@security-alert/sarif-to-markdown 1.3.0 → 1.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +336 -4
- package/lib/sarif-to-markdown.d.ts +16 -7
- package/lib/sarif-to-markdown.js +17 -11
- package/lib/sarif-to-markdown.js.map +1 -1
- package/module/sarif-to-markdown.d.ts +16 -7
- package/module/sarif-to-markdown.js +17 -11
- package/module/sarif-to-markdown.js.map +1 -1
- package/package.json +2 -2
- package/CHANGELOG.md +0 -11
package/README.md
CHANGED
|
@@ -1,11 +1,11 @@
|
|
|
1
1
|
# @security-alert/sarif-to-markdown
|
|
2
2
|
|
|
3
|
-
Convert SARIF format to
|
|
3
|
+
Convert SARIF format to Markdown text.
|
|
4
4
|
|
|
5
5
|
> Supported safari version: v2.1.0
|
|
6
6
|
|
|
7
7
|
- [SARIF output — CodeQL](https://help.semmle.com/codeql/codeql-cli/reference/sarif-overview.html)
|
|
8
|
-
- [OASIS Static Analysis
|
|
8
|
+
- [OASIS Static Analysis sarifToMarkdownResult Interchange Format (SARIF) TC | OASIS](https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=sarif)
|
|
9
9
|
|
|
10
10
|
## Install
|
|
11
11
|
|
|
@@ -13,9 +13,341 @@ Install with [npm](https://www.npmjs.com/):
|
|
|
13
13
|
|
|
14
14
|
npm install @security-alert/sarif-to-markdown
|
|
15
15
|
|
|
16
|
-
##
|
|
16
|
+
## Example
|
|
17
17
|
|
|
18
|
-
|
|
18
|
+
**input.sarif:**
|
|
19
|
+
|
|
20
|
+
```json
|
|
21
|
+
{
|
|
22
|
+
"$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
|
|
23
|
+
"version": "2.1.0",
|
|
24
|
+
"runs": [
|
|
25
|
+
{
|
|
26
|
+
"tool": {
|
|
27
|
+
"driver": {
|
|
28
|
+
"name": "CodeQL command-line toolchain",
|
|
29
|
+
"organization": "GitHub",
|
|
30
|
+
"semanticVersion": "2.2.4",
|
|
31
|
+
"rules": [
|
|
32
|
+
{
|
|
33
|
+
"id": "js/xss",
|
|
34
|
+
"name": "js/xss",
|
|
35
|
+
"shortDescription": {
|
|
36
|
+
"text": "Client-side cross-site scripting"
|
|
37
|
+
},
|
|
38
|
+
"fullDescription": {
|
|
39
|
+
"text": "Writing user input directly to the DOM allows for a cross-site scripting vulnerability."
|
|
40
|
+
},
|
|
41
|
+
"defaultConfiguration": {
|
|
42
|
+
"level": "error"
|
|
43
|
+
},
|
|
44
|
+
"properties": {
|
|
45
|
+
"tags": [
|
|
46
|
+
"security",
|
|
47
|
+
"external/cwe/cwe-079",
|
|
48
|
+
"external/cwe/cwe-116"
|
|
49
|
+
],
|
|
50
|
+
"kind": "path-problem",
|
|
51
|
+
"precision": "high",
|
|
52
|
+
"name": "Client-side cross-site scripting",
|
|
53
|
+
"description": "Writing user input directly to the DOM allows for\n a cross-site scripting vulnerability.",
|
|
54
|
+
"id": "js/xss",
|
|
55
|
+
"problem.severity": "error"
|
|
56
|
+
}
|
|
57
|
+
}
|
|
58
|
+
]
|
|
59
|
+
}
|
|
60
|
+
},
|
|
61
|
+
"artifacts": [
|
|
62
|
+
{
|
|
63
|
+
"location": {
|
|
64
|
+
"uri": "examples/Xss.js",
|
|
65
|
+
"uriBaseId": "%SRCROOT%",
|
|
66
|
+
"index": 0
|
|
67
|
+
}
|
|
68
|
+
}
|
|
69
|
+
],
|
|
70
|
+
"results": [
|
|
71
|
+
{
|
|
72
|
+
"ruleId": "js/xss",
|
|
73
|
+
"ruleIndex": 0,
|
|
74
|
+
"message": {
|
|
75
|
+
"text": "Cross-site scripting vulnerability due to [user-provided value](1)."
