writer-json-sarif: add tool to rule properties

kdudka · kdudka · commit bb1634e3da20 · 2023-10-17T15:27:11.000+02:00
... to ease SARIF import into Defect Dojo Resolves: https://issues.redhat.com/browse/OSH-355 Closes: #147
diff --git a/src/lib/writer-json-sarif.cc b/src/lib/writer-json-sarif.cc
@@ -28,6 +28,7 @@ using namespace boost::json;
 struct RuleProps {
     int                 cweId;
     std::string         scRuleId;
+    std::string         tool;
 };
 
 struct SarifTreeEncoder::Private {
@@ -164,6 +165,12 @@ void SarifTreeEncoder::Private::serializeRules()
         const bool haveScRule = !rp.scRuleId.empty();
         if (haveScRule)
             sarifEncodeShellCheckRule(&rule, rp.scRuleId);
+        else if (!rp.tool.empty()) {
+            // encode tool tag
+            array tags = { rp.tool };
+            object &props = rule["properties"].as_object();
+            props["tags"] = std::move(tags);
+        }
 
         if (rp.cweId)
             sarifEncodeCweRule(&rule, rp.cweId, /*append =*/ haveScRule);
@@ -316,6 +323,10 @@ void SarifTreeEncoder::appendDef(const Defect &def)
         result["properties"] = std::move(cweProp);
     }
 
+    if (!def.tool.empty())
+        // update tool for this rule
+        d->ruleMap[ruleId].tool = def.tool;
+
     // key event severity level
     sarifEncodeLevel(&result, keyEvt.event);
 
diff --git a/tests/csgrep/0081-sarif-writer-stdout.txt b/tests/csgrep/0081-sarif-writer-stdout.txt
@@ -12,6 +12,9 @@
                         {
                             "id": "ALLOC_FREE_MISMATCH: free",
                             "properties": {
+                                "tags": [
+                                    "coverity"
+                                ],
                                 "cwe": [
                                     "CWE-762"
                                 ]
@@ -23,6 +26,9 @@
                         {
                             "id": "CHECKED_RETURN: check_return",
                             "properties": {
+                                "tags": [
+                                    "coverity"
+                                ],
                                 "cwe": [
                                     "CWE-252"
                                 ]
@@ -34,6 +40,9 @@
                         {
                             "id": "CONSTANT_EXPRESSION_RESULT: pointless_expression",
                             "properties": {
+                                "tags": [
+                                    "coverity"
+                                ],
                                 "cwe": [
                                     "CWE-569"
                                 ]
@@ -45,6 +54,9 @@
                         {
                             "id": "CONSTANT_EXPRESSION_RESULT: result_independent_of_operands",
                             "properties": {
+                                "tags": [
+                                    "coverity"
+                                ],
                                 "cwe": [
                                     "CWE-569"
                                 ]
@@ -56,6 +68,9 @@
                         {
                             "id": "DEADCODE: dead_error_begin",
                             "properties": {
+                                "tags": [
+                                    "coverity"
+                                ],
                                 "cwe": [
                                     "CWE-561"
                                 ]
@@ -67,6 +82,9 @@
                         {
                             "id": "DEADCODE: dead_error_line",
                             "properties": {
+                                "tags": [
+                                    "coverity"
+                                ],
                                 "cwe": [
                                     "CWE-561"
                                 ]
@@ -78,6 +96,9 @@
                         {
                             "id": "DEADCODE: effectively_constant",
                             "properties": {
+                                "tags": [
+                                    "coverity"
+                                ],
                                 "cwe": [
                                     "CWE-561"
                                 ]
@@ -89,6 +110,9 @@
                         {
                             "id": "FORWARD_NULL: var_deref_model",
                             "properties": {
+                                "tags": [
+                                    "coverity"
+                                ],
                                 "cwe": [
                                     "CWE-476"
                                 ]
@@ -100,6 +124,9 @@
                         {
                             "id": "NEGATIVE_RETURNS: negative_returns",
                             "properties": {
+                                "tags": [
+                                    "coverity"
+                                ],
                                 "cwe": [
                                     "CWE-687"
                                 ]
@@ -111,6 +138,9 @@
                         {
                             "id": "OVERRUN: illegal_address",
                             "properties": {
+                                "tags": [
+                                    "coverity"
+                                ],
                                 "cwe": [
                                     "CWE-119"
                                 ]
@@ -122,6 +152,9 @@
                         {
                             "id": "OVERRUN: overrun-buffer-arg",
                             "properties": {
+                                "tags": [
+                                    "coverity"
+                                ],
                                 "cwe": [
                                     "CWE-119"
                                 ]
@@ -133,6 +166,9 @@
                         {
                             "id": "OVERRUN: overrun-local",
                             "properties": {
+                                "tags": [
+                                    "coverity"
+                                ],
                                 "cwe": [
                                     "CWE-125"
                                 ]
@@ -144,6 +180,9 @@
                         {
                             "id": "PRINTF_ARGS: invalid_type",
                             "properties": {
+                                "tags": [
+                                    "coverity"
+                                ],
                                 "cwe": [
                                     "CWE-686"
                                 ]
@@ -155,6 +194,9 @@
                         {
                             "id": "RESOURCE_LEAK: leaked_storage",
                             "properties": {
+                                "tags": [
+                                    "coverity"
+                                ],
                                 "cwe": [
                                     "CWE-404"
                                 ]
@@ -166,6 +208,9 @@
                         {
                             "id": "RESOURCE_LEAK: overwrite_var",
                             "properties": {
+                                "tags": [
+                                    "coverity"
+                                ],
                                 "cwe": [
                                     "CWE-404"
                                 ]
@@ -177,6 +222,9 @@
                         {
                             "id": "STRING_NULL: string_null",
                             "properties": {
+                                "tags": [
+                                    "coverity"
+                                ],
                                 "cwe": [
                                     "CWE-170"
                                 ]
@@ -188,6 +236,9 @@
                         {
                             "id": "STRING_OVERFLOW: fixed_size_dest",
                             "properties": {
+                                "tags": [
+                                    "coverity"
+                                ],
                                 "cwe": [
                                     "CWE-120"
                                 ]
@@ -199,6 +250,9 @@
                         {
                             "id": "TOCTOU: toctou",
                             "properties": {
+                                "tags": [
+                                    "coverity"
+                                ],
                                 "cwe": [
                                     "CWE-367"
                                 ]
diff --git a/tests/csgrep/0090-sarif-writer-illegal-utf8-sequence-stdout.txt b/tests/csgrep/0090-sarif-writer-illegal-utf8-sequence-stdout.txt
@@ -7,7 +7,17 @@
                 "driver": {
                     "name": "csdiff",
                     "version": "",
-                    "informationUri": "https://github.com/csutils/csdiff"
+                    "informationUri": "https://github.com/csutils/csdiff",
+                    "rules": [
+                        {
+                            "id": "COMPILER_WARNING: warning",
+                            "properties": {
+                                "tags": [
+                                    "gcc"
+                                ]
+                            }
+                        }
+                    ]
                 }
             },
             "results": [

