Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[report-converter] Support sarif format and Gcc analyzer #4011

Merged
merged 1 commit into from
Oct 10, 2023

Conversation

Szelethus
Copy link
Collaborator

Fixes #1797. Based on a commit authored by @csordasmarton. Credit goes to him!

We've long wanted to support sarif
(https://sarifweb.azurewebsites.net/), and finally, this is the first real step towards it!

This patch can both parse and and export to sarif.

@Szelethus
Copy link
Collaborator Author

Szelethus commented Sep 21, 2023

Turns out we have an entry in the main README for all outputs, need to fix that.
Also here: docs/supported_code_analyzers.md

@Szelethus Szelethus changed the title [report-converter] Support sarif format [report-converter] Support sarif format and Gcc analyzer Oct 4, 2023
@Szelethus Szelethus requested a review from dkrupp as a code owner October 4, 2023 13:10
Copy link
Contributor

@bruntib bruntib left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you, please, try the following scenario:

  1. Create a .sarif file with gcc static analyzer.
  2. Use report-converter to convert this .sarif file to .plist
  3. Use CodeChecker parse <report folder> to list the reports based on the .plist.

This scenario doesn't work for me when I start from step 2 with double_free.cpp.sarif test file, because CodeChecker parse results this message:

[WARNING 2023-10-09 11:32] - The following source file contents changed or missing since the latest analysis:
 - /home/<user>/CodeChecker/codechecker/tools/report-converter/tests/unit/analyzers/gcc_output_test_files/<report_dir>/files/double_free.cpp
Please re-analyze your project to update the reports!

In the original .sarif file the /files/double_free.cpp is not under the <report_dir>.

@Szelethus Szelethus added the gcc 🐃 GNU GCC Static Analyzer label Oct 9, 2023
@Szelethus Szelethus force-pushed the sarif_support branch 2 times, most recently from d90eea6 to 1d56191 Compare October 10, 2023 12:58
Fixes Ericsson#1797. Based on a commit authored by @csordasmarton. Credit goes
to him!

We've long wanted to support sarif
(https://sarifweb.azurewebsites.net/), and finally, this is the first
real step towards it!

This patch can both parse and export to sarif.

My intent is that the code is self explanatory (because I explained
things in the code!), there are two things I'd like to highlight:

1. I strugged a LOT with mypy, which lead me to express a things things
   in a rather cumbersome manner. I left comments around these parts
2. I copied all example tests from https://github.com/microsoft/sarif-tutorials/
   to tools/report-converter/tests/unit/parser/sarif/sarif_test_files/.
   These examples come with an MIT licence, which I also copied over.

Co-authored-by: Kristóf Umann <dkszelethus@gmail.com>
@Szelethus
Copy link
Collaborator Author

This scenario doesn't work for me when I start from step 2 with double_free.cpp.sarif test file, because CodeChecker parse results this message:

[WARNING 2023-10-09 11:32] - The following source file contents changed or missing since the latest analysis:
 - /home/<user>/CodeChecker/codechecker/tools/report-converter/tests/unit/analyzers/gcc_output_test_files/<report_dir>/files/double_free.cpp
Please re-analyze your project to update the reports!

In the original .sarif file the /files/double_free.cpp is not under the <report_dir>.

The test file you tried this out in the tests/ directory was a bit manifactured, as I needed to remove absolute paths in order to satisfy the CI.

@bruntib bruntib merged commit 3a652ec into Ericsson:master Oct 10, 2023
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
gcc 🐃 GNU GCC Static Analyzer report-converter 🔄
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Support Static Analysis Results Interchange Format (SARIF) format?
3 participants