@fabasoad/sarif-to-slack 0.2.2 → 0.2.4

package/dist/utils/SarifUtils.js

@@ -1,3 +1,19 @@
+/**
+ * This function finds the respective tool for the given result.
+ * @param run An instance of {@link Run} object.
+ * @param result An instance of {@link Result} object.
+ * @internal
+ */
+export function findToolComponentByResult(run, result) {
+    let tool;
+    if (result?.rule?.toolComponent?.index != null) {
+        tool = run.tool.extensions?.[result.rule.toolComponent.index];
+    }
+    if (!tool) {
+        tool = run.tool.driver;
+    }
+    return tool;
+}
 /**
  * This function tries to find the respective rule for the given result.
  * @param run An instance of {@link Run} object.
@@ -7,24 +23,28 @@
 export function findRuleByResult(run, result) {
     const ruleData = {};
     if (result.rule) {
-        if (result.rule?.index) {
+        if (result.rule?.index != null) {
             ruleData.index = result.rule.index;
         }
         if (result.rule?.id) {
             ruleData.id = result.rule.id;
         }
     }
-    if (!ruleData.index && result.ruleIndex) {
+    if (ruleData.index == null && result.ruleIndex != null) {
         ruleData.index = result.ruleIndex;
     }
-    if (ruleData.index
-        && run.tool.driver?.rules
-        && ruleData.index < run.tool.driver.rules.length) {
-        return run.tool.driver.rules[ruleData.index];
+    if (!ruleData.id && result.ruleId) {
+        ruleData.id = result.ruleId;
+    }
+    const tool = findToolComponentByResult(run, result);
+    if (ruleData.index != null
+        && tool?.rules
+        && ruleData.index < tool.rules.length) {
+        return tool.rules[ruleData.index];
     }
     // If failed to find rule by index then try to find by ruleId
-    if (result.ruleId && run.tool.driver?.rules) {
-        return run.tool.driver.rules.find((r) => r.id === result.ruleId);
+    if (ruleData.id && tool?.rules) {
+        return tool.rules.find((r) => r.id === ruleData.id);
     }
     return undefined;
 }
@@ -43,4 +63,4 @@ export function tryGetRulePropertyByResult(run, result, propertyName) {
     }
     return undefined;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiU2FyaWZVdGlscy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy91dGlscy9TYXJpZlV0aWxzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUVBOzs7OztHQUtHO0FBQ0gsTUFBTSxVQUFVLGdCQUFnQixDQUFDLEdBQVEsRUFBRSxNQUFjO0lBQ3ZELE1BQU0sUUFBUSxHQUFvQyxFQUFFLENBQUE7SUFFcEQsSUFBSSxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDaEIsSUFBSSxNQUFNLENBQUMsSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFDO1lBQ3ZCLFFBQVEsQ0FBQyxLQUFLLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUE7UUFDcEMsQ0FBQztRQUNELElBQUksTUFBTSxDQUFDLElBQUksRUFBRSxFQUFFLEVBQUUsQ0FBQztZQUNwQixRQUFRLENBQUMsRUFBRSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFBO1FBQzlCLENBQUM7SUFDSCxDQUFDO0lBRUQsSUFBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLElBQUksTUFBTSxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQ3hDLFFBQVEsQ0FBQyxLQUFLLEdBQUcsTUFBTSxDQUFDLFNBQVMsQ0FBQTtJQUNuQyxDQUFDO0lBRUQsSUFBSSxRQUFRLENBQUMsS0FBSztXQUNiLEdBQUcsQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLEtBQUs7V0FDdEIsUUFBUSxDQUFDLEtBQUssR0FBRyxHQUFHLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDbkQsT0FBTyxHQUFHLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFBO0lBQzlDLENBQUM7SUFFRCw2REFBNkQ7SUFDN0QsSUFBSSxNQUFNLENBQUMsTUFBTSxJQUFJLEdBQUcsQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxDQUFDO1FBQzVDLE9BQU8sR0FBRyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLElBQUksQ0FDL0IsQ0FBQyxDQUFzQixFQUFXLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxLQUFLLE1BQU0sQ0FBQyxNQUFNLENBQzVELENBQUE7SUFDSCxDQUFDO0lBRUQsT0FBTyxTQUFTLENBQUE7QUFDbEIsQ0FBQztBQVFEOzs7Ozs7O0dBT0c7QUFDSCxNQUFNLFVBQVUsMEJBQTBCLENBQUksR0FBUSxFQUFFLE1BQWMsRUFBRSxZQUEwQjtJQUNoRyxNQUFNLElBQUksR0FBb0MsZ0JBQWdCLENBQUMsR0FBRyxFQUFFLE1BQU0sQ0FBQyxDQUFBO0lBQzNFLElBQUksSUFBSSxJQUFJLElBQUksQ0FBQyxVQUFVLElBQUksWUFBWSxJQUFJLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUMvRCxPQUFPLElBQUksQ0FBQyxVQUFVLENBQUMsWUFBWSxDQUFNLENBQUE7SUFDM0MsQ0FBQztJQUVELE9BQU8sU0FBUyxDQUFBO0FBQ2xCLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiU2FyaWZVdGlscy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy91dGlscy9TYXJpZlV0aWxzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUVBOzs7OztHQUtHO0FBQ0gsTUFBTSxVQUFVLHlCQUF5QixDQUFDLEdBQVEsRUFBRSxNQUFlO0lBQ2pFLElBQUksSUFBK0IsQ0FBQTtJQUNuQyxJQUFJLE1BQU0sRUFBRSxJQUFJLEVBQUUsYUFBYSxFQUFFLEtBQUssSUFBSSxJQUFJLEVBQUUsQ0FBQztRQUMvQyxJQUFJLEdBQUcsR0FBRyxDQUFDLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsQ0FBQTtJQUMvRCxDQUFDO0lBRUQsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ1YsSUFBSSxHQUFHLEdBQUcsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFBO0lBQ3hCLENBQUM7SUFFRCxPQUFPLElBQUksQ0FBQTtBQUNiLENBQUM7QUFFRDs7Ozs7R0FLRztBQUNILE1BQU0sVUFBVSxnQkFBZ0IsQ0FBQyxHQUFRLEVBQUUsTUFBYztJQUN2RCxNQUFNLFFBQVEsR0FBb0MsRUFBRSxDQUFBO0lBRXBELElBQUksTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ2hCLElBQUksTUFBTSxDQUFDLElBQUksRUFBRSxLQUFLLElBQUksSUFBSSxFQUFFLENBQUM7WUFDL0IsUUFBUSxDQUFDLEtBQUssR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQTtRQUNwQyxDQUFDO1FBQ0QsSUFBSSxNQUFNLENBQUMsSUFBSSxFQUFFLEVBQUUsRUFBRSxDQUFDO1lBQ3BCLFFBQVEsQ0FBQyxFQUFFLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUE7UUFDOUIsQ0FBQztJQUNILENBQUM7SUFFRCxJQUFJLFFBQVEsQ0FBQyxLQUFLLElBQUksSUFBSSxJQUFJLE1BQU0sQ0FBQyxTQUFTLElBQUksSUFBSSxFQUFFLENBQUM7UUFDdkQsUUFBUSxDQUFDLEtBQUssR0FBRyxNQUFNLENBQUMsU0FBUyxDQUFBO0lBQ25DLENBQUM7SUFFRCxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsSUFBSSxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDbEMsUUFBUSxDQUFDLEVBQUUsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFBO0lBQzdCLENBQUM7SUFFRCxNQUFNLElBQUksR0FBa0IseUJBQXlCLENBQUMsR0FBRyxFQUFFLE1BQU0sQ0FBQyxDQUFBO0lBRWxFLElBQUksUUFBUSxDQUFDLEtBQUssSUFBSSxJQUFJO1dBQ3JCLElBQUksRUFBRSxLQUFLO1dBQ1gsUUFBUSxDQUFDLEtBQUssR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ3hDLE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUE7SUFDbkMsQ0FBQztJQUVELDZEQUE2RDtJQUM3RCxJQUFJLFFBQVEsQ0FBQyxFQUFFLElBQUksSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFDO1FBQy9CLE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQ3BCLENBQUMsQ0FBc0IsRUFBVyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsS0FBSyxRQUFRLENBQUMsRUFBRSxDQUMxRCxDQUFBO0lBQ0gsQ0FBQztJQUVELE9BQU8sU0FBUyxDQUFBO0FBQ2xCLENBQUM7QUFRRDs7Ozs7OztHQU9HO0FBQ0gsTUFBTSxVQUFVLDBCQUEwQixDQUFJLEdBQVEsRUFBRSxNQUFjLEVBQUUsWUFBMEI7SUFDaEcsTUFBTSxJQUFJLEdBQW9DLGdCQUFnQixDQUFDLEdBQUcsRUFBRSxNQUFNLENBQUMsQ0FBQTtJQUMzRSxJQUFJLElBQUksSUFBSSxJQUFJLENBQUMsVUFBVSxJQUFJLFlBQVksSUFBSSxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDL0QsT0FBTyxJQUFJLENBQUMsVUFBVSxDQUFDLFlBQVksQ0FBTSxDQUFBO0lBQzNDLENBQUM7SUFFRCxPQUFPLFNBQVMsQ0FBQTtBQUNsQixDQUFDIn0=

