@fabasoad/sarif-to-slack 0.2.3 → 0.2.4

package/.github/workflows/security.yml

@@ -11,6 +11,7 @@ jobs:
   sast:
     name: SAST
     permissions:
+      actions: read
       contents: read
       security-events: write
     uses: fabasoad/reusable-workflows/.github/workflows/wf-security-sast.yml@main

package/.github/workflows/send-sarif-to-slack.yml

@@ -34,6 +34,8 @@ on: # yamllint disable-line rule:truthy
           - "Trivy IaC (Error: 1, Note: 1)"
           - "Wiz Container (Error: 12, Warning: 369, Note: 191)"
           - "Wiz IaC (Warning: 5, Note: 5)"
+          - "Runs: 1, Extensions: 1, Results: 0"
+          - "Runs: 1, Extensions: 1, Results > 0"
           - "Runs: 1, Tools: 1, Results: 0"
           - "Runs: 2, Tools: 1, Results > 0"
           - "Runs: 2, Tools: 1, Results: 0"
@@ -174,6 +176,10 @@ jobs:
             value="wiz-iac.sarif"
           elif [ "${INPUT_SARIF}" = "Runs: 1, Tools: 1, Results: 0" ]; then
             value="runs-1-tools-1-results-0.sarif"
+          elif [ "${INPUT_SARIF}" = "Runs: 1, Extensions: 1, Results: 0" ]; then
+            value="runs-1-extensions-1-results-0.sarif"
+          elif [ "${INPUT_SARIF}" = "Runs: 1, Extensions: 1, Results > 0" ]; then
+            value="runs-1-extensions-1.sarif"
           elif [ "${INPUT_SARIF}" = "Runs: 2, Tools: 1, Results > 0" ]; then
             value="runs-2-tools-1.sarif"
           elif [ "${INPUT_SARIF}" = "Runs: 2, Tools: 1, Results: 0" ]; then

package/dist/index.cjs

@@ -149,31 +149,45 @@ function processSarifPath(sarifPath) {
 var import_webhook = require("@slack/webhook");
 
 // src/version.ts
-var LIB_VERSION = "0.2.3";
+var LIB_VERSION = "0.2.4";
 
 // src/model/SarifModelPerSarif.ts
 var import_immutable2 = require("immutable");
 
 // src/utils/SarifUtils.ts
+function findToolComponentByResult(run, result) {
+  let tool;
+  if (result?.rule?.toolComponent?.index != null) {
+    tool = run.tool.extensions?.[result.rule.toolComponent.index];
+  }
+  if (!tool) {
+    tool = run.tool.driver;
+  }
+  return tool;
+}
 function findRuleByResult(run, result) {
   const ruleData = {};
   if (result.rule) {
-    if (result.rule?.index) {
+    if (result.rule?.index != null) {
       ruleData.index = result.rule.index;
     }
     if (result.rule?.id) {
       ruleData.id = result.rule.id;
     }
   }
-  if (!ruleData.index && result.ruleIndex) {
+  if (ruleData.index == null && result.ruleIndex != null) {
     ruleData.index = result.ruleIndex;
   }
-  if (ruleData.index && run.tool.driver?.rules && ruleData.index < run.tool.driver.rules.length) {
-    return run.tool.driver.rules[ruleData.index];
+  if (!ruleData.id && result.ruleId) {
+    ruleData.id = result.ruleId;
+  }
+  const tool = findToolComponentByResult(run, result);
+  if (ruleData.index != null && tool?.rules && ruleData.index < tool.rules.length) {
+    return tool.rules[ruleData.index];
   }
-  if (result.ruleId && run.tool.driver?.rules) {
-    return run.tool.driver.rules.find(
-      (r) => r.id === result.ruleId
+  if (ruleData.id && tool?.rules) {
+    return tool.rules.find(
+      (r) => r.id === ruleData.id
     );
   }
   return void 0;
@@ -225,7 +239,7 @@ var SarifModelPerRun = class {
   _securitySeverityMap;
   _securityLevelMap;
   constructor(run) {
-    this.toolName = run.tool.driver.name;
+    this.toolName = findToolComponentByResult(run, run.results?.[0]).name;
     this._securitySeverityMap = (0, import_immutable.Map)().asMutable();
     this._securityLevelMap = (0, import_immutable.Map)().asMutable();
     this.buildSecuritySeverityMap(run);

