62bf29zv@my_pc    | [INFO 2022-04-25 22:46] - [my_results] Processed 0 analyzer result file(s).
cc_codechecker.2.j0pu62bf29zv@my_pc    | [INFO 2022-04-25 22:46] - [my_results] Store reports done... (duration: 0.0 sec)
cc_codechecker.2.j0pu62bf29zv@my_pc    | [INFO 2022-04-25 22:46] - 'Anonymous' stored results (71 KB /decompressed/) to run 'my_results' (id: 23) in 0.07 seconds.
cc_codechecker.1.g1m5tbjukbra@my_pc    | [INFO 2022-04-25 22:46] - [::ffff:10.0.1.4]:38566 -- [Anonymous] POST 
/test/v6.47/CodeCheckerService@allowsStoringAnalysisStatistics

Those logs look similar to those of some tool (for example Pylint) that was already integrated

By the way I checked your branch and tried it out now. For me from the logs it looks like the CodeChecker client (CodeChecker store) command sends the analyzer result files to the server:

In my report directory there are two sarif report files:

If you run the CodeChecker server command with the --verbose debug option you will also see that the server gets these sarif files and tries to process it:

[DEBUG][2022-04-27 10:37:19] {server} [12523] <140040906127168> - mass_store_run.py:971 __store_reports() - Parsing input file 'lib.cpp_clang-tidy_ad737a0b989aae5fdb5f093b5658f677.sarif'

Maybe the problem is that the docker image you are using to run the server is not built from your branch/commits. Please try to run the server with the --verbose debug option and make sure you are using the correct docker image. You can also verify it if you run the following command in the docker container: CodeChecker version. The output will contain the Git commit ID (hash).

Also let's continue the discussion here if you need any help and @bruntib will help you.