circle-ir-ai 2.7.1 → 2.7.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +21 -0
- package/package.json +2 -2
- package/dist/cli/args.d.ts +0 -86
- package/dist/cli/args.d.ts.map +0 -1
- package/dist/cli/args.js +0 -653
- package/dist/cli/args.js.map +0 -1
- package/dist/cli/colors.d.ts +0 -31
- package/dist/cli/colors.d.ts.map +0 -1
- package/dist/cli/colors.js +0 -80
- package/dist/cli/colors.js.map +0 -1
- package/dist/cli/commands/analyze-skill.d.ts +0 -33
- package/dist/cli/commands/analyze-skill.d.ts.map +0 -1
- package/dist/cli/commands/analyze-skill.js +0 -217
- package/dist/cli/commands/analyze-skill.js.map +0 -1
- package/dist/cli/commands/analyze.d.ts +0 -19
- package/dist/cli/commands/analyze.d.ts.map +0 -1
- package/dist/cli/commands/analyze.js +0 -303
- package/dist/cli/commands/analyze.js.map +0 -1
- package/dist/cli/commands/benchmark-runner.d.ts +0 -42
- package/dist/cli/commands/benchmark-runner.d.ts.map +0 -1
- package/dist/cli/commands/benchmark-runner.js +0 -18
- package/dist/cli/commands/benchmark-runner.js.map +0 -1
- package/dist/cli/commands/benchmark.d.ts +0 -11
- package/dist/cli/commands/benchmark.d.ts.map +0 -1
- package/dist/cli/commands/benchmark.js +0 -90
- package/dist/cli/commands/benchmark.js.map +0 -1
- package/dist/cli/commands/cluster.d.ts +0 -12
- package/dist/cli/commands/cluster.d.ts.map +0 -1
- package/dist/cli/commands/cluster.js +0 -203
- package/dist/cli/commands/cluster.js.map +0 -1
- package/dist/cli/commands/compare.d.ts +0 -13
- package/dist/cli/commands/compare.d.ts.map +0 -1
- package/dist/cli/commands/compare.js +0 -109
- package/dist/cli/commands/compare.js.map +0 -1
- package/dist/cli/commands/dead-code.d.ts +0 -11
- package/dist/cli/commands/dead-code.d.ts.map +0 -1
- package/dist/cli/commands/dead-code.js +0 -75
- package/dist/cli/commands/dead-code.js.map +0 -1
- package/dist/cli/commands/generate-spec.d.ts +0 -11
- package/dist/cli/commands/generate-spec.d.ts.map +0 -1
- package/dist/cli/commands/generate-spec.js +0 -120
- package/dist/cli/commands/generate-spec.js.map +0 -1
- package/dist/cli/commands/health.d.ts +0 -11
- package/dist/cli/commands/health.d.ts.map +0 -1
- package/dist/cli/commands/health.js +0 -76
- package/dist/cli/commands/health.js.map +0 -1
- package/dist/cli/commands/index.d.ts +0 -30
- package/dist/cli/commands/index.d.ts.map +0 -1
- package/dist/cli/commands/index.js +0 -36
- package/dist/cli/commands/index.js.map +0 -1
- package/dist/cli/commands/metrics.d.ts +0 -12
- package/dist/cli/commands/metrics.d.ts.map +0 -1
- package/dist/cli/commands/metrics.js +0 -231
- package/dist/cli/commands/metrics.js.map +0 -1
- package/dist/cli/commands/project.d.ts +0 -21
- package/dist/cli/commands/project.d.ts.map +0 -1
- package/dist/cli/commands/project.js +0 -92
- package/dist/cli/commands/project.js.map +0 -1
- package/dist/cli/commands/quality.d.ts +0 -15
- package/dist/cli/commands/quality.d.ts.map +0 -1
- package/dist/cli/commands/quality.js +0 -86
- package/dist/cli/commands/quality.js.map +0 -1
- package/dist/cli/commands/scan.d.ts +0 -11
- package/dist/cli/commands/scan.d.ts.map +0 -1
- package/dist/cli/commands/scan.js +0 -102
- package/dist/cli/commands/scan.js.map +0 -1
- package/dist/cli/commands/secrets.d.ts +0 -11
- package/dist/cli/commands/secrets.d.ts.map +0 -1
- package/dist/cli/commands/secrets.js +0 -79
- package/dist/cli/commands/secrets.js.map +0 -1
- package/dist/cli/commands/spec-diff.d.ts +0 -12
- package/dist/cli/commands/spec-diff.d.ts.map +0 -1
- package/dist/cli/commands/spec-diff.js +0 -150
- package/dist/cli/commands/spec-diff.js.map +0 -1
- package/dist/cli/commands/swarm.d.ts +0 -21