|
|
76
|
+
},
|
|
77
|
+
"locations": [
|
|
78
|
+
{
|
|
79
|
+
"physicalLocation": {
|
|
80
|
+
"artifactLocation": {
|
|
81
|
+
"uri": "examples/Xss.js",
|
|
82
|
+
"uriBaseId": "%SRCROOT%",
|
|
83
|
+
"index": 0
|
|
84
|
+
},
|
|
85
|
+
"region": {
|
|
86
|
+
"startLine": 4,
|
|
87
|
+
"startColumn": 20,
|
|
88
|
+
"endColumn": 56
|
|
89
|
+
}
|
|
90
|
+
}
|
|
91
|
+
}
|
|
92
|
+
],
|
|
93
|
+
"partialFingerprints": {
|
|
94
|
+
"primaryLocationLineHash": "f10617abe5e779f0:1",
|
|
95
|
+
"primaryLocationStartColumnFingerprint": "15"
|
|
96
|
+
},
|
|
97
|
+
"codeFlows": [
|
|
98
|
+
{
|
|
99
|
+
"threadFlows": [
|
|
100
|
+
{
|
|
101
|
+
"locations": [
|
|
102
|
+
{
|
|
103
|
+
"location": {
|
|
104
|
+
"physicalLocation": {
|
|
105
|
+
"artifactLocation": {
|
|
106
|
+
"uri": "examples/Xss.js",
|
|
107
|
+
"uriBaseId": "%SRCROOT%",
|
|
108
|
+
"index": 0
|
|
109
|
+
},
|
|
110
|
+
"region": {
|
|
111
|
+
"startLine": 2,
|
|
112
|
+
"startColumn": 16,
|
|
113
|
+
"endColumn": 33
|
|
114
|
+
}
|
|
115
|
+
},
|
|
116
|
+
"message": {
|
|
117
|
+
"text": "document.location"
|
|
118
|
+
}
|
|
119
|
+
}
|
|
120
|
+
},
|
|
121
|
+
{
|
|
122
|
+
"location": {
|
|
123
|
+
"physicalLocation": {
|
|
124
|
+
"artifactLocation": {
|
|
125
|
+
"uri": "examples/Xss.js",
|
|
126
|
+
"uriBaseId": "%SRCROOT%",
|
|
127
|
+
"index": 0
|
|
128
|
+
},
|
|
129
|
+
"region": {
|
|
130
|
+
"startLine": 2,
|
|
131
|
+
"startColumn": 16,
|
|
132
|
+
"endColumn": 38
|
|
133
|
+
}
|
|
134
|
+
},
|
|
135
|
+
"message": {
|
|
136
|
+
"text": "documen ... on.href"
|
|
137
|
+
}
|
|
138
|
+
}
|
|
139
|
+
},
|
|
140
|
+
{
|
|
141
|
+
"location": {
|
|
142
|
+
"physicalLocation": {
|
|
143
|
+
"artifactLocation": {
|
|
144
|
+
"uri": "examples/Xss.js",
|
|
145
|
+
"uriBaseId": "%SRCROOT%",
|
|
146
|
+
"index": 0
|
|
147
|
+
},
|
|
148
|
+
"region": {
|
|
149
|
+
"startLine": 2,
|
|
150
|
+
"startColumn": 9,
|
|
151
|
+
"endColumn": 38
|
|
152
|
+
}
|
|
153
|
+
},
|
|
154
|
+
"message": {
|
|
155
|
+
"text": "href"
|
|
156
|
+
}
|
|
157
|
+
}
|
|
158
|
+
},
|
|
159
|
+
{
|
|
160
|
+
"location": {
|
|
161
|
+
"physicalLocation": {
|
|
162
|
+
"artifactLocation": {
|
|
163
|
+
"uri": "examples/Xss.js",
|
|
164
|
+
"uriBaseId": "%SRCROOT%",
|
|
165
|
+
"index": 0
|
|
166
|
+
},
|
|
167
|
+
"region": {
|
|
168
|
+
"startLine": 3,
|
|
169
|
+
"startColumn": 17,
|
|
170
|
+
"endColumn": 21
|
|
171
|
+
}
|
|
172
|
+
},
|
|
173
|
+
"message": {
|
|
174
|
+
"text": "href"
|
|
175
|
+
}
|
|
176
|
+
}
|
|
177
|
+
},
|
|
178
|
+
{
|
|
179
|
+
"location": {
|
|
180
|
+
"physicalLocation": {
|
|
181
|
+
"artifactLocation": {
|
|
182
|
+
"uri": "examples/Xss.js",
|
|
183
|
+
"uriBaseId": "%SRCROOT%",
|
|
184
|
+
"index": 0
|
|
185
|
+
},
|
|
186
|
+
"region": {
|
|
187
|
+
"startLine": 3,
|
|
188
|
+
"startColumn": 17,
|
|
189
|
+
"endColumn": 59
|
|
190
|
+
}
|
|
191
|
+
},
|
|
192
|
+
"message": {
|
|
193
|
+
"text": "href.su ... t=\")+8)"
|
|
194
|
+
}
|
|
195
|
+
}
|
|
196
|
+
},
|
|
197
|
+
{
|
|
198
|
+
"location": {
|
|
199
|
+
"physicalLocation": {