Original file line number	Diff line number	Diff line change
`@@ -12,6 +12,9 @@`
`12`	`12`	`{`
`13`	`13`	`"id": "ALLOC_FREE_MISMATCH: free",`
`14`	`14`	`"properties": {`
	`15`	`+ "tags": [`
	`16`	`+ "coverity"`
	`17`	`+ ],`
`15`	`18`	`"cwe": [`
`16`	`19`	`"CWE-762"`
`17`	`20`	`]`
`@@ -23,6 +26,9 @@`
`23`	`26`	`{`
`24`	`27`	`"id": "CHECKED_RETURN: check_return",`
`25`	`28`	`"properties": {`
	`29`	`+ "tags": [`
	`30`	`+ "coverity"`
	`31`	`+ ],`
`26`	`32`	`"cwe": [`
`27`	`33`	`"CWE-252"`
`28`	`34`	`]`
`@@ -34,6 +40,9 @@`
`34`	`40`	`{`
`35`	`41`	`"id": "CONSTANT_EXPRESSION_RESULT: pointless_expression",`
`36`	`42`	`"properties": {`
	`43`	`+ "tags": [`
	`44`	`+ "coverity"`
	`45`	`+ ],`
`37`	`46`	`"cwe": [`
`38`	`47`	`"CWE-569"`
`39`	`48`	`]`
`@@ -45,6 +54,9 @@`
`45`	`54`	`{`
`46`	`55`	`"id": "CONSTANT_EXPRESSION_RESULT: result_independent_of_operands",`
`47`	`56`	`"properties": {`
	`57`	`+ "tags": [`
	`58`	`+ "coverity"`
	`59`	`+ ],`
`48`	`60`	`"cwe": [`
`49`	`61`	`"CWE-569"`
`50`	`62`	`]`
`@@ -56,6 +68,9 @@`
`56`	`68`	`{`
`57`	`69`	`"id": "DEADCODE: dead_error_begin",`
`58`	`70`	`"properties": {`
	`71`	`+ "tags": [`
	`72`	`+ "coverity"`
	`73`	`+ ],`
`59`	`74`	`"cwe": [`
`60`	`75`	`"CWE-561"`
`61`	`76`	`]`
`@@ -67,6 +82,9 @@`
`67`	`82`	`{`
`68`	`83`	`"id": "DEADCODE: dead_error_line",`
`69`	`84`	`"properties": {`
	`85`	`+ "tags": [`
	`86`	`+ "coverity"`
	`87`	`+ ],`
`70`	`88`	`"cwe": [`
`71`	`89`	`"CWE-561"`
`72`	`90`	`]`
`@@ -78,6 +96,9 @@`
`78`	`96`	`{`
`79`	`97`	`"id": "DEADCODE: effectively_constant",`
`80`	`98`	`"properties": {`
	`99`	`+ "tags": [`
	`100`	`+ "coverity"`
	`101`	`+ ],`
`81`	`102`	`"cwe": [`
`82`	`103`	`"CWE-561"`
`83`	`104`	`]`
`@@ -89,6 +110,9 @@`
`89`	`110`	`{`
`90`	`111`	`"id": "FORWARD_NULL: var_deref_model",`
`91`	`112`	`"properties": {`
	`113`	`+ "tags": [`
	`114`	`+ "coverity"`
	`115`	`+ ],`
`92`	`116`	`"cwe": [`
`93`	`117`	`"CWE-476"`
`94`	`118`	`]`
`@@ -100,6 +124,9 @@`
`100`	`124`	`{`
`101`	`125`	`"id": "NEGATIVE_RETURNS: negative_returns",`
`102`	`126`	`"properties": {`
	`127`	`+ "tags": [`
	`128`	`+ "coverity"`
	`129`	`+ ],`
`103`	`130`	`"cwe": [`
`104`	`131`	`"CWE-687"`