- package/dist/cli/commands/swarm.d.ts.map +0 -1
- package/dist/cli/commands/swarm.js +0 -175
- package/dist/cli/commands/swarm.js.map +0 -1
- package/dist/cli/commands/trust.d.ts +0 -23
- package/dist/cli/commands/trust.d.ts.map +0 -1
- package/dist/cli/commands/trust.js +0 -397
- package/dist/cli/commands/trust.js.map +0 -1
- package/dist/cli/commands/understand.d.ts +0 -12
- package/dist/cli/commands/understand.d.ts.map +0 -1
- package/dist/cli/commands/understand.js +0 -188
- package/dist/cli/commands/understand.js.map +0 -1
- package/dist/cli/config.d.ts +0 -161
- package/dist/cli/config.d.ts.map +0 -1
- package/dist/cli/config.js +0 -383
- package/dist/cli/config.js.map +0 -1
- package/dist/cli/discovery.d.ts +0 -31
- package/dist/cli/discovery.d.ts.map +0 -1
- package/dist/cli/discovery.js +0 -212
- package/dist/cli/discovery.js.map +0 -1
- package/dist/cli/effective-options.d.ts +0 -42
- package/dist/cli/effective-options.d.ts.map +0 -1
- package/dist/cli/effective-options.js +0 -80
- package/dist/cli/effective-options.js.map +0 -1
- package/dist/cli/file-collection.d.ts +0 -49
- package/dist/cli/file-collection.d.ts.map +0 -1
- package/dist/cli/file-collection.js +0 -142
- package/dist/cli/file-collection.js.map +0 -1
- package/dist/cli/formatters/index.d.ts +0 -15
- package/dist/cli/formatters/index.d.ts.map +0 -1
- package/dist/cli/formatters/index.js +0 -51
- package/dist/cli/formatters/index.js.map +0 -1
- package/dist/cli/formatters/json.d.ts +0 -11
- package/dist/cli/formatters/json.d.ts.map +0 -1
- package/dist/cli/formatters/json.js +0 -12
- package/dist/cli/formatters/json.js.map +0 -1
- package/dist/cli/formatters/project-json.d.ts +0 -11
- package/dist/cli/formatters/project-json.d.ts.map +0 -1
- package/dist/cli/formatters/project-json.js +0 -12
- package/dist/cli/formatters/project-json.js.map +0 -1
- package/dist/cli/formatters/project-sarif.d.ts +0 -11
- package/dist/cli/formatters/project-sarif.d.ts.map +0 -1
- package/dist/cli/formatters/project-sarif.js +0 -127
- package/dist/cli/formatters/project-sarif.js.map +0 -1
- package/dist/cli/formatters/project-summary.d.ts +0 -11
- package/dist/cli/formatters/project-summary.d.ts.map +0 -1
- package/dist/cli/formatters/project-summary.js +0 -202
- package/dist/cli/formatters/project-summary.js.map +0 -1
- package/dist/cli/formatters/sarif-shared.d.ts +0 -101
- package/dist/cli/formatters/sarif-shared.d.ts.map +0 -1
- package/dist/cli/formatters/sarif-shared.js +0 -57
- package/dist/cli/formatters/sarif-shared.js.map +0 -1
- package/dist/cli/formatters/sarif.d.ts +0 -12
- package/dist/cli/formatters/sarif.d.ts.map +0 -1
- package/dist/cli/formatters/sarif.js +0 -92
- package/dist/cli/formatters/sarif.js.map +0 -1
- package/dist/cli/formatters/summary.d.ts +0 -11
- package/dist/cli/formatters/summary.d.ts.map +0 -1
- package/dist/cli/formatters/summary.js +0 -240
- package/dist/cli/formatters/summary.js.map +0 -1
- package/dist/cli/formatters/two-phase-summary.d.ts +0 -11
- package/dist/cli/formatters/two-phase-summary.d.ts.map +0 -1
- package/dist/cli/formatters/two-phase-summary.js +0 -188
- package/dist/cli/formatters/two-phase-summary.js.map +0 -1
- package/dist/cli/index.d.ts +0 -10
- package/dist/cli/index.d.ts.map +0 -1
- package/dist/cli/index.js +0 -72
- package/dist/cli/index.js.map +0 -1
- package/dist/cli/program.d.ts +0 -117
- package/dist/cli/program.d.ts.map +0 -1
- package/dist/cli/program.js +0 -825
- package/dist/cli/program.js.map +0 -1
|
@@ -1,202 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Project Summary Formatter
|
|
3
|
-
*
|
|
4
|
-
* Outputs a human-readable summary of project-level analysis.