|
|
200
|
+
"artifactLocation": {
|
|
201
|
+
"uri": "examples/Xss.js",
|
|
202
|
+
"uriBaseId": "%SRCROOT%",
|
|
203
|
+
"index": 0
|
|
204
|
+
},
|
|
205
|
+
"region": {
|
|
206
|
+
"startLine": 3,
|
|
207
|
+
"startColumn": 9,
|
|
208
|
+
"endColumn": 59
|
|
209
|
+
}
|
|
210
|
+
},
|
|
211
|
+
"message": {
|
|
212
|
+
"text": "deflt"
|
|
213
|
+
}
|
|
214
|
+
}
|
|
215
|
+
},
|
|
216
|
+
{
|
|
217
|
+
"location": {
|
|
218
|
+
"physicalLocation": {
|
|
219
|
+
"artifactLocation": {
|
|
220
|
+
"uri": "examples/Xss.js",
|
|
221
|
+
"uriBaseId": "%SRCROOT%",
|
|
222
|
+
"index": 0
|
|
223
|
+
},
|
|
224
|
+
"region": {
|
|
225
|
+
"startLine": 4,
|
|
226
|
+
"startColumn": 39,
|
|
227
|
+
"endColumn": 44
|
|
228
|
+
}
|
|
229
|
+
},
|
|
230
|
+
"message": {
|
|
231
|
+
"text": "deflt"
|
|
232
|
+
}
|
|
233
|
+
}
|
|
234
|
+
},
|
|
235
|
+
{
|
|
236
|
+
"location": {
|
|
237
|
+
"physicalLocation": {
|
|
238
|
+
"artifactLocation": {
|
|
239
|
+
"uri": "examples/Xss.js",
|
|
240
|
+
"uriBaseId": "%SRCROOT%",
|
|
241
|
+
"index": 0
|
|
242
|
+
},
|
|
243
|
+
"region": {
|
|
244
|
+
"startLine": 4,
|
|
245
|
+
"startColumn": 20,
|
|
246
|
+
"endColumn": 56
|
|
247
|
+
}
|
|
248
|
+
},
|
|
249
|
+
"message": {
|
|
250
|
+
"text": "\"<OPTIO ... PTION>\""
|
|
251
|
+
}
|
|
252
|
+
}
|
|
253
|
+
}
|
|
254
|
+
]
|
|
255
|
+
}
|
|
256
|
+
]
|
|
257
|
+
}
|
|
258
|
+
],
|
|
259
|
+
"relatedLocations": [
|
|
260
|
+
{
|
|
261
|
+
"id": 1,
|
|
262
|
+
"physicalLocation": {
|
|
263
|
+
"artifactLocation": {
|
|
264
|
+
"uri": "examples/Xss.js",
|
|
265
|
+
"uriBaseId": "%SRCROOT%",
|
|
266
|
+
"index": 0
|
|
267
|
+
},
|
|
268
|
+
"region": {
|
|
269
|
+
"startLine": 2,
|
|
270
|
+
"startColumn": 16,
|
|
271
|
+
"endColumn": 33
|
|
272
|
+
}
|
|
273
|
+
},
|
|
274
|
+
"message": {
|
|
275
|
+
"text": "user-provided value"
|
|
276
|
+
}
|
|
277
|
+
}
|
|
278
|
+
]
|
|
279
|
+
}
|
|
280
|
+
],
|
|
281
|
+
"newlineSequences": [
|
|
282
|
+
"\r\n",
|
|
283
|
+
"\n",
|
|
284
|
+
"
",
|
|
285
|
+
"
"
|
|
286
|
+
],
|
|
287
|
+
"columnKind": "utf16CodeUnits",
|
|
288
|
+
"properties": {
|
|
289
|
+
"semmle.formatSpecifier": "sarifv2.1.0"
|
|
290
|
+
}
|
|
291
|
+
}
|
|
292
|
+
]
|
|
293
|
+
}
|
|
294
|
+
```
|
|
295
|
+
|
|
296
|
+
**output.md**
|
|
297
|
+
|
|
298
|
+
---
|
|
299
|
+
|
|
300
|
+
|
|
301
|
+
## Rules
|
|
302
|
+
<!-- Rule Info -->
|
|
303
|
+
**js/xss** (severity: **error**)
|
|
304
|
+
|
|
305
|
+
> Client-side cross-site scripting
|
|
306
|
+
|
|
307
|
+
<details><summary>Details</summary>
|
|
308
|
+
<pre>{
|
|
309
|
+
"driver": {
|
|
310
|
+
"name": "CodeQL command-line toolchain",
|
|
311
|
+
"organization": "GitHub",
|
|
312
|
+
"semanticVersion": "2.2.4",
|
|
313
|
+
"rules": [
|
|
314
|
+
{
|
|
315
|
+
"id": "js/xss",
|
|
316
|
+
"name": "js/xss",
|
|
317
|
+
"shortDescription": {
|
|
318
|
+
"text": "Client-side cross-site scripting"
|
|
319
|
+
},
|
|
320
|
+
"fullDescription": {
|
|
321
|
+
"text": "Writing user input directly to the DOM allows for a cross-site scripting vulnerability."
