Incorrect Titles in Code Scanning Alerts Section

[ncoop57]

Github’s Code scanning alerts section shows incorrect filename and path to file in flagged security alerts:

As shown, the title states the issue is at DESCipherExample.java at the path src/main/java/com/minimals/des. However, the problem is actually located in DESReplaceCipherExample.java at the path src/main/java/com/minimals/des_replace, which is correctly shown in the subtitle.

Sorry if this is not the correct place to submit this issue. I couldn't find any Code Scanning specific place.

[chrisgavin]

Hi @ncoop57,

Thank you for reporting this issue. I've had a look and it seems like the reason the results have wrong title is because rule titles created by the ShiftLeftSecurity/scan-action contain information about specific results, even though the rule can be shared across multiple results.

The best way to report issues with third-party Code Scanning actions is usually by raising an issue on the repository for that action, in this case ShiftLeftSecurity/scan-action. They should be able to advise if this is a known issue or if they can update the data they output to avoid this issue.

Best regards,
Chris