jenkins/sap-jenkins-library
1
0
Fork 0
mirror of https://github.com/SAP/jenkins-library.git synced 2026-06-19 22:58:55 +02:00
Code Issues Releases Activity

feat(fortifyExecuteScan): further improvements to the SARIF generation (#3799)

Browse Source 
* feat(fortfiyExecuteScan): proper XML unescaping, added rulepacks to SARIF, added kingdom/type/subtype to tags

* feat(fortifyExecuteScan): proper handling of severity, kinds, levels in SARIF

* fix(fortifyExecuteScan): edge case when handling properties taht could lead to a crash

* fix(fortifyExecuteScan): ensure SARIF processing is done after latest FPR is processed by SSC
This commit is contained in:
xgoffin
2022-05-24 13:40:49 +02:00
committed by GitHub
parent ddb28899bf
commit 6a43e9f455
3 changed files with 94 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/format/sarif.go
+13 -7
View File
@@ -24,6 +24,7 @@ type Runs struct {
type Results struct {
RuleID string `json:"ruleId"`
RuleIndex int `json:"ruleIndex"`
Kind string `json:"kind,omitempty"`
Level string `json:"level,omitempty"`
Message *Message `json:"message,omitempty"`
AnalysisTarget *ArtifactLocation `json:"analysisTarget,omitempty"`
@@ -101,15 +102,17 @@ type SarifProperties struct {
// Tool these structs are relevant to the Tool object
type Tool struct {
Driver Driver `json:"driver"`
Driver Driver `json:"driver"`
Extensions []Driver `json:"extensions"`
}
// Driver meta information for the scan and tool context
type Driver struct {
Name string `json:"name"`
Version string `json:"version"`
GUID string `json:"guid,omitempty"`
InformationUri string `json:"informationUri,omitempty"`
Rules []SarifRule `json:"rules"`
Rules []SarifRule `json:"rules,omitempty"`
SupportedTaxonomies []SupportedTaxonomies `json:"supportedTaxonomies,omitempty"`
}
@@ -191,6 +194,8 @@ type SupportedTaxonomies struct {
type DefaultConfiguration struct {
Properties DefaultProperties `json:"properties,omitempty"`
Level string `json:"level,omitempty"` //This exists in the template, but not sure how it is populated. TODO.
Enabled bool `json:"enabled,omitempty"`
Rank float64 `json:"rank,omitempty"`
}
// DefaultProperties
@@ -218,11 +223,12 @@ type ToolComponent struct {
//SarifRuleProperties
type SarifRuleProperties struct {
Accuracy string `json:"accuracy,omitempty"`
Impact string `json:"impact,omitempty"`
Probability string `json:"probability,omitempty"`
Tags []string `json:"tags,omitempty"`
Precision string `json:"precision,omitempty"`
Accuracy string `json:"accuracy,omitempty"`
Impact string `json:"impact,omitempty"`
Probability string `json:"probability,omitempty"`
Tags []string `json:"tags,omitempty"`
Precision string `json:"precision,omitempty"`
SecuritySeverity string `json:"security-severity,omitempty"` //used by GHAS to defined the tag (low,medium,high)
}
// Invocations These structs are relevant to the Invocations object