|
|
322
|
+
},
|
|
323
|
+
"defaultConfiguration": {
|
|
324
|
+
"level": "error"
|
|
325
|
+
},
|
|
326
|
+
"properties": {
|
|
327
|
+
"tags": [
|
|
328
|
+
"security",
|
|
329
|
+
"external/cwe/cwe-079",
|
|
330
|
+
"external/cwe/cwe-116"
|
|
331
|
+
],
|
|
332
|
+
"kind": "path-problem",
|
|
333
|
+
"precision": "high",
|
|
334
|
+
"name": "Client-side cross-site scripting",
|
|
335
|
+
"description": "Writing user input directly to the DOM allows for\n a cross-site scripting vulnerability.",
|
|
336
|
+
"id": "js/xss",
|
|
337
|
+
"problem.severity": "error"
|
|
338
|
+
}
|
|
339
|
+
}
|
|
340
|
+
]
|
|
341
|
+
}
|
|
342
|
+
}</pre></details>
|
|
343
|
+
|
|
344
|
+
## Results
|
|
345
|
+
|
|
346
|
+
- **js/xss**: Cross-site scripting vulnerability due to \[user-provided value\]\(1\).
|
|
347
|
+
|
|
348
|
+
https://github.com/owner/repo/blob/master/base/examples/Xss.js#L4
|
|
349
|
+
|
|
350
|
+
---
|
|
19
351
|
|
|
20
352
|
## Changelog
|
|
21
353
|
|
|
@@ -1,9 +1,12 @@
|
|
|
1
1
|
import type { Log } from "sarif";
|
|
2
|
-
export declare type sarifFormatterResult = {
|
|
3
|
-
title: string;
|
|
4
|
-
body: string;
|
|
5
|
-
};
|
|
6
2
|
export declare type sarifFormatterOptions = {
|
|
3
|
+
/**
|
|
4
|
+
* Title of content
|
|
5
|
+
*/
|
|
6
|
+
title?: string;
|
|
7
|
+
/**
|
|
8
|
+
* https://github.com
|
|
9
|
+
*/
|
|
7
10
|
githubHost?: string;
|
|
8
11
|
/**
|
|
9
12
|
* GitHub Owner
|
|
@@ -23,7 +26,13 @@ export declare type sarifFormatterOptions = {
|
|
|
23
26
|
*/
|
|
24
27
|
sourceRoot: string;
|
|
25
28
|
};
|
|
26
|
-
|
|
27
|
-
title
|
|
29
|
+
declare type sarifToMarkdownResult = {
|
|
30
|
+
title?: string;
|
|
28
31
|
body: string;
|
|
29
|
-
|
|
32
|
+
/**
|
|
33
|
+
* If the body has not results, `hasMessages` will be `false`
|
|
34
|
+
*/
|
|
35
|
+
hasMessages: boolean;
|
|
36
|
+
};
|
|
37
|
+
export declare const sarifToMarkdown: (options: sarifFormatterOptions) => (sarifLog: Log) => sarifToMarkdownResult[];
|
|
38
|
+
export {};
|
package/lib/sarif-to-markdown.js
CHANGED
|
@@ -44,13 +44,15 @@ var createCodeURL = function (result, options) {
|
|
|
44
44
|
return [];
|
|
45
45
|
}
|
|
46
46
|
var lineNumber = physicalLocation.region.endLine !== undefined ? "L" + physicalLocation.region.startLine + "-" + physicalLocation.region.endLine : "L" + physicalLocation.region.startLine;
|
|
47
|
-
return url_join_1.default(githubHost, options.owner, options.repo, "
|
|
47
|
+
return url_join_1.default(githubHost, options.owner, options.repo, "blob/" + options.branch, options.sourceRoot, physicalLocation.artifactLocation.uri + "#" + lineNumber);
|
|
48
48
|
});
|
|
49
49
|
};
|
|
50
50
|
exports.sarifToMarkdown = function (options) {
|
|
51
51
|
return function (sarifLog) {
|
|
52
52
|
return sarifLog.runs.map(function (run) {
|
|
53
|
-
var _a, _b, _c;
|
|
53
|
+
var _a, _b, _c, _d, _e, _f, _g;
|
|
54
|
+
var title = options.title ? "# " + options.title + "\n" : "# Report";
|
|
55
|
+
var toolInfo = "\n## Tool information\n- Name: " + ((_a = run.tool.driver) === null || _a === void 0 ? void 0 : _a.name) + "\n- Organization: " + ((_b = run.tool.driver) === null || _b === void 0 ? void 0 : _b.organization) + "\n- Version: " + ((_c = run.tool.driver) === null || _c === void 0 ? void 0 : _c.semanticVersion) + "\n";
|
|
54
56
|
// # tool section
|
|
55
57
|
// Rule info
|
|
56
58
|
// Vulnerability info
|
|
@@ -59,27 +61,31 @@ exports.sarifToMarkdown = function (options) {
|
|
|
59
61
|
/**
|
|
60
62
|
* # Rule Info
|
|
61
63
|
*/
|
|
62
|
-
var ruleInfo = escapeMarkdown(templateObject_1 || (templateObject_1 = __makeTemplateObject(["
|
|
63
|
-
"\n "])),
|
|
64
|
-
var _a;
|
|
64
|
+
var ruleInfo = escapeMarkdown(templateObject_1 || (templateObject_1 = __makeTemplateObject(["\n## Rules information\n<!-- Rule Info -->\n<details><summary>Rules details</summary>\n\n", "\n "], ["\n## Rules information\n<!-- Rule Info -->\n<details><summary>Rules details</summary>\n\n",
|
|
65
|
+
"\n "])), (_e = (_d = run.tool.driver) === null || _d === void 0 ? void 0 : _d.rules) === null || _e === void 0 ? void 0 : _e.map(function (rule) {
|
|
66
|
+
var _a, _b;
|
|
67
|
+
var severity = rule.properties ? (_a = rule.properties) === null || _a === void 0 ? void 0 : _a["problem.severity"] : "";
|
|
65
68
|
// rule description
|
|
66
|
-
return "
|
|
69
|
+
return "- " + rule.id + " [" + severity + "]\n\n> " + ((_b = rule.shortDescription) === null || _b === void 0 ? void 0 : _b.text);
|
|
67
70
|
}));
|
|
68
|
-
var ruleDetails = "<details><summary>Details</summary>\n<pre>" + JSON.stringify(run.tool, null, 4) + "</pre></details
|
|
71
|
+
var ruleDetails = "<details><summary>Details</summary>\n<pre>" + JSON.stringify(run.tool, null, 4) + "</pre></details>\n";
|
|
69
72
|
/* Results
|
|
70
73
|
- rule id
|
|
71
74
|
- message
|
|
72
75
|
- vulnerability source location
|
|
76
|
+
|
|
77
|
+
If pass the scan, results is empty array
|
|
73
78
|
*/
|
|
74
|
-
var results = "\n## Results\n\n" + ((
|
|
79
|
+
var results = run.results && run.results.length > 0 ? "\n## Results\n\n" + ((_f = run.results) === null || _f === void 0 ? void 0 : _f.map(function (result) {
|
|
75
80
|
return "- **" + result.ruleId + "**: " + markdown_escape_1.default(result.message.text)
|
|
76
81
|
+ "\n\n"
|
|
77
82
|
+ createCodeURL(result, options).join("\n")
|
|
78
83
|
+ "\n";
|
|
79
|
-
}).join("\n")) + "\n"
|
|
84
|
+
}).join("\n")) + "\n"
|
|
85
|
+
: "\n## Results\n\nNo Error\n\n";
|
|
80
86
|
return {
|
|
81
|
-
|
|
82
|
-
|
|
87
|
+
body: title + results + "\n" + ruleInfo + "\n" + ruleDetails + toolInfo,
|
|
88
|
+
hasMessages: ((_g = run.results) === null || _g === void 0 ? void 0 : _g.length) !== 0
|
|
83
89
|
};
|
|
84
90
|
});
|
|
85
91
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sarif-to-markdown.js","sourceRoot":"","sources":["../src/sarif-to-markdown.ts"],"names":[],"mappings":";;;;;;;;;;AACA,aAAa;AACb,oEAAoC;
|
|
1
|
+
{"version":3,"file":"sarif-to-markdown.js","sourceRoot":"","sources":["../src/sarif-to-markdown.ts"],"names":[],"mappings":";;;;;;;;;;AACA,aAAa;AACb,oEAAoC;AACpC,sDAA+B;AAE/B,SAAS,cAAc,CAAC,OAA6B;IAAE,gBAAgB;SAAhB,UAAgB,EAAhB,qBAAgB,EAAhB,IAAgB;QAAhB,+BAAgB;;IACnE,OAAO,OAAO,CAAC,MAAM,CAAC,UAAC,MAAM,EAAE,GAAG,EAAE,CAAC;QACjC,IAAM,KAAK,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;YAC3B,OAAO,MAAM,GAAG,yBAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;SACvC;aAAM;YACH,OAAO,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;SACvC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAED,IAAM,aAAa,GAAG,UAAC,MAAc,EAAE,OAA8B;;IACjE,IAAM,UAAU,SAAG,OAAO,CAAC,UAAU,mCAAI,oBAAoB,CAAC;IAC9D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;QAClC,OAAO,EAAE,CAAC;KACb;IACD,aAAO,MAAM,CAAC,SAAS,0CAAE,OAAO,CAAC,UAAA,QAAQ;QACrC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE;YAC5B,OAAO,EAAE,CAAC;SACb;QACD,IAAM,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,CAAA;QAClD,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,EAAE;YACpC,OAAO,EAAE,CAAC;SACb;QACD,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE;YAC1B,OAAO,EAAE,CAAC;SACb;QACD,IAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAI,gBAAgB,CAAC,MAAM,CAAC,SAAS,SAAI,gBAAgB,CAAC,MAAM,CAAC,OAAS,CAAC,CAAC,CAAC,MAAI,gBAAgB,CAAC,MAAM,CAAC,SAAW,CAAC;QACxL,OAAO,kBAAO,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,UAAQ,OAAO,CAAC,MAAQ,EAAE,OAAO,CAAC,UAAU,EAAK,gBAAgB,CAAC,gBAAgB,CAAC,GAAG,SAAI,UAAY,CAAC,CAAC;IACpK,CAAC,EAAE;AAEP,CAAC,CAAA;AAuCY,QAAA,eAAe,GAAG,UAAC,OAA8B;IAC1D,OAAO,UAAC,QAAa;QACjB,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,UAAA,GAAG;;YACxB,IAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAK,OAAO,CAAC,KAAK,OAAI,CAAC,CAAC,CAAC,UAAU,CAAC;YAElE,IAAM,QAAQ,GAAG,2CAEnB,GAAG,CAAC,IAAI,CAAC,MAAM,0CAAE,IAAI,kCACb,GAAG,CAAC,IAAI,CAAC,MAAM,0CAAE,YAAY,6BAClC,GAAG,CAAC,IAAI,CAAC,MAAM,0CAAE,eAAe,QAC5C,CAAA;YACW,iBAAiB;YACjB,YAAY;YACZ,qBAAqB;YACrB,aAAa;YACb,YAAY;YACZ;;eAEG;YACH,IAAM,QAAQ,GAAG,cAAc,qKAAA,2FAKzC;gBAOW,KACX,iBARA,GAAG,CAAC,IAAI,CAAC,MAAM,0CAAE,KAAK,0CAAE,GAAG,CAAC,UAAA,IAAI;;gBACd,IAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,OAAC,IAAI,CAAC,UAAU,0CAAG,kBAAkB,EAAE,CAAC,CAAC,EAAE,CAAA;gBAC7E,mBAAmB;gBACnB,OAAO,OAAK,IAAI,CAAC,EAAE,UAAK,QAAQ,sBAEhD,IAAI,CAAC,gBAAgB,0CAAE,IAAI,CAAE,CAAA;YACjB,CAAC,EAEf,CAAC;YACS,IAAM,WAAW,GAAG,+CACzB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,uBACvC,CAAC;YAEU;;;;;;cAME;YACF,IAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,4BAGlE,GAAG,CAAC,OAAO,0CAAE,GAAG,CAAC,UAAA,MAAM;gBACL,OAAO,SAAO,MAAM,CAAC,MAAM,YAAO,yBAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAG;sBACzD,MAAM;sBACN,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;sBACzC,IAAI,CAAA;YACd,CAAC,EAAE,IAAI,CAAC,IAAI,SAC3B;gBACe,CAAC,CAAC,8BAKjB,CAAA;YACW,OAAO;gBACH,IAAI,EAAE,KAAK,GAAG,OAAO,GAAG,IAAI,GAAG,QAAQ,GAAE,IAAI,GAAG,WAAW,GAAG,QAAQ;gBACtE,WAAW,EAAE,OAAA,GAAG,CAAC,OAAO,0CAAE,MAAM,MAAK,CAAC;aACzC,CAAC;QACN,CAAC,CAAC,CAAC;IACP,CAAC,CAAA;AAEL,CAAC,CAAA"}
|
|
@@ -1,9 +1,12 @@
|
|
|
1
1
|
import type { Log } from "sarif";
|
|
2
|
-
export declare type sarifFormatterResult = {
|
|
3
|
-
title: string;
|
|
4
|
-
body: string;
|
|
5
|
-
};
|
|
6
2
|
export declare type sarifFormatterOptions = {
|
|
3
|
+
/**
|
|
4
|
+
* Title of content
|
|
5
|
+
*/
|
|
6
|
+
title?: string;
|
|
7
|
+
/**
|
|
8
|
+
* https://github.com
|
|
9
|
+
*/
|
|
7
10
|
githubHost?: string;
|
|
8
11
|
/**
|
|
9
12
|
* GitHub Owner
|
|
@@ -23,7 +26,13 @@ export declare type sarifFormatterOptions = {
|
|
|
23
26
|
*/
|
|
24
27
|
sourceRoot: string;
|
|
25
28
|
};
|
|
26
|
-
|
|
27
|
-
title
|
|
29
|
+
declare type sarifToMarkdownResult = {
|
|
30
|
+
title?: string;
|
|
28
31
|
body: string;
|
|
29
|
-
|
|
32
|
+
/**
|
|
33
|
+
* If the body has not results, `hasMessages` will be `false`
|
|
34
|
+
*/
|
|
35
|
+
hasMessages: boolean;
|
|
36
|
+
};
|
|
37
|
+
export declare const sarifToMarkdown: (options: sarifFormatterOptions) => (sarifLog: Log) => sarifToMarkdownResult[];
|
|
38
|
+
export {};
|
|
@@ -38,13 +38,15 @@ var createCodeURL = function (result, options) {
|
|
|
38
38
|
return [];
|
|
39
39
|
}
|
|
40
40
|
var lineNumber = physicalLocation.region.endLine !== undefined ? "L" + physicalLocation.region.startLine + "-" + physicalLocation.region.endLine : "L" + physicalLocation.region.startLine;
|
|
41
|
-
return urlJoin(githubHost, options.owner, options.repo, "
|
|
41
|
+
return urlJoin(githubHost, options.owner, options.repo, "blob/" + options.branch, options.sourceRoot, physicalLocation.artifactLocation.uri + "#" + lineNumber);
|
|
42
42
|
});
|
|
43
43
|
};
|
|
44
44
|
export var sarifToMarkdown = function (options) {
|
|
45
45
|
return function (sarifLog) {
|
|
46
46
|
return sarifLog.runs.map(function (run) {
|
|
47
|
-
var _a, _b, _c;