package/dist/model/SarifModelPerRun.js

@@ -1,4 +1,4 @@
-import { tryGetRulePropertyByResult } from '../utils/SarifUtils';
+import { findToolComponentByResult, tryGetRulePropertyByResult } from '../utils/SarifUtils';
 import { SecurityLevel, SecuritySeverity } from './types';
 import Logger from '../Logger';
 import { Map as ImmutableMap } from 'immutable';
@@ -14,7 +14,7 @@ export class SarifModelPerRun {
     _securitySeverityMap;
     _securityLevelMap;
     constructor(run) {
-        this.toolName = run.tool.driver.name;
+        this.toolName = findToolComponentByResult(run, run.results?.[0]).name;
         this._securitySeverityMap = ImmutableMap().asMutable();
         this._securityLevelMap = ImmutableMap().asMutable();
         this.buildSecuritySeverityMap(run);
@@ -87,4 +87,4 @@ export class SarifModelPerRun {
         return sortSecurityLevelMap(this._securityLevelMap);
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiU2FyaWZNb2RlbFBlclJ1bi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9tb2RlbC9TYXJpZk1vZGVsUGVyUnVuLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFBRSwwQkFBMEIsRUFBRSxNQUFNLHFCQUFxQixDQUFBO0FBQ2hFLE9BQU8sRUFBRSxhQUFhLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSxTQUFTLENBQUE7QUFDekQsT0FBTyxNQUFNLE1BQU0sV0FBVyxDQUFBO0FBQzlCLE9BQU8sRUFBRSxHQUFHLElBQUksWUFBWSxFQUFFLE1BQU0sV0FBVyxDQUFBO0FBQy9DLE9BQU8sRUFDTCxvQkFBb0IsRUFDcEIsdUJBQXVCLEVBQ3hCLE1BQU0sb0JBQW9CLENBQUM7QUFFNUI7Ozs7O0dBS0c7QUFDSCxNQUFNLE9BQU8sZ0JBQWdCO0lBQ1gsUUFBUSxDQUFRO0lBRWYsb0JBQW9CLENBQXdDO0lBQzVELGlCQUFpQixDQUFxQztJQUV2RSxZQUFZLEdBQVE7UUFDbEIsSUFBSSxDQUFDLFFBQVEsR0FBRyxHQUFHLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUE7UUFFcEMsSUFBSSxDQUFDLG9CQUFvQixHQUFHLFlBQVksRUFBNEIsQ0FBQyxTQUFTLEVBQUUsQ0FBQTtRQUNoRixJQUFJLENBQUMsaUJBQWlCLEdBQUcsWUFBWSxFQUF5QixDQUFDLFNBQVMsRUFBRSxDQUFBO1FBRTFFLElBQUksQ0FBQyx3QkFBd0IsQ0FBQyxHQUFHLENBQUMsQ0FBQTtRQUNsQyxJQUFJLENBQUMscUJBQXFCLENBQUMsR0FBRyxDQUFDLENBQUE7SUFDakMsQ0FBQztJQUVPLHdCQUF3QixDQUFDLEtBQWM7UUFDN0MsSUFBSSxLQUFLLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDeEIsT0FBTyxnQkFBZ0IsQ0FBQyxPQUFPLENBQUE7UUFDakMsQ0FBQztRQUVELElBQUksS0FBSyxJQUFJLENBQUMsSUFBSSxLQUFLLElBQUksRUFBRSxFQUFFLENBQUM7WUFDOUIsT0FBTyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUE7UUFDbEMsQ0FBQztRQUVELElBQUksS0FBSyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQ2YsT0FBTyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUE7UUFDOUIsQ0FBQztRQUVELElBQUksS0FBSyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQ2YsT0FBTyxnQkFBZ0IsQ0FBQyxNQUFNLENBQUE7UUFDaEMsQ0FBQztRQUVELElBQUksS0FBSyxJQUFJLEdBQUcsRUFBRSxDQUFDO1lBQ2pCLE9BQU8sZ0JBQWdCLENBQUMsR0FBRyxDQUFBO1FBQzdCLENBQUM7UUFFRCxJQUFJLEtBQUssSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUNmLE9BQU8sZ0JBQWdCLENBQUMsSUFBSSxDQUFBO1FBQzlCLENBQUM7UUFFRCxNQUFNLENBQUMsSUFBSSxDQUFDLGdCQUFnQixLQUFLLDJDQUEyQyxDQUFDLENBQUE7UUFDN0UsT0FBTyxnQkFBZ0IsQ0FBQyxPQUFPLENBQUE7SUFDakMsQ0FBQztJQUVPLHFCQUFxQixDQUFDLEtBQWM7UUFDMUMsSUFBSSxLQUFLLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDeEIsT0FBTyxhQUFhLENBQUMsT0FBTyxDQUFBO1FBQzlCLENBQUM7UUFFRCxJQUFJLEtBQUssQ0FBQyxXQUFXLEVBQUUsS0FBSyxPQUFPLEVBQUUsQ0FBQztZQUNwQyxPQUFPLGFBQWEsQ0FBQyxLQUFLLENBQUE7UUFDNUIsQ0FBQztRQUVELElBQUksS0FBSyxDQUFDLFdBQVcsRUFBRSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3RDLE9BQU8sYUFBYSxDQUFDLE9BQU8sQ0FBQTtRQUM5QixDQUFDO1FBRUQsSUFBSSxLQUFLLENBQUMsV0FBVyxFQUFFLEtBQUssTUFBTSxFQUFFLENBQUM7WUFDbkMsT0FBTyxhQUFhLENBQUMsSUFBSSxDQUFBO1FBQzNCLENBQUM7UUFFRCxNQUFNLENBQUMsSUFBSSxDQUFDLGVBQWUsS0FBSyx1Q0FBdUMsQ0FBQyxDQUFBO1FBQ3hFLE9BQU8sYUFBYSxDQUFDLE9BQU8sQ0FBQTtJQUM5QixDQUFDO0lBRU8sd0JBQXdCLENBQUMsR0FBUTtRQUN2QyxNQUFNLE9BQU8sR0FBYSxHQUFHLENBQUMsT0FBTyxJQUFJLEVBQUUsQ0FBQTtRQUMzQyxLQUFLLE1BQU0sTUFBTSxJQUFJLE9BQU8sRUFBRSxDQUFDO1lBQzdCLE1BQU0sUUFBUSxHQUFxQixJQUFJLENBQUMsd0JBQXdCLENBQzlELDBCQUEwQixDQUFDLEdBQUcsRUFBRSxNQUFNLEVBQUUsbUJBQW1CLENBQUMsQ0FDN0QsQ0FBQTtZQUNELE1BQU0sS0FBSyxHQUFXLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFBO1lBQ2xFLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxHQUFHLENBQUMsUUFBUSxFQUFFLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQTtRQUNwRCxDQUFDO0lBQ0gsQ0FBQztJQUVPLG1CQUFtQixDQUFDLEdBQVEsRUFBRSxNQUFjO1FBQ2xELElBQUksTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ2pCLE9BQU8sTUFBTSxDQUFDLEtBQUssQ0FBQTtRQUNyQixDQUFDO1FBRUQsT0FBTywwQkFBMEIsQ0FBQyxHQUFHLEVBQUUsTUFBTSxFQUFFLGtCQUFrQixDQUFDLENBQUE7SUFDcEUsQ0FBQztJQUVPLHFCQUFxQixDQUFDLEdBQVE7UUFDcEMsTUFBTSxPQUFPLEdBQWEsR0FBRyxDQUFDLE9BQU8sSUFBSSxFQUFFLENBQUE7UUFDM0MsS0FBSyxNQUFNLE1BQU0sSUFBSSxPQUFPLEVBQUUsQ0FBQztZQUM3QixNQUFNLEtBQUssR0FBa0IsSUFBSSxDQUFDLHFCQUFxQixDQUNyRCxJQUFJLENBQUMsbUJBQW1CLENBQUMsR0FBRyxFQUFFLE1BQU0sQ0FBQyxDQUN0QyxDQUFBO1lBQ0QsTUFBTSxLQUFLLEdBQVcsSUFBSSxDQUFDLGlCQUFpQixDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUE7WUFDNUQsSUFBSSxDQUFDLGlCQUFpQixDQUFDLEdBQUcsQ0FBQyxLQUFLLEVBQUUsS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFBO1FBQzlDLENBQUM7SUFDSCxDQUFDO0lBRUQsSUFBVyxtQkFBbUI7UUFDNUIsT0FBTyx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsb0JBQW9CLENBQUMsQ0FBQTtJQUMzRCxDQUFDO0lBRUQsSUFBVyxnQkFBZ0I7UUFDekIsT0FBTyxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsaUJBQWlCLENBQUMsQ0FBQTtJQUNyRCxDQUFDO0NBQ0YifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiU2FyaWZNb2RlbFBlclJ1bi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9tb2RlbC9TYXJpZk1vZGVsUGVyUnVuLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFDTCx5QkFBeUIsRUFDekIsMEJBQTBCLEVBQzNCLE1BQU0scUJBQXFCLENBQUE7QUFDNUIsT0FBTyxFQUFFLGFBQWEsRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLFNBQVMsQ0FBQTtBQUN6RCxPQUFPLE1BQU0sTUFBTSxXQUFXLENBQUE7QUFDOUIsT0FBTyxFQUFFLEdBQUcsSUFBSSxZQUFZLEVBQUUsTUFBTSxXQUFXLENBQUE7QUFDL0MsT0FBTyxFQUNMLG9CQUFvQixFQUNwQix1QkFBdUIsRUFDeEIsTUFBTSxvQkFBb0IsQ0FBQztBQUU1Qjs7Ozs7R0FLRztBQUNILE1BQU0sT0FBTyxnQkFBZ0I7SUFDWCxRQUFRLENBQVE7SUFFZixvQkFBb0IsQ0FBd0M7SUFDNUQsaUJBQWlCLENBQXFDO0lBRXZFLFlBQVksR0FBUTtRQUNsQixJQUFJLENBQUMsUUFBUSxHQUFHLHlCQUF5QixDQUFDLEdBQUcsRUFBRSxHQUFHLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUE7UUFFckUsSUFBSSxDQUFDLG9CQUFvQixHQUFHLFlBQVksRUFBNEIsQ0FBQyxTQUFTLEVBQUUsQ0FBQTtRQUNoRixJQUFJLENBQUMsaUJBQWlCLEdBQUcsWUFBWSxFQUF5QixDQUFDLFNBQVMsRUFBRSxDQUFBO1FBRTFFLElBQUksQ0FBQyx3QkFBd0IsQ0FBQyxHQUFHLENBQUMsQ0FBQTtRQUNsQyxJQUFJLENBQUMscUJBQXFCLENBQUMsR0FBRyxDQUFDLENBQUE7SUFDakMsQ0FBQztJQUVPLHdCQUF3QixDQUFDLEtBQWM7UUFDN0MsSUFBSSxLQUFLLