Skip to content

Commit

Permalink
fix: SARIF parser: parse with no region result. fix originalOutput field
Browse files Browse the repository at this point in the history
  • Loading branch information
@irgaly
irgaly committed Jan 26, 2024
1 parent 48b25a0 commit 9bd6192
Show file tree
Hide file tree
Showing 2 changed files with 112 additions and 36 deletions.
48 changes: 22 additions & 26 deletions parser/sarif.go
View file
Expand Up @@ -2,7 +2,6 @@ package parser

import (
"encoding/json"
"fmt"
"io"
"net/url"
"os"
Expand Down Expand Up @@ -46,6 +45,10 @@ func (p *SarifParser) Parse(r io.Reader) ([]*rdf.Diagnostic, error) {
rules[rule.ID] = rule
}
for _, result := range run.Results {
original, err := json.Marshal(result)
if err != nil {
return nil, err

Check failure on line 50 in parser/sarif.go

View workflow job for this annotation

GitHub Actions / runner / golangci-lint 

[golangci] reported by reviewdog 馃惗
error returned from external package is unwrapped: sig: func encoding/json.Marshal(v any) ([]byte, error) (wrapcheck)

Raw Output:
parser/sarif.go:50:17: error returned from external package is unwrapped: sig: func encoding/json.Marshal(v any) ([]byte, error) (wrapcheck)
				return nil, err
				            ^
}

Check warning on line 51 in parser/sarif.go

View check run for this annotation

Codecov / codecov/patch

parser/sarif.go#L50-L51 

Added lines #L50 - L51 were not covered by tests
message := result.Message.GetText()
ruleID := result.RuleID
rule := rules[ruleID]
Expand Down Expand Up @@ -88,10 +91,6 @@ func (p *SarifParser) Parse(r io.Reader) ([]*rdf.Diagnostic, error) {
}
region := physicalLocation.Region
rng := region.GetRdfRange()
if rng == nil {
// No line information in result
continue
}
var code *rdf.Code
if ruleID != "" {
code = &rdf.Code{
Expand All @@ -110,12 +109,9 @@ func (p *SarifParser) Parse(r io.Reader) ([]*rdf.Diagnostic, error) {
Name: name,
Url: informationURI,
},
Code: code,
Suggestions: suggestionsMap[path],
OriginalOutput: fmt.Sprintf(
"%v:%d:%d: %v: %v (%v)",
path, rng.Start.Line, getActualStartColumn(rng), level, message, ruleID,
),
Code: code,
Suggestions: suggestionsMap[path],
OriginalOutput: string(original),
}
ds = append(ds, d)
}
Expand All @@ -132,27 +128,27 @@ type SarifJson struct {
Runs []struct {
OriginalURIBaseIds map[string]SarifOriginalURI `json:"originalUriBaseIds"`
Results []struct {
Level string `json:"level"`
Level string `json:"level,omitempty"`
Locations []struct {
PhysicalLocation struct {
ArtifactLocation SarifArtifactLocation `json:"artifactLocation"`
Region SarifRegion `json:"region"`
} `json:"physicalLocation"`
ArtifactLocation SarifArtifactLocation `json:"artifactLocation,omitempty"`
Region SarifRegion `json:"region,omitempty"`
} `json:"physicalLocation,omitempty"`
} `json:"locations"`
Message SarifText `json:"message"`
RuleID string `json:"ruleId"`
RuleID string `json:"ruleId,omitempty"`
Fixes []struct {
Description SarifText `json:"description"`
ArtifactChanges []struct {
ArtifactLocation SarifArtifactLocation `json:"artifactLocation"`
ArtifactLocation SarifArtifactLocation `json:"artifactLocation,omitempty"`
Replacements []struct {
DeletedRegion SarifRegion `json:"deletedRegion"`
InsertedContent struct {
Text string `json:"text"`
} `json:"insertedContent"`
} `json:"insertedContent,omitempty"`
} `json:"replacements"`
} `json:"artifactChanges"`
} `json:"fixes"`
} `json:"fixes,omitempty"`
} `json:"results"`
Tool struct {
Driver struct {
Expand All @@ -170,9 +166,9 @@ type SarifOriginalURI struct {
}