|
|
5
|
-
*/
|
|
6
|
-
/**
|
|
7
|
-
* Format project analysis as human-readable summary.
|
|
8
|
-
*/
|
|
9
|
-
export function formatProjectSummary(result) {
|
|
10
|
-
const lines = [];
|
|
11
|
-
// Header
|
|
12
|
-
lines.push('');
|
|
13
|
-
lines.push('═'.repeat(70));
|
|
14
|
-
lines.push(' Circle-IR Project Analysis Report');
|
|
15
|
-
lines.push('═'.repeat(70));
|
|
16
|
-
lines.push('');
|
|
17
|
-
// Project info
|
|
18
|
-
lines.push(`Project: ${result.meta.name}`);
|
|
19
|
-
lines.push(`Root: ${result.meta.root}`);
|
|
20
|
-
lines.push(`Language: ${result.meta.language}`);
|
|
21
|
-
if (result.meta.framework) {
|
|
22
|
-
lines.push(`Framework: ${result.meta.framework}${result.meta.framework_version ? ` ${result.meta.framework_version}` : ''}`);
|
|
23
|
-
}
|
|
24
|
-
lines.push(`Total Files: ${result.meta.total_files}`);
|
|
25
|
-
lines.push(`Total Lines: ${result.meta.total_loc}`);
|
|
26
|
-
lines.push(`Analyzed: ${result.meta.analyzed_at}`);
|
|
27
|
-
lines.push('');
|
|
28
|
-
// Type hierarchy summary
|
|
29
|
-
lines.push('─'.repeat(70));
|
|
30
|
-
lines.push('Type Hierarchy');
|
|
31
|
-
lines.push('─'.repeat(70));
|
|
32
|
-
const classCount = Object.keys(result.type_hierarchy.classes).length;
|
|
33
|
-
const interfaceCount = Object.keys(result.type_hierarchy.interfaces).length;
|
|
34
|
-
lines.push(` Classes: ${classCount}`);
|
|
35
|
-
lines.push(` Interfaces: ${interfaceCount}`);
|
|
36
|
-
// Show inheritance if any
|
|
37
|
-
const classesWithParent = Object.values(result.type_hierarchy.classes).filter(c => c.extends);
|
|
38
|
-
if (classesWithParent.length > 0) {
|
|
39
|
-
lines.push(` Classes with inheritance: ${classesWithParent.length}`);
|
|
40
|
-
}
|
|
41
|
-
const classesWithInterfaces = Object.values(result.type_hierarchy.classes).filter(c => c.implements.length > 0);
|
|
42
|
-
if (classesWithInterfaces.length > 0) {
|
|
43
|
-
lines.push(` Classes implementing interfaces: ${classesWithInterfaces.length}`);
|
|
44
|
-
}
|
|
45
|
-
lines.push('');
|
|
46
|
-
// Cross-file calls
|
|
47
|
-
lines.push('─'.repeat(70));
|
|
48
|
-
lines.push('Cross-File Dependencies');
|
|
49
|
-
lines.push('─'.repeat(70));
|
|
50
|
-
if (result.cross_file_calls.length === 0) {
|
|
51
|
-
lines.push(' No cross-file calls detected');
|
|
52
|
-
}
|
|
53
|
-
else {
|
|
54
|
-
lines.push(` Total cross-file calls: ${result.cross_file_calls.length}`);
|
|
55
|
-
// Group by caller file
|
|
56
|
-
const byCallerFile = groupBy(result.cross_file_calls, c => c.from.file);
|
|
57
|
-
const topCallers = Object.entries(byCallerFile)
|
|
58
|
-
.sort((a, b) => b[1].length - a[1].length)
|
|
59
|
-
.slice(0, 5);
|
|
60
|
-
if (topCallers.length > 0) {
|
|
61
|
-
lines.push(' Top files making external calls:');