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDeEIsT0FBTyxnQkFBZ0IsQ0FBQyxPQUFPLENBQUE7UUFDakMsQ0FBQztRQUVELElBQUksS0FBSyxJQUFJLENBQUMsSUFBSSxLQUFLLElBQUksRUFBRSxFQUFFLENBQUM7WUFDOUIsT0FBTyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUE7UUFDbEMsQ0FBQztRQUVELElBQUksS0FBSyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQ2YsT0FBTyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUE7UUFDOUIsQ0FBQztRQUVELElBQUksS0FBSyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQ2YsT0FBTyxnQkFBZ0IsQ0FBQyxNQUFNLENBQUE7UUFDaEMsQ0FBQztRQUVELElBQUksS0FBSyxJQUFJLEdBQUcsRUFBRSxDQUFDO1lBQ2pCLE9BQU8sZ0JBQWdCLENBQUMsR0FBRyxDQUFBO1FBQzdCLENBQUM7UUFFRCxJQUFJLEtBQUssSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUNmLE9BQU8sZ0JBQWdCLENBQUMsSUFBSSxDQUFBO1FBQzlCLENBQUM7UUFFRCxNQUFNLENBQUMsSUFBSSxDQUFDLGdCQUFnQixLQUFLLDJDQUEyQyxDQUFDLENBQUE7UUFDN0UsT0FBTyxnQkFBZ0IsQ0FBQyxPQUFPLENBQUE7SUFDakMsQ0FBQztJQUVPLHFCQUFxQixDQUFDLEtBQWM7UUFDMUMsSUFBSSxLQUFLLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDeEIsT0FBTyxhQUFhLENBQUMsT0FBTyxDQUFBO1FBQzlCLENBQUM7UUFFRCxJQUFJLEtBQUssQ0FBQyxXQUFXLEVBQUUsS0FBSyxPQUFPLEVBQUUsQ0FBQztZQUNwQyxPQUFPLGFBQWEsQ0FBQyxLQUFLLENBQUE7UUFDNUIsQ0FBQztRQUVELElBQUksS0FBSyxDQUFDLFdBQVcsRUFBRSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3RDLE9BQU8sYUFBYSxDQUFDLE9BQU8sQ0FBQTtRQUM5QixDQUFDO1FBRUQsSUFBSSxLQUFLLENBQUMsV0FBVyxFQUFFLEtBQUssTUFBTSxFQUFFLENBQUM7WUFDbkMsT0FBTyxhQUFhLENBQUMsSUFBSSxDQUFBO1FBQzNCLENBQUM7UUFFRCxNQUFNLENBQUMsSUFBSSxDQUFDLGVBQWUsS0FBSyx1Q0FBdUMsQ0FBQyxDQUFBO1FBQ3hFLE9BQU8sYUFBYSxDQUFDLE9BQU8sQ0FBQTtJQUM5QixDQUFDO0lBRU8sd0JBQXdCLENBQUMsR0FBUTtRQUN2QyxNQUFNLE9BQU8sR0FBYSxHQUFHLENBQUMsT0FBTyxJQUFJLEVBQUUsQ0FBQTtRQUMzQyxLQUFLLE1BQU0sTUFBTSxJQUFJLE9BQU8sRUFBRSxDQUFDO1lBQzdCLE1BQU0sUUFBUSxHQUFxQixJQUFJLENBQUMsd0JBQXdCLENBQzlELDBCQUEwQixDQUFDLEdBQUcsRUFBRSxNQUFNLEVBQUUsbUJBQW1CLENBQUMsQ0FDN0QsQ0FBQTtZQUNELE1BQU0sS0FBSyxHQUFXLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFBO1lBQ2xFLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxHQUFHLENBQUMsUUFBUSxFQUFFLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQTtRQUNwRCxDQUFDO0lBQ0gsQ0FBQztJQUVPLG1CQUFtQixDQUFDLEdBQVEsRUFBRSxNQUFjO1FBQ2xELElBQUksTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ2pCLE9BQU8sTUFBTSxDQUFDLEtBQUssQ0FBQTtRQUNyQixDQUFDO1FBRUQsT0FBTywwQkFBMEIsQ0FBQyxHQUFHLEVBQUUsTUFBTSxFQUFFLGtCQUFrQixDQUFDLENBQUE7SUFDcEUsQ0FBQztJQUVPLHFCQUFxQixDQUFDLEdBQVE7UUFDcEMsTUFBTSxPQUFPLEdBQWEsR0FBRyxDQUFDLE9BQU8sSUFBSSxFQUFFLENBQUE7UUFDM0MsS0FBSyxNQUFNLE1BQU0sSUFBSSxPQUFPLEVBQUUsQ0FBQztZQUM3QixNQUFNLEtBQUssR0FBa0IsSUFBSSxDQUFDLHFCQUFxQixDQUNyRCxJQUFJLENBQUMsbUJBQW1CLENBQUMsR0FBRyxFQUFFLE1BQU0sQ0FBQyxDQUN0QyxDQUFBO1lBQ0QsTUFBTSxLQUFLLEdBQVcsSUFBSSxDQUFDLGlCQUFpQixDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUE7WUFDNUQsSUFBSSxDQUFDLGlCQUFpQixDQUFDLEdBQUcsQ0FBQyxLQUFLLEVBQUUsS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFBO1FBQzlDLENBQUM7SUFDSCxDQUFDO0lBRUQsSUFBVyxtQkFBbUI7UUFDNUIsT0FBTyx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsb0JBQW9CLENBQUMsQ0FBQTtJQUMzRCxDQUFDO0lBRUQsSUFBVyxnQkFBZ0I7UUFDekIsT0FBTyxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsaUJBQWlCLENBQUMsQ0FBQTtJQUNyRCxDQUFDO0NBQ0YifQ==