type SarifArtifactLocation struct {
URI string `json:"uri"`
URI string `json:"uri,omitempty"`
URIBaseID string `json:"uriBaseId"`
Index int `json:"index"`
Index int `json:"index,omitempty"`
}

func (l *SarifArtifactLocation) GetPath(
Expand All @@ -198,8 +194,8 @@ func (l *SarifArtifactLocation) GetPath(
}

type SarifText struct {
Text string `json:"text"`
Markdown *string `json:"markdown"`
Text string `json:"text,omitempty"`
Markdown *string `json:"markdown,omitempty"`
}

func (t *SarifText) GetText() string {
Expand All @@ -212,9 +208,9 @@ func (t *SarifText) GetText() string {

type SarifRegion struct {
StartLine *int `json:"startLine"`
StartColumn *int `json:"startColumn"`
EndLine *int `json:"endLine"`
EndColumn *int `json:"endColumn"`
StartColumn *int `json:"startColumn,omitempty"`
EndLine *int `json:"endLine,omitempty"`
EndColumn *int `json:"endColumn,omitempty"`
}

// convert SARIF Region to RDF Range
Expand Down
100 changes: 90 additions & 10 deletions parser/sarif_test.go
View file
Expand Up @@ -19,18 +19,22 @@ func TestExampleSarifParser(t *testing.T) {
if err != nil {
panic(err)
}
if len(diagnostics) == 0 {
t.Errorf("empty diagnostics")
}
for _, d := range diagnostics {
rdjson, _ := protojson.MarshalOptions{Indent: " "}.Marshal(d)
var actualJson interface{}
var expectJson interface{}
var actualJson map[string]interface{}

Check failure on line 27 in parser/sarif_test.go

View workflow job for this annotation

GitHub Actions / runner / golangci-lint 

[golangci] reported by reviewdog 馃惗
var `actualJson` should be `actualJSON` (golint)

Raw Output:
parser/sarif_test.go:27:8: var `actualJson` should be `actualJSON` (golint)
			var actualJson map[string]interface{}
			    ^

Check warning on line 27 in parser/sarif_test.go

View workflow job for this annotation

GitHub Actions / reviewdog (github-check) 

[golint-github-check] reported by reviewdog 馃惗
var actualJson should be actualJSON

Raw Output:
parser/sarif_test.go:27:8: var actualJson should be actualJSON

Check failure on line 27 in parser/sarif_test.go

View workflow job for this annotation

GitHub Actions / reviewdog on Pull Request 

[golint-pr-review] reported by reviewdog 馃惗
var actualJson should be actualJSON

Raw Output:
parser/sarif_test.go:27:8: var actualJson should be actualJSON

Check warning on line 27 in parser/sarif_test.go

View workflow job for this annotation

GitHub Actions / reviewdog on Pull Request 

[golint] reported by reviewdog 馃惗
var actualJson should be actualJSON

Raw Output:
/home/runner/work/reviewdog/reviewdog/parser/sarif_test.go:27:8: var actualJson should be actualJSON
var expectJson map[string]interface{}

Check failure on line 28 in parser/sarif_test.go

View workflow job for this annotation

GitHub Actions / runner / golangci-lint 

[golangci] reported by reviewdog 馃惗
var `expectJson` should be `expectJSON` (golint)

Raw Output:
parser/sarif_test.go:28:8: var `expectJson` should be `expectJSON` (golint)
			var expectJson map[string]interface{}
			    ^

Check warning on line 28 in parser/sarif_test.go

View workflow job for this annotation

GitHub Actions / reviewdog (github-check) 

[golint-github-check] reported by reviewdog 馃惗
var expectJson should be expectJSON