|
|
47
|
+
var _a, _b, _c, _d, _e, _f, _g;
|
|
48
|
+
var title = options.title ? "# " + options.title + "\n" : "# Report";
|
|
49
|
+
var toolInfo = "\n## Tool information\n- Name: " + ((_a = run.tool.driver) === null || _a === void 0 ? void 0 : _a.name) + "\n- Organization: " + ((_b = run.tool.driver) === null || _b === void 0 ? void 0 : _b.organization) + "\n- Version: " + ((_c = run.tool.driver) === null || _c === void 0 ? void 0 : _c.semanticVersion) + "\n";
|
|
48
50
|
// # tool section
|
|
49
51
|
// Rule info
|
|
50
52
|
// Vulnerability info
|
|
@@ -53,27 +55,31 @@ export var sarifToMarkdown = function (options) {
|
|
|
53
55
|
/**
|
|
54
56
|
* # Rule Info
|
|
55
57
|
*/
|
|
56
|
-
var ruleInfo = escapeMarkdown(templateObject_1 || (templateObject_1 = __makeTemplateObject(["
|
|
57
|
-
"\n "])),
|
|
58
|
-
var _a;
|
|
58
|
+
var ruleInfo = escapeMarkdown(templateObject_1 || (templateObject_1 = __makeTemplateObject(["\n## Rules information\n<!-- Rule Info -->\n<details><summary>Rules details</summary>\n\n", "\n "], ["\n## Rules information\n<!-- Rule Info -->\n<details><summary>Rules details</summary>\n\n",
|
|
59
|
+
"\n "])), (_e = (_d = run.tool.driver) === null || _d === void 0 ? void 0 : _d.rules) === null || _e === void 0 ? void 0 : _e.map(function (rule) {
|
|
60
|
+
var _a, _b;
|
|
61
|
+
var severity = rule.properties ? (_a = rule.properties) === null || _a === void 0 ? void 0 : _a["problem.severity"] : "";
|
|
59
62
|
// rule description
|
|
60
|
-
return "
|
|
63
|
+
return "- " + rule.id + " [" + severity + "]\n\n> " + ((_b = rule.shortDescription) === null || _b === void 0 ? void 0 : _b.text);
|
|
61
64
|
}));
|
|
62
|
-
var ruleDetails = "<details><summary>Details</summary>\n<pre>" + JSON.stringify(run.tool, null, 4) + "</pre></details
|
|
65
|
+
var ruleDetails = "<details><summary>Details</summary>\n<pre>" + JSON.stringify(run.tool, null, 4) + "</pre></details>\n";
|
|
63
66
|
/* Results
|
|
64
67
|
- rule id
|
|
65
68
|
- message
|
|
66
69
|
- vulnerability source location
|
|
70
|
+
|
|
71
|
+
If pass the scan, results is empty array
|
|
67
72
|
*/
|
|
68
|
-
var results = "\n## Results\n\n" + ((
|
|
73
|
+
var results = run.results && run.results.length > 0 ? "\n## Results\n\n" + ((_f = run.results) === null || _f === void 0 ? void 0 : _f.map(function (result) {
|
|
69
74
|
return "- **" + result.ruleId + "**: " + escape(result.message.text)
|
|
70
75
|
+ "\n\n"
|
|
71
76
|
+ createCodeURL(result, options).join("\n")
|
|
72
77
|
+ "\n";
|
|
73
|
-
}).join("\n")) + "\n"
|
|
78
|
+
}).join("\n")) + "\n"
|
|
79
|
+
: "\n## Results\n\nNo Error\n\n";
|
|
74
80
|
return {
|
|
75
|
-
|
|
76
|
-
|
|
81
|
+
body: title + results + "\n" + ruleInfo + "\n" + ruleDetails + toolInfo,
|
|
82
|
+
hasMessages: ((_g = run.results) === null || _g === void 0 ? void 0 : _g.length) !== 0
|
|
77
83
|
};
|
|
78
84
|
});
|
|
79
85
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sarif-to-markdown.js","sourceRoot":"","sources":["../src/sarif-to-markdown.ts"],"names":[],"mappings":";;;;AACA,aAAa;AACb,OAAO,MAAM,MAAM,iBAAiB,CAAA;
|
|
1
|
+