package/dist/utils/SarifUtils.js

@@ -1,3 +1,19 @@
+/**
+ * This function finds the respective tool for the given result.
+ * @param run An instance of {@link Run} object.
+ * @param result An instance of {@link Result} object.
+ * @internal
+ */
+export function findToolComponentByResult(run, result) {
+    let tool;
+    if (result?.rule?.toolComponent?.index != null) {
+        tool = run.tool.extensions?.[result.rule.toolComponent.index];
+    }
+    if (!tool) {
+        tool = run.tool.driver;
+    }
+    return tool;
+}
 /**
  * This function tries to find the respective rule for the given result.
  * @param run An instance of {@link Run} object.
@@ -7,24 +23,28 @@
 export function findRuleByResult(run, result) {
     const ruleData = {};
     if (result.rule) {
-        if (result.rule?.index) {
+        if (result.rule?.index != null) {
             ruleData.index = result.rule.index;
         }
         if (result.rule?.id) {
             ruleData.id = result.rule.id;
         }
     }
-    if (!ruleData.index && result.ruleIndex) {
+    if (ruleData.index == null && result.ruleIndex != null) {
         ruleData.index = result.ruleIndex;
     }
-    if (ruleData.index
-        && run.tool.driver?.rules
-        && ruleData.index < run.tool.driver.rules.length) {
-        return run.tool.driver.rules[ruleData.index];
+    if (!ruleData.id && result.ruleId) {
+        ruleData.id = result.ruleId;
+    }
+    const tool = findToolComponentByResult(run, result);
+    if (ruleData.index != null
+        && tool?.rules
+        && ruleData.index < tool.rules.length) {
+        return tool.rules[ruleData.index];
     }
     // If failed to find rule by index then try to find by ruleId
-    if (result.ruleId && run.tool.driver?.rules) {
-        return run.tool.driver.rules.find((r) => r.id === result.ruleId);
+    if (ruleData.id && tool?.rules) {
+        return tool.rules.find((r) => r.id === ruleData.id);
     }
     return undefined;
 }
@@ -43,4 +63,4 @@ export function tryGetRulePropertyByResult(run, result, propertyName) {
     }
     return undefined;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiU2FyaWZVdGlscy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy91dGlscy9TYXJpZlV0aWxzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUVBOzs7OztHQUtHO0FBQ0gsTUFBTSxVQUFVLGdCQUFnQixDQUFDLEdBQVEsRUFBRSxNQUFjO0lBQ3ZELE1BQU0sUUFBUSxHQUFvQyxFQUFFLENBQUE7SUFFcEQsSUFBSSxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDaEIsSUFBSSxNQUFNLENBQUMsSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFDO1lBQ3ZCLFFBQVEsQ0FBQyxLQUFLLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUE7UUFDcEMsQ0FBQztRQUNELElBQUksTUFBTSxDQUFDLElBQUksRUFBRSxFQUFFLEVBQUUsQ0FBQztZQUNwQixRQUFRLENBQUMsRUFBRSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFBO1FBQzlCLENBQUM7SUFDSCxDQUFDO0lBRUQsSUFBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLElBQUksTUFBTSxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQ3hDLFFBQVEsQ0FBQyxLQUFLLEdBQUcsTUFBTSxDQUFDLFNBQVMsQ0FBQTtJQUNuQyxDQUFDO0lBRUQsSUFBSSxRQUFRLENBQUMsS0FBSztXQUNiLEdBQUcsQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLEtBQUs7V0FDdEIsUUFBUSxDQUFDLEtBQUssR0FBRyxHQUFHLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDbkQsT0FBTyxHQUFHLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFBO0lBQzlDLENBQUM7SUFFRCw2REFBNkQ7SUFDN0QsSUFBSSxNQUFNLENBQUMsTUFBTSxJQUFJLEdBQUcsQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxDQUFDO1FBQzVDLE9BQU8sR0FBRyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLElBQUksQ0FDL0IsQ0FBQyxDQUFzQixFQUFXLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxLQUFLLE1BQU0sQ0FBQyxNQUFNLENBQzVELENBQUE7SUFDSCxDQUFDO0lBRUQsT0FBTyxTQUFTLENBQUE7QUFDbEIsQ0FBQztBQVFEOzs7Ozs7O0dBT0c7QUFDSCxNQUFNLFVBQVUsMEJBQTBCLENBQUksR0FBUSxFQUFFLE1BQWMsRUFBRSxZQUEwQjtJQUNoRyxNQUFNLElBQUksR0FBb0MsZ0JBQWdCLENBQUMsR0FBRyxFQUFFLE1BQU0sQ0FBQyxDQUFBO0lBQzNFLElBQUksSUFBSSxJQUFJLElBQUksQ0FBQyxVQUFVLElBQUksWUFBWSxJQUFJLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUMvRCxPQUFPLElBQUksQ0FBQyxVQUFVLENBQUMsWUFBWSxDQUFNLENBQUE7SUFDM0MsQ0FBQztJQUVELE9BQU8sU0FBUyxDQUFBO0FBQ2xCLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiU2FyaWZVdGlscy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy91dGlscy9TYXJpZlV0aWxzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUVBOzs7OztHQUtHO0FBQ0gsTUFBTSxVQUFVLHlCQUF5QixDQUFDLEdBQVEsRUFBRSxNQUFlO0lBQ2pFLElBQUksSUFBK0IsQ0FBQTtJQUNuQyxJQUFJLE1BQU0sRUFBRSxJQUFJLEVBQUUsYUFBYSxFQUFFLEtBQUssSUFBSSxJQUFJLEVBQUUsQ0FBQztRQUMvQyxJQUFJLEdBQUcsR0FBRyxDQUFDLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsQ0FBQTtJQUMvRCxDQUFDO0lBRUQsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ1YsSUFBSSxHQUFHLEdBQUcsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFBO0lBQ3hCLENBQUM7SUFFRCxPQUFPLElBQUksQ0FBQTtBQUNiLENBQUM7QUFFRDs7Ozs7R0FLRztBQUNILE1BQU0sVUFBVSxnQkFBZ0IsQ0FBQyxHQUFRLEVBQUUsTUFBYztJQUN2RCxNQUFNLFFBQVEsR0FBb0MsRUFBRSxDQUFBO0lBRXBELElBQUksTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ2hCLElBQUksTUFBTSxDQUFDLElBQUksRUFBRSxLQUFLLElBQUksSUFBSSxFQUFFLENBQUM7WUFDL0IsUUFBUSxDQUFDLEtBQUssR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQTtRQUNwQyxDQUFDO1FBQ0QsSUFBSSxNQUFNLENBQUMsSUFBSSxFQUFFLEVBQUUsRUFBRSxDQUFDO1lBQ3BCLFFBQVEsQ0FBQyxFQUFFLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUE7UUFDOUIsQ0FBQztJQUNILENBQUM7SUFFRCxJQUFJLFFBQVEsQ0FBQyxLQUFLLElBQUksSUFBSSxJQUFJLE1BQU0sQ0FBQyxTQUFTLElBQUksSUFBSSxFQUFFLENBQUM7UUFDdkQsUUFBUSxDQUFDLEtBQUssR0FBRyxNQUFNLENBQUMsU0FBUyxDQUFBO0lBQ25DLENBQUM7SUFFRCxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsSUFBSSxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDbEMsUUFBUSxDQUFDLEVBQUUsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFBO0lBQzdCLENBQUM7SUFFRCxNQUFNLElBQUksR0FBa0IseUJBQXlCLENBQUMsR0FBRyxFQUFFLE1BQU0sQ0FBQyxDQUFBO0lBRWxFLElBQUksUUFBUSxDQUFDLEtBQUssSUFBSSxJQUFJO1dBQ3JCLElBQUksRUFBRSxLQUFLO1dBQ1gsUUFBUSxDQUFDLEtBQUssR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ3hDLE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUE7SUFDbkMsQ0FBQztJQUVELDZEQUE2RDtJQUM3RCxJQUFJLFFBQVEsQ0FBQyxFQUFFLElBQUksSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFDO1FBQy9CLE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQ3BCLENBQUMsQ0FBc0IsRUFBVyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsS0FBSyxRQUFRLENBQUMsRUFBRSxDQUMxRCxDQUFBO0lBQ0gsQ0FBQztJQUVELE9BQU8sU0FBUyxDQUFBO0FBQ2xCLENBQUM7QUFRRDs7Ozs7OztHQU9HO0FBQ0gsTUFBTSxVQUFVLDBCQUEwQixDQUFJLEdBQVEsRUFBRSxNQUFjLEVBQUUsWUFBMEI7SUFDaEcsTUFBTSxJQUFJLEdBQW9DLGdCQUFnQixDQUFDLEdBQUcsRUFBRSxNQUFNLENBQUMsQ0FBQTtJQUMzRSxJQUFJLElBQUksSUFBSSxJQUFJLENBQUMsVUFBVSxJQUFJLFlBQVksSUFBSSxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDL0QsT0FBTyxJQUFJLENBQUMsVUFBVSxDQUFDLFlBQVksQ0FBTSxDQUFBO0lBQzNDLENBQUM7SUFFRCxPQUFPLFNBQVMsQ0FBQTtBQUNsQixDQUFDIn0=