|
|
62
|
-
for (const [file, calls] of topCallers) {
|
|
63
|
-
lines.push(` - ${file}: ${calls.length} call(s)`);
|
|
64
|
-
}
|
|
65
|
-
}
|
|
66
|
-
}
|
|
67
|
-
lines.push('');
|
|
68
|
-
// Taint analysis summary
|
|
69
|
-
lines.push('─'.repeat(70));
|
|
70
|
-
lines.push('Taint Analysis');
|
|
71
|
-
lines.push('─'.repeat(70));
|
|
72
|
-
// Count sources and sinks across files
|
|
73
|
-
let totalSources = 0;
|
|
74
|
-
let totalSinks = 0;
|
|
75
|
-
for (const file of result.files) {
|
|
76
|
-
totalSources += file.analysis.taint.sources.length;
|
|
77
|
-
totalSinks += file.analysis.taint.sinks.length;
|
|
78
|
-
}
|
|
79
|
-
lines.push(` Total sources: ${totalSources}`);
|
|
80
|
-
lines.push(` Total sinks: ${totalSinks}`);
|
|
81
|
-
lines.push(` Cross-file taint paths: ${result.taint_paths.length}`);
|
|
82
|
-
lines.push('');
|
|
83
|
-
// Taint paths detail
|
|
84
|
-
if (result.taint_paths.length > 0) {
|
|
85
|
-
lines.push('─'.repeat(70));
|
|
86
|
-
lines.push('Cross-File Taint Paths');
|
|
87
|
-
lines.push('─'.repeat(70));
|
|
88
|
-
for (const path of result.taint_paths.slice(0, 10)) {
|
|
89
|
-
lines.push(formatTaintPath(path));
|
|
90
|
-
}
|
|
91
|
-
if (result.taint_paths.length > 10) {
|
|
92
|
-
lines.push(` ... and ${result.taint_paths.length - 10} more path(s)`);
|
|
93
|
-
}
|
|
94
|
-
lines.push('');
|
|
95
|
-
}
|
|
96
|
-
// Findings
|
|
97
|
-
lines.push('─'.repeat(70));
|
|
98
|
-
lines.push('Security Findings');
|
|
99
|
-
lines.push('─'.repeat(70));
|
|
100
|
-
if (result.findings.length === 0) {
|
|
101
|
-
lines.push(' No security findings');
|
|
102
|
-
}
|
|
103
|
-
else {
|
|
104
|
-
// Group by severity
|
|
105
|
-
const bySeverity = groupBy(result.findings, f => f.severity);
|
|
106
|
-
const critical = bySeverity['critical'] || [];
|
|
107
|
-
const high = bySeverity['high'] || [];
|
|
108
|
-
const medium = bySeverity['medium'] || [];
|
|
109
|
-
const low = bySeverity['low'] || [];
|
|
110
|
-
lines.push(` Critical: ${critical.length}`);
|
|
111
|
-
lines.push(` High: ${high.length}`);
|
|
112
|
-
lines.push(` Medium: ${medium.length}`);
|
|
113
|
-
lines.push(` Low: ${low.length}`);
|
|
114
|
-
lines.push('');
|
|
115
|
-
// Show findings
|
|
116
|
-
for (const finding of result.findings.slice(0, 15)) {
|
|
117
|
-
lines.push(formatFinding(finding));
|
|
118
|
-
}
|
|
119
|
-
if (result.findings.length > 15) {
|
|
120
|
-
lines.push(` ... and ${result.findings.length - 15} more finding(s)`);
|
|
121
|
-
}
|
|
122
|
-
}
|
|
123
|
-
lines.push('');
|
|
124
|
-
// Per-file summary
|
|
125
|
-
lines.push('─'.repeat(70));
|
|
126
|
-
lines.push('Per-File Summary');
|
|
127
|
-
lines.push('─'.repeat(70));
|
|
128
|
-
// Sort files by number of sinks (most vulnerable first)