`105`	`132`	`]`
`@@ -111,6 +138,9 @@`
`111`	`138`	`{`
`112`	`139`	`"id": "OVERRUN: illegal_address",`
`113`	`140`	`"properties": {`
	`141`	`+ "tags": [`
	`142`	`+ "coverity"`
	`143`	`+ ],`
`114`	`144`	`"cwe": [`
`115`	`145`	`"CWE-119"`
`116`	`146`	`]`
`@@ -122,6 +152,9 @@`
`122`	`152`	`{`
`123`	`153`	`"id": "OVERRUN: overrun-buffer-arg",`
`124`	`154`	`"properties": {`
	`155`	`+ "tags": [`
	`156`	`+ "coverity"`
	`157`	`+ ],`
`125`	`158`	`"cwe": [`
`126`	`159`	`"CWE-119"`
`127`	`160`	`]`
`@@ -133,6 +166,9 @@`
`133`	`166`	`{`
`134`	`167`	`"id": "OVERRUN: overrun-local",`
`135`	`168`	`"properties": {`
	`169`	`+ "tags": [`
	`170`	`+ "coverity"`
	`171`	`+ ],`
`136`	`172`	`"cwe": [`
`137`	`173`	`"CWE-125"`
`138`	`174`	`]`
`@@ -144,6 +180,9 @@`
`144`	`180`	`{`
`145`	`181`	`"id": "PRINTF_ARGS: invalid_type",`
`146`	`182`	`"properties": {`
	`183`	`+ "tags": [`
	`184`	`+ "coverity"`
	`185`	`+ ],`
`147`	`186`	`"cwe": [`
`148`	`187`	`"CWE-686"`
`149`	`188`	`]`
`@@ -155,6 +194,9 @@`
`155`	`194`	`{`
`156`	`195`	`"id": "RESOURCE_LEAK: leaked_storage",`
`157`	`196`	`"properties": {`
	`197`	`+ "tags": [`
	`198`	`+ "coverity"`
	`199`	`+ ],`
`158`	`200`	`"cwe": [`
`159`	`201`	`"CWE-404"`
`160`	`202`	`]`
`@@ -166,6 +208,9 @@`
`166`	`208`	`{`
`167`	`209`	`"id": "RESOURCE_LEAK: overwrite_var",`
`168`	`210`	`"properties": {`
	`211`	`+ "tags": [`
	`212`	`+ "coverity"`
	`213`	`+ ],`
`169`	`214`	`"cwe": [`
`170`	`215`	`"CWE-404"`
`171`	`216`	`]`
`@@ -177,6 +222,9 @@`
`177`	`222`	`{`
`178`	`223`	`"id": "STRING_NULL: string_null",`
`179`	`224`	`"properties": {`
	`225`	`+ "tags": [`
	`226`	`+ "coverity"`
	`227`	`+ ],`
`180`	`228`	`"cwe": [`
`181`	`229`	`"CWE-170"`
`182`	`230`	`]`
`@@ -188,6 +236,9 @@`
`188`	`236`	`{`
`189`	`237`	`"id": "STRING_OVERFLOW: fixed_size_dest",`
`190`	`238`	`"properties": {`
	`239`	`+ "tags": [`
	`240`	`+ "coverity"`
	`241`	`+ ],`
`191`	`242`	`"cwe": [`
`192`	`243`	`"CWE-120"`
`193`	`244`	`]`
`@@ -199,6 +250,9 @@`
`199`	`250`	`{`
`200`	`251`	`"id": "TOCTOU: toctou",`
`201`	`252`	`"properties": {`
	`253`	`+ "tags": [`
	`254`	`+ "coverity"`
	`255`	`+ ],`
`202`	`256`	`"cwe": [`
`203`	`257`	`"CWE-367"`
`204`	`258`	`]`