package/dist/version.js

@@ -7,5 +7,5 @@
  *
  * @internal
  */
-export const LIB_VERSION = '0.2.2';
+export const LIB_VERSION = '0.2.4';
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmVyc2lvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy92ZXJzaW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sV0FBVyxHQUFHLE9BQU8sQ0FBQSJ9

package/jest.config.json

@@ -10,7 +10,7 @@
   ],
   "coverageThreshold": {
     "global": {
-      "branches": 15,
+      "branches": 10,
       "functions": 10,
       "lines": 15,
       "statements": 15

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@fabasoad/sarif-to-slack",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "TypeScript library to send results of SARIF file to Slack webhook URL.",
-  "main": "dist/index.js",
+  "main": "dist/index.cjs",
   "module": "dist/index.js",
   "typings": "dist/index.d.ts",
   "private": false,
@@ -12,9 +12,8 @@
     "test:integration": "jest --config=jest.config.json --testNamePattern=integration",
     "clean": "rm -rf coverage && rm -rf temp",
     "clean:unsafe": "rm -f package-lock.json && rm -rf node_modules && rm -rf dist && rm -rf lib",
-    "tsc": "tsc",
     "prebuild": "./scripts/save-version.sh",
-    "build": "npm run tsc && api-extractor run --local --verbose",
+    "build": "./scripts/build.sh",
     "prepublishOnly": "npm run build",
     "preinstall": "./scripts/save-version.sh",
     "version:patch": "npm version patch --commit-hooks --git-tag-version --message 'chore: bump to version %s'",
@@ -56,6 +55,7 @@
     "jest": "30.0.5",
     "jest-circus": "30.0.5",
     "ts-jest": "29.4.0",
+    "tsup": "8.5.0",
     "typescript": "5.8.3"
   }
 }

package/scripts/build.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env sh
+
+main() {
+  tsc
+  api-extractor run --local --verbose
+  tsup src/index.ts --format cjs --target es2024 --out-dir dist-cjs --clean
+  mv dist-cjs/index.js dist/index.cjs
+  rm -rf dist-cjs
+}
+
+main "$@"

package/src/model/SarifModelPerRun.ts

@@ -1,5 +1,8 @@
 import type { Result, Run } from 'sarif';
-import { tryGetRulePropertyByResult } from '../utils/SarifUtils'
+import {
+  findToolComponentByResult,
+  tryGetRulePropertyByResult
+} from '../utils/SarifUtils'
 import { SecurityLevel, SecuritySeverity } from './types'
 import Logger from '../Logger'
 import { Map as ImmutableMap } from 'immutable'
@@ -21,7 +24,7 @@ export class SarifModelPerRun {
   private readonly _securityLevelMap: ImmutableMap<SecurityLevel, number>
 
   constructor(run: Run) {
-    this.toolName = run.tool.driver.name
+    this.toolName = findToolComponentByResult(run, run.results?.[0]).name
 
     this._securitySeverityMap = ImmutableMap<SecuritySeverity, number>().asMutable()
     this._securityLevelMap = ImmutableMap<SecurityLevel, number>().asMutable()

package/src/utils/SarifUtils.ts

@@ -1,4 +1,23 @@
-import type { ReportingDescriptor, Result, Run } from "sarif";
+import type { ReportingDescriptor, Result, Run, ToolComponent } from "sarif";
+
+/**
+ * This function finds the respective tool for the given result.
+ * @param run An instance of {@link Run} object.
+ * @param result An instance of {@link Result} object.
+ * @internal
+ */
+export function findToolComponentByResult(run: Run, result?: Result): ToolComponent {
+  let tool: ToolComponent | undefined
+  if (result?.rule?.toolComponent?.index != null) {
+    tool = run.tool.extensions?.[result.rule.toolComponent.index]
+  }
+
+  if (!tool) {
+    tool = run.tool.driver
+  }
+
+  return tool
+}
 
 /**
  * This function tries to find the respective rule for the given result.
@@ -10,7 +29,7 @@ export function findRuleByResult(run: Run, result: Result): ReportingDescriptor
   const ruleData: { id?: string, index?: number } = {}
 
   if (result.rule) {
-    if (result.rule?.index) {
+    if (result.rule?.index != null) {
       ruleData.index = result.rule.index
     }
     if (result.rule?.id) {
@@ -18,20 +37,26 @@ export function findRuleByResult(run: Run, result: Result): ReportingDescriptor
     }
   }
 