|
|
129
|
-
const filesBySinks = [...result.files].sort((a, b) => b.analysis.taint.sinks.length - a.analysis.taint.sinks.length);
|
|
130
|
-
for (const file of filesBySinks.slice(0, 10)) {
|
|
131
|
-
const sources = file.analysis.taint.sources.length;
|
|
132
|
-
const sinks = file.analysis.taint.sinks.length;
|
|
133
|
-
if (sources > 0 || sinks > 0) {
|
|
134
|
-
lines.push(` ${file.file}: ${sources} source(s), ${sinks} sink(s)`);
|
|
135
|
-
}
|
|
136
|
-
}
|
|
137
|
-
if (filesBySinks.length > 10) {
|
|
138
|
-
const remaining = filesBySinks.slice(10).filter(f => f.analysis.taint.sources.length > 0 || f.analysis.taint.sinks.length > 0);
|
|
139
|
-
if (remaining.length > 0) {
|
|
140
|
-
lines.push(` ... and ${remaining.length} more file(s) with findings`);
|
|
141
|
-
}
|
|
142
|
-
}
|
|
143
|
-
lines.push('');
|
|
144
|
-
// Summary
|
|
145
|
-
lines.push('═'.repeat(70));
|
|
146
|
-
lines.push(`Summary: ${result.meta.total_files} files, ${result.findings.length} findings, ${result.taint_paths.length} taint paths`);
|
|
147
|
-
lines.push('═'.repeat(70));
|
|
148
|
-
lines.push('');
|
|
149
|
-
return lines.join('\n');
|
|
150
|
-
}
|
|
151
|
-
/**
|
|
152
|
-
* Format a single taint path.
|
|
153
|
-
*/
|
|
154
|
-
function formatTaintPath(path) {
|
|
155
|
-
const sanitized = path.sanitizers_in_path.length > 0 ? ' [SANITIZED]' : '';
|
|
156
|
-
const confidence = Math.round(path.confidence * 100);
|
|
157
|
-
return ` [${path.sink.cwe}] ${path.source.file}:${path.source.line} → ${path.sink.file}:${path.sink.line}${sanitized} (${confidence}% confidence)
|
|
158
|
-
Source: ${path.source.type} - ${path.source.code || 'N/A'}
|
|
159
|
-
Sink: ${path.sink.type} - ${path.sink.code || 'N/A'}`;
|
|
160
|
-
}
|
|
161
|
-
/**
|
|
162
|
-
* Format a single finding.
|
|
163
|
-
*/
|
|
164
|
-
function formatFinding(finding) {
|
|
165
|
-
const severity = formatSeverity(finding.severity);
|
|
166
|
-
const exploitable = finding.exploitable ? ' [EXPLOITABLE]' : '';
|
|
167
|
-
return ` ${severity} [${finding.cwe}] ${finding.type}${exploitable}
|
|
168
|
-
Source: ${finding.source.file}:${finding.source.line}
|
|
169
|
-
Sink: ${finding.sink.file}:${finding.sink.line}
|
|
170
|
-
${finding.explanation}`;
|
|
171
|
-
}
|
|
172
|
-
/**
|
|
173
|
-
* Format severity with indicator.
|
|
174
|
-
*/
|
|
175
|
-
function formatSeverity(severity) {
|
|
176
|
-
switch (severity) {
|
|
177
|
-
case 'critical':
|
|
178
|
-
return '[!!!!]';
|
|
179
|
-
case 'high':
|
|
180
|
-
return '[!!! ]';
|
|
181
|
-
case 'medium':
|
|
182
|
-
return '[!! ]';
|
|
183
|
-
case 'low':
|
|
184
|
-
return '[! ]';
|
|
185
|
-
default:
|
|
186
|
-
return '[ ]';
|
|
187
|
-
}
|
|
188
|
-
}
|
|
189
|
-
/**
|
|
190
|
-
* Group array by key function.