package/dist/version.js

@@ -7,5 +7,5 @@
  *
  * @internal
  */
-export const LIB_VERSION = '0.2.3';
+export const LIB_VERSION = '0.2.4';
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmVyc2lvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy92ZXJzaW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sV0FBVyxHQUFHLE9BQU8sQ0FBQSJ9

package/jest.config.json

@@ -10,7 +10,7 @@
   ],
   "coverageThreshold": {
     "global": {
-      "branches": 15,
+      "branches": 10,
       "functions": 10,
       "lines": 15,
       "statements": 15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fabasoad/sarif-to-slack",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "TypeScript library to send results of SARIF file to Slack webhook URL.",
   "main": "dist/index.cjs",
   "module": "dist/index.js",

package/src/model/SarifModelPerRun.ts

@@ -1,5 +1,8 @@
 import type { Result, Run } from 'sarif';
-import { tryGetRulePropertyByResult } from '../utils/SarifUtils'
+import {
+  findToolComponentByResult,
+  tryGetRulePropertyByResult
+} from '../utils/SarifUtils'
 import { SecurityLevel, SecuritySeverity } from './types'
 import Logger from '../Logger'
 import { Map as ImmutableMap } from 'immutable'
@@ -21,7 +24,7 @@ export class SarifModelPerRun {
   private readonly _securityLevelMap: ImmutableMap<SecurityLevel, number>
 
   constructor(run: Run) {
-    this.toolName = run.tool.driver.name
+    this.toolName = findToolComponentByResult(run, run.results?.[0]).name
 
     this._securitySeverityMap = ImmutableMap<SecuritySeverity, number>().asMutable()
     this._securityLevelMap = ImmutableMap<SecurityLevel, number>().asMutable()

package/src/utils/SarifUtils.ts

@@ -1,4 +1,23 @@
-import type { ReportingDescriptor, Result, Run } from "sarif";
+import type { ReportingDescriptor, Result, Run, ToolComponent } from "sarif";
+
+/**
+ * This function finds the respective tool for the given result.
+ * @param run An instance of {@link Run} object.
+ * @param result An instance of {@link Result} object.
+ * @internal
+ */
+export function findToolComponentByResult(run: Run, result?: Result): ToolComponent {
+  let tool: ToolComponent | undefined
+  if (result?.rule?.toolComponent?.index != null) {
+    tool = run.tool.extensions?.[result.rule.toolComponent.index]
+  }
+
+  if (!tool) {
+    tool = run.tool.driver
+  }
+
+  return tool
+}
 
 /**
  * This function tries to find the respective rule for the given result.
@@ -10,7 +29,7 @@ export function findRuleByResult(run: Run, result: Result): ReportingDescriptor
   const ruleData: { id?: string, index?: number } = {}
 
   if (result.rule) {
-    if (result.rule?.index) {
+    if (result.rule?.index != null) {
       ruleData.index = result.rule.index
     }
     if (result.rule?.id) {
@@ -18,20 +37,26 @@ export function findRuleByResult(run: Run, result: Result): ReportingDescriptor
     }
   }
 