-  if (!ruleData.index && result.ruleIndex) {
+  if (ruleData.index == null && result.ruleIndex != null) {
     ruleData.index = result.ruleIndex
   }
 
-  if (ruleData.index
-    && run.tool.driver?.rules
-    && ruleData.index < run.tool.driver.rules.length) {
-    return run.tool.driver.rules[ruleData.index]
+  if (!ruleData.id && result.ruleId) {
+    ruleData.id = result.ruleId
+  }
+
+  const tool: ToolComponent = findToolComponentByResult(run, result)
+
+  if (ruleData.index != null
+    && tool?.rules
+    && ruleData.index < tool.rules.length) {
+    return tool.rules[ruleData.index]
   }
 
   // If failed to find rule by index then try to find by ruleId
-  if (result.ruleId && run.tool.driver?.rules) {
-    return run.tool.driver.rules.find(
-      (r: ReportingDescriptor): boolean => r.id === result.ruleId
+  if (ruleData.id && tool?.rules) {
+    return tool.rules.find(
+      (r: ReportingDescriptor): boolean => r.id === ruleData.id
     )
   }
 

package/src/version.ts

@@ -7,4 +7,4 @@
  *
  * @internal
  */
-export const LIB_VERSION = '0.2.2'
+export const LIB_VERSION = '0.2.4'

package/test-data/sarif/runs-1-extensions-1-results-0.sarif

@@ -0,0 +1,24 @@
+{
+  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+  "version": "2.1.0",
+  "runs": [
+    {
+      "tool": {
+        "driver": {
+          "language": "en-US",
+          "name": "Snyk Open Source"
+        },
+        "extensions": [
+          {
+            "name": "Snyk Open Source Extension",
+            "properties": {
+              "artifactsScanned": 6
+            },
+            "rules": []
+          }
+        ]
+      },
+      "results": []
+    }
+  ]
+}

package/test-data/sarif/runs-1-extensions-1.sarif

@@ -0,0 +1,79 @@
+{
+  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+  "version": "2.1.0",
+  "runs": [
+    {
+      "tool": {
+        "driver": {
+          "language": "en-US",
+          "name": "Snyk Open Source"
+        },
+        "extensions": [
+          {
+            "name": "Snyk Open Source Extension",
+            "properties": {
+              "artifactsScanned": 6
+            },
+            "rules": [
+              {
+                "id": "SNYK-HEX-PAGINATOR-1086684",
+                "shortDescription": {
+                  "text": "Critical severity - Remote Code Execution (RCE) vulnerability in paginator"
+                },
+                "fullDescription": {
+                  "text": "(CVE-2020-15150) paginator@0.6.0"
+                },
+                "help": {
+                  "text": "",
+                  "markdown": "* Package Manager: hex\n* Vulnerable module: paginator\n* Introduced through: carafe@0.1.0 and paginator@0.6.0\n### Detailed paths\n* _Introduced through_: carafe@0.1.0 › paginator@0.6.0\n# Overview\n[paginator](https://hex.pm/packages/paginator) is a package that enables cursor-based pagination for Elixir Ecto.\n\nAffected versions of this package are vulnerable to Remote Code Execution (RCE) via `paginate()` function when untrusted input is passed from a remote user.\r\n\r\n# PoC\r\n```\r\ndefp rce_start_xcalc() do\r\n    exploit = fn _, _ ->  System.cmd(\"xcalc\", []); {:cont, []} end\r\n    payload =\r\n    exploit\r\n    |> :erlang.term_to_binary()\r\n    |> Base.url_encode64()\r\nend\r\n```\n# Remediation\nUpgrade `paginator` to version 1.0.0 or higher.\n# References\n- [GitHub PR](https://github.com/duffelhq/paginator/commit/bf45e92602e517c75aea0465efc35cd661d9ebf8)\n- [Research Blog Post](https://www.alphabot.com/security/blog/2020/elixir/Remote-code-execution-vulnerability-in-Elixir-based-Paginator-project.html)\n"
+                },
+                "properties": {
+                  "tags": [
+                    "security",
+                    "CWE-94",
+                    "hex"
+                  ],
+                  "cvssv3_baseScore": 9.8,
+                  "security-severity": "9.8"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "results": [
+        {
+          "rule": {
+            "id": "SNYK-HEX-PAGINATOR-1086684",
+            "index": 0,
+            "toolComponent": {
+              "index": 0
+            }
+          },
+          "ruleId": "SNYK-HEX-PAGINATOR-1086684",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable paginator package with a critical severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "mix.exs"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "paginator@0.6.0"
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}