@eurekadevsecops/radar 1.6.1 → 1.6.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eurekadevsecops/radar",
-  "version": "1.6.1",
+  "version": "1.6.2",
   "description": "Radar is an open-source orchestrator of security scanners.",
   "homepage": "https://www.eurekadevsecops.com/radar",
   "keywords": [

package/src/commands/scan.js

@@ -150,8 +150,8 @@ module.exports = {
     }
 
     // Send telemetry: git metadata.
+    const metadata = git.metadata(target)
     if (telemetry.enabled && scanID) {
-      const metadata = git.metadata(target)
       await telemetry.send(`scans/:scanID/metadata`, { scanID }, { metadata })
       await telemetry.sendSensitive(`scans/:scanID/metadata`, { scanID }, { metadata })
     }
@@ -173,7 +173,7 @@ module.exports = {
 
     // Transform scan findings: treat warnings and notes as errors, and normalize location paths.
     if (escalations) results.sarif = SARIF.transforms.escalate(results.sarif, escalations)
-    SARIF.transforms.normalize(results.sarif, target)
+    SARIF.transforms.normalize(results.sarif, target, metadata, git.root(target))
 
     // Write findings to the destination SARIF file.
     if (outfile) fs.writeFileSync(outfile, JSON.stringify(results.sarif))

package/src/util/git/index.js

@@ -84,6 +84,23 @@ git rev-list --abbrev=4 --abbrev-commit --all | \
   }
 }
 
+function root(folder) {
+  try {
+    // Get the full OS path to the root of the repo.
+    const root = execSync('git rev-parse --show-toplevel', { cwd: folder }).toString().trim()
+    return root
+  } catch (error) {
+    return {
+      type: 'error',
+      error: {
+        code: 'E_GIT_METADATA',
+        details: error
+      }
+    }
+  }
+}
+
 module.exports = {
-  metadata
+  metadata,
+  root
 }

package/src/util/sarif/transforms/normalize.js

@@ -1,21 +1,33 @@
 const path = require('node:path')
-module.exports = (sarif, dir) => {
+module.exports = (sarif, dir, git, root) => {
   // Normalize findings.
   for (const run of sarif.runs) {
-    if (!run.results) continue
-    for (const result of run.results) {
 
-      // Find paths in the finding description and make them relative to the scan directory.
-      if (result?.message?.text) result.message.text = result.message.text.replace('/app/', '')
+    // Record the source repo location and the relative target subfolder within the repo.
+    run.originalUriBaseIds = {
+     "SOURCE": {
+        "uri": git.repo.url.https,
+        "description": "Source origin for the target being scanned (ie. git repo URL)."
+     },
+      "TARGET": {
+        "uri": `${path.relative(root, dir)}`,
+        "uriBaseId": "SOURCE",
+        "description": "Scan target (subfolder) within the source repo or folder."
+      }
+    }
 
-      // Make all physical locations for the result relative to the scan directory.
+    // Make all physical locations for the result relative to the scan directory.
+    if (!run.results) continue
+    for (const result of run.results) {
       for (const location of result.locations) {
         if (location.physicalLocation?.artifactLocation?.uri?.startsWith('/app')) {
           let file = path.relative('/app', location.physicalLocation.artifactLocation.uri)
+          if (result?.message?.text) result.message.text = result.message.text.replace(location.physicalLocation.artifactLocation.uri, file)
           location.physicalLocation.artifactLocation.uri = file
         }
         else if (location.physicalLocation?.artifactLocation?.uri?.startsWith('/')) {
           let file = path.relative('/', location.physicalLocation.artifactLocation.uri)
+          if (result?.message?.text) result.message.text = result.message.text.replace(location.physicalLocation.artifactLocation.uri, file)
           location.physicalLocation.artifactLocation.uri = file
         }
       }