-  if (!ruleData.index && result.ruleIndex) {
+  if (ruleData.index == null && result.ruleIndex != null) {
     ruleData.index = result.ruleIndex
   }
 
-  if (ruleData.index
-    && run.tool.driver?.rules
-    && ruleData.index < run.tool.driver.rules.length) {
-    return run.tool.driver.rules[ruleData.index]
+  if (!ruleData.id && result.ruleId) {
+    ruleData.id = result.ruleId
+  }
+
+  const tool: ToolComponent = findToolComponentByResult(run, result)
+
+  if (ruleData.index != null
+    && tool?.rules
+    && ruleData.index < tool.rules.length) {
+    return tool.rules[ruleData.index]
   }
 
   // If failed to find rule by index then try to find by ruleId
-  if (result.ruleId && run.tool.driver?.rules) {
-    return run.tool.driver.rules.find(
-      (r: ReportingDescriptor): boolean => r.id === result.ruleId
+  if (ruleData.id && tool?.rules) {
+    return tool.rules.find(
+      (r: ReportingDescriptor): boolean => r.id === ruleData.id
     )
   }
 

package/src/version.ts

@@ -7,4 +7,4 @@
  *
  * @internal
  */
-export const LIB_VERSION = '0.2.3'
+export const LIB_VERSION = '0.2.4'

package/test-data/sarif/runs-1-extensions-1-results-0.sarif

@@ -0,0 +1,24 @@
+{
+  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+  "version": "2.1.0",
+  "runs": [
+    {
+      "tool": {
+        "driver": {
+          "language": "en-US",
+          "name": "Snyk Open Source"
+        },
+        "extensions": [
+          {
+            "name": "Snyk Open Source Extension",
+            "properties": {
+              "artifactsScanned": 6
+            },
+            "rules": []
+          }
+        ]
+      },
+      "results": []
+    }
+  ]
+}

package/test-data/sarif/runs-1-extensions-1.sarif

@@ -0,0 +1,79 @@
+{
+  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+  "version": "2.1.0",
+  "runs": [
+    {
+      "tool": {
+        "driver": {
+          "language": "en-US",
+          "name": "Snyk Open Source"
+        },
+        "extensions": [
+          {
+            "name": "Snyk Open Source Extension",
+            "properties": {
+              "artifactsScanned": 6
+            },
+            "rules": [
+              {
+                "id": "SNYK-HEX-PAGINATOR-1086684",
+                "shortDescription": {
+                  "text": "Critical severity - Remote Code Execution (RCE) vulnerability in paginator"
+                },
+                "fullDescription": {
+                  "text": "(CVE-2020-15150) paginator@0.6.0"
+                },
+                "help": {
+                  "text": "",
+                  "markdown": "* Package Manager: hex\n* Vulnerable module: paginator\n* Introduced through: carafe@0.1.0 and paginator@0.6.0\n### Detailed paths\n* _Introduced through_: carafe@0.1.0 › paginator@0.6.0\n# Overview\n[paginator](https://hex.pm/packages/paginator) is a package that enables cursor-based pagination for Elixir Ecto.\n\nAffected versions of this package are vulnerable to Remote Code Execution (RCE) via `paginate()` function when untrusted input is passed from a remote user.\r\n\r\n# PoC\r\n```\r\ndefp rce_start_xcalc() do\r\n    exploit = fn _, _ ->  System.cmd(\"xcalc\", []); {:cont, []} end\r\n    payload =\r\n    exploit\r\n    |> :erlang.term_to_binary()\r\n    |> Base.url_encode64()\r\nend\r\n```\n# Remediation\nUpgrade `paginator` to version 1.0.0 or higher.\n# References\n- [GitHub PR](https://github.com/duffelhq/paginator/commit/bf45e92602e517c75aea0465efc35cd661d9ebf8)\n- [Research Blog Post](https://www.alphabot.com/security/blog/2020/elixir/Remote-code-execution-vulnerability-in-Elixir-based-Paginator-project.html)\n"
+                },
+                "properties": {
+                  "tags": [
+                    "security",
+                    "CWE-94",
+                    "hex"
+                  ],
+                  "cvssv3_baseScore": 9.8,
+                  "security-severity": "9.8"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "results": [
+        {
+          "rule": {
+            "id": "SNYK-HEX-PAGINATOR-1086684",
+            "index": 0,
+            "toolComponent": {
+              "index": 0
+            }
+          },
+          "ruleId": "SNYK-HEX-PAGINATOR-1086684",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable paginator package with a critical severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "mix.exs"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "paginator@0.6.0"
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}