{"version":3,"file":"sarif-to-markdown.js","sourceRoot":"","sources":["../src/sarif-to-markdown.ts"],"names":[],"mappings":";;;;AACA,aAAa;AACb,OAAO,MAAM,MAAM,iBAAiB,CAAA;AACpC,OAAO,OAAO,MAAM,UAAU,CAAC;AAE/B,SAAS,cAAc,CAAC,OAA6B;IAAE,gBAAgB;SAAhB,UAAgB,EAAhB,qBAAgB,EAAhB,IAAgB;QAAhB,+BAAgB;;IACnE,OAAO,OAAO,CAAC,MAAM,CAAC,UAAC,MAAM,EAAE,GAAG,EAAE,CAAC;QACjC,IAAM,KAAK,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;YAC3B,OAAO,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;SACvC;aAAM;YACH,OAAO,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;SACvC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAED,IAAM,aAAa,GAAG,UAAC,MAAc,EAAE,OAA8B;;IACjE,IAAM,UAAU,SAAG,OAAO,CAAC,UAAU,mCAAI,oBAAoB,CAAC;IAC9D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;QAClC,OAAO,EAAE,CAAC;KACb;IACD,aAAO,MAAM,CAAC,SAAS,0CAAE,OAAO,CAAC,UAAA,QAAQ;QACrC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE;YAC5B,OAAO,EAAE,CAAC;SACb;QACD,IAAM,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,CAAA;QAClD,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,EAAE;YACpC,OAAO,EAAE,CAAC;SACb;QACD,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE;YAC1B,OAAO,EAAE,CAAC;SACb;QACD,IAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAI,gBAAgB,CAAC,MAAM,CAAC,SAAS,SAAI,gBAAgB,CAAC,MAAM,CAAC,OAAS,CAAC,CAAC,CAAC,MAAI,gBAAgB,CAAC,MAAM,CAAC,SAAW,CAAC;QACxL,OAAO,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,UAAQ,OAAO,CAAC,MAAQ,EAAE,OAAO,CAAC,UAAU,EAAK,gBAAgB,CAAC,gBAAgB,CAAC,GAAG,SAAI,UAAY,CAAC,CAAC;IACpK,CAAC,EAAE;AAEP,CAAC,CAAA;AAuCD,MAAM,CAAC,IAAM,eAAe,GAAG,UAAC,OAA8B;IAC1D,OAAO,UAAC,QAAa;QACjB,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,UAAA,GAAG;;YACxB,IAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAK,OAAO,CAAC,KAAK,OAAI,CAAC,CAAC,CAAC,UAAU,CAAC;YAElE,IAAM,QAAQ,GAAG,2CAEnB,GAAG,CAAC,IAAI,CAAC,MAAM,0CAAE,IAAI,kCACb,GAAG,CAAC,IAAI,CAAC,MAAM,0CAAE,YAAY,6BAClC,GAAG,CAAC,IAAI,CAAC,MAAM,0CAAE,eAAe,QAC5C,CAAA;YACW,iBAAiB;YACjB,YAAY;YACZ,qBAAqB;YACrB,aAAa;YACb,YAAY;YACZ;;eAEG;YACH,IAAM,QAAQ,GAAG,cAAc,qKAAA,2FAKzC;gBAOW,KACX,iBARA,GAAG,CAAC,IAAI,CAAC,MAAM,0CAAE,KAAK,0CAAE,GAAG,CAAC,UAAA,IAAI;;gBACd,IAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,OAAC,IAAI,CAAC,UAAU,0CAAG,kBAAkB,EAAE,CAAC,CAAC,EAAE,CAAA;gBAC7E,mBAAmB;gBACnB,OAAO,OAAK,IAAI,CAAC,EAAE,UAAK,QAAQ,sBAEhD,IAAI,CAAC,gBAAgB,0CAAE,IAAI,CAAE,CAAA;YACjB,CAAC,EAEf,CAAC;YACS,IAAM,WAAW,GAAG,+CACzB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,uBACvC,CAAC;YAEU;;;;;;cAME;YACF,IAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,4BAGlE,GAAG,CAAC,OAAO,0CAAE,GAAG,CAAC,UAAA,MAAM;gBACL,OAAO,SAAO,MAAM,CAAC,MAAM,YAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAG;sBACzD,MAAM;sBACN,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;sBACzC,IAAI,CAAA;YACd,CAAC,EAAE,IAAI,CAAC,IAAI,SAC3B;gBACe,CAAC,CAAC,8BAKjB,CAAA;YACW,OAAO;gBACH,IAAI,EAAE,KAAK,GAAG,OAAO,GAAG,IAAI,GAAG,QAAQ,GAAE,IAAI,GAAG,WAAW,GAAG,QAAQ;gBACtE,WAAW,EAAE,OAAA,GAAG,CAAC,OAAO,0CAAE,MAAM,MAAK,CAAC;aACzC,CAAC;QACN,CAAC,CAAC,CAAC;IACP,CAAC,CAAA;AAEL,CAAC,CAAA"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@security-alert/sarif-to-markdown",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.5.0",
|
|
4
4
|
"description": "Convert Sarif format to body text",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"sarif",
|
|
@@ -64,5 +64,5 @@
|
|
|
64
64
|
"publishConfig": {
|
|
65
65
|
"access": "public"
|
|
66
66
|
},
|
|
67
|
-
"gitHead": "
|
|
67
|
+
"gitHead": "0d5db77172579ca1726adc001e941f4bd294dbac"
|
|
68
68
|
}
|
package/CHANGELOG.md
DELETED
|
@@ -1,11 +0,0 @@
|
|
|
1
|
-
# Change Log
|
|
2
|
-
|
|
3
|
-
All notable changes to this project will be documented in this file.
|
|
4
|
-
See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
|
|
5
|
-
|
|
6
|
-
# [1.3.0](https://github.com/azu/security-alert/compare/v1.2.0...v1.3.0) (2020-08-04)
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
### Features
|
|
10
|
-
|
|
11
|
-
* add sarif packages ([c0831cd](https://github.com/azu/security-alert/commit/c0831cd1834e1f84ed721500cbe8db9523edc4eb))
|