Raw Output:
parser/sarif_test.go:28:8: var expectJson should be expectJSON

Check failure on line 28 in parser/sarif_test.go

View workflow job for this annotation

GitHub Actions / reviewdog on Pull Request 

[golint-pr-review] reported by reviewdog 馃惗
var expectJson should be expectJSON

Raw Output:
parser/sarif_test.go:28:8: var expectJson should be expectJSON

Check warning on line 28 in parser/sarif_test.go

View workflow job for this annotation

GitHub Actions / reviewdog on Pull Request 

[golint] reported by reviewdog 馃惗
var expectJson should be expectJSON

Raw Output:
/home/runner/work/reviewdog/reviewdog/parser/sarif_test.go:28:8: var expectJson should be expectJSON
json.Unmarshal([]byte(rdjson), &actualJson)
json.Unmarshal([]byte(fixture[1]), &expectJson)
expectJson["originalOutput"] = actualJson["originalOutput"]
if !reflect.DeepEqual(actualJson, expectJson) {
var out bytes.Buffer
json.Indent(&out, rdjson, "", "\t")
actual := out.String()
expect := fixture[1]
t.Errorf("actual(%v):\n%v\n---\nexpect(%v):\n%v", i, actual, i, expect)
expect, _ := json.MarshalIndent(expectJson, "", "\t")

Check failure on line 36 in parser/sarif_test.go

View workflow job for this annotation

GitHub Actions / runner / golangci-lint 

[golangci] reported by reviewdog 馃惗
Error return value of `encoding/json.MarshalIndent` is not checked: unsafe type `interface{}` found (errchkjson)

Raw Output:
parser/sarif_test.go:36:18: Error return value of `encoding/json.MarshalIndent` is not checked: unsafe type `interface{}` found (errchkjson)
				expect, _ := json.MarshalIndent(expectJson, "", "\t")
				             ^
t.Errorf("actual(%v):\n%v\n---\nexpect(%v):\n%v", i, actual, i, string(expect))
}
}
}
Expand Down Expand Up @@ -121,8 +125,7 @@ var fixtures = [][]string{{
"code": {
"value": "rule_id",
"url": "https://example.com"
},
"originalOutput": "src/MyClass.kt:10:5: warning: result message (rule_id)"
}
}`},
{`{
"runs": [
Expand Down Expand Up @@ -184,8 +187,7 @@ var fixtures = [][]string{{
},
"code": {
"value": "rule_id"
},
"originalOutput": "src/MyClass.kt:10:1: error: message (rule_id)"
}
}`},
{`{
"runs": [
Expand Down Expand Up @@ -270,7 +272,85 @@ var fixtures = [][]string{{
},
"text": "// "
}
],
"originalOutput": "src/MyClass.kt:10:1: : message (rule_id)"
]
}`},
{fmt.Sprintf(`{
"runs": [
{
"originalUriBaseIds": {
"ROOTPATH": {
"uri": "%s"
}
},
"tool": {
"driver": {
"name": "Trivy",
"informationUri": "https://github.com/aquasecurity/trivy",
"fullName": "Trivy Vulnerability Scanner",
"version": "0.15.0",
"rules": [
{
"id": "CVE-2018-14618/curl",
"name": "OS Package Vulnerability (Alpine)",
"shortDescription": {
"text": "CVE-2018-14618 Package: curl"
},
"fullDescription": {
"text": "curl: NTLM password overflow via integer overflow."
},
"defaultConfiguration": {
"level": "error"
},
"helpUri": "https://avd.aquasec.com/nvd/cve-2018-14618",
"help": {
"text": "Vulnerability CVE-2018-14618\nSeverity: CRITICAL\n...",
"markdown": "**Vulnerability CVE-2018-14618**\n| Severity..."
},
"properties": {
"tags": [
"vulnerability",
"CRITICAL",
"curl"
],
"precision": "very-high"
}
}
]
}
},
"results": [
{
"ruleId": "CVE-2018-14618/curl",
"ruleIndex": 0,
"level": "error",
"message": {
"text": "curl before version 7.61.1 is..."
},
"locations": [{
"physicalLocation": {
"artifactLocation": {
"uri": "knqyf263/vuln-image (alpine 3.7.1)",
"uriBaseId": "ROOTPATH"
}
}
}]
}]
}
]
}
`, basedir()), `{
"message": "curl before version 7.61.1 is...",
"location": {
"path": "knqyf263/vuln-image (alpine 3.7.1)"
},
"severity": "ERROR",
"source": {
"name": "Trivy",
"url": "https://github.com/aquasecurity/trivy"
},
"code": {
"value": "CVE-2018-14618/curl",
"url": "https://avd.aquasec.com/nvd/cve-2018-14618"
}
}`},
}

0 comments on commit 9bd6192

Please sign in to comment.