|
|
191
|
-
*/
|
|
192
|
-
function groupBy(array, keyFn) {
|
|
193
|
-
return array.reduce((result, item) => {
|
|
194
|
-
const key = keyFn(item);
|
|
195
|
-
if (!result[key]) {
|
|
196
|
-
result[key] = [];
|
|
197
|
-
}
|
|
198
|
-
result[key].push(item);
|
|
199
|
-
return result;
|
|
200
|
-
}, {});
|
|
201
|
-
}
|
|
202
|
-
//# sourceMappingURL=project-summary.js.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"project-summary.js","sourceRoot":"","sources":["../../../src/cli/formatters/project-summary.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAuB;IAC1D,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,SAAS;IACT,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAClD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,eAAe;IACf,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/H,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACtD,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACpD,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACnD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,yBAAyB;IACzB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC7B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IACrE,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;IAC5E,KAAK,CAAC,IAAI,CAAC,cAAc,UAAU,EAAE,CAAC,CAAC;IACvC,KAAK,CAAC,IAAI,CAAC,iBAAiB,cAAc,EAAE,CAAC,CAAC;IAE9C,0BAA0B;IAC1B,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC9F,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,+BAA+B,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAChH,IAAI,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,sCAAsC,qBAAqB,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,mBAAmB;IACnB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACtC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,6BAA6B,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;QAE1E,uBAAuB;QACvB,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxE,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;aAC5C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;aACzC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAEf,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YACjD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;gBACvC,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,KAAK,CAAC,MAAM,UAAU,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,yBAAyB;IACzB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC7B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAE3B,uCAAuC;IACvC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,YAAY,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACnD,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,oBAAoB,YAAY,EAAE,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,kBAAkB,UAAU,EAAE,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,6BAA6B,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;IACrE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,qBAAqB;IACrB,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAE3B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YACnD,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,EAAE,eAAe,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,WAAW;IACX,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAChC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAE3B,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACvC,CAAC;SAAM,CAAC;QACN,oBAAoB;QACpB,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAE7D,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAEpC,KAAK,CAAC,IAAI,CAAC,eAAe,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEf,gBAAgB;QAChB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YACnD,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,mBAAmB;IACnB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC/B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAE3B,wDAAwD;IACxD,MAAM,YAAY,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CACzC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CACxE,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;QAC/C,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,eAAe,KAAK,UAAU,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,CAC7C,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAC9E,CAAC;QACF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,aAAa,SAAS,CAAC,MAAM,6BAA6B,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,UAAU;IACV,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,IAAI,CAAC,WAAW,WAAW,MAAM,CAAC,QAAQ,CAAC,MAAM,cAAc,MAAM,CAAC,WAAW,CAAC,MAAM,cAAc,CAAC,CAAC;IACtI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,IAAe;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;IAErD,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,SAAS,KAAK,UAAU;cACxH,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK;YACjD,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC;AAC1D,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,OAAgB;IACrC,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;IAEhE,OAAO,KAAK,QAAQ,KAAK,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,IAAI,GAAG,WAAW;cACvD,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI;YAC5C,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI;MAC5C,OAAO,CAAC,WAAW,EAAE,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,QAAgB;IACtC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,QAAQ,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,QAAQ,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,KAAK;YACR,OAAO,QAAQ,CAAC;QAClB;YACE,OAAO,QAAQ,CAAC;IACpB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,OAAO,CAAI,KAAU,EAAE,KAA0B;IACxD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;QACnC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QACnB,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,OAAO,MAAM,CAAC;IAChB,CAAC,EAAE,EAAyB,CAAC,CAAC;AAChC,CAAC"}
|
|
@@ -1,101 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Shared SARIF types and utilities
|
|
3
|
-
*
|
|
4
|
-
* Common interfaces and functions used by both sarif.ts and project-sarif.ts formatters.
|
|
5
|
-
*/
|
|
6
|
-
export interface SarifLog {
|
|
7
|
-
$schema: string;
|
|
8
|
-
version: string;
|
|
9
|
-
runs: SarifRun[];
|
|
10
|
-
}
|
|
11
|
-
export interface SarifRun {
|
|
12
|
-
tool: {
|
|
13
|
-
driver: {
|
|
14
|
-
name: string;
|
|
15
|
-
version: string;
|
|
16
|
-
informationUri: string;
|
|
17
|
-
rules: SarifRule[];
|
|
18
|
-
};
|
|
19
|
-
};
|
|
20
|
-
results: SarifResult[];
|
|
21
|
-
}
|
|
22
|
-
export interface SarifRule {
|
|
23
|
-
id: string;
|
|
24
|
-
name: string;
|
|
25
|
-
shortDescription: {
|
|
26
|
-
text: string;
|
|
27
|
-
};
|
|
28
|
-
fullDescription: {
|
|
29
|
-
text: string;
|
|
30
|
-
};
|
|
31
|
-
help: {
|
|
32
|
-
text: string;
|
|
33
|
-
};
|
|
34
|
-
properties: {
|
|
35
|
-
tags: string[];
|
|
36
|
-
security_severity: string;
|
|
37
|
-
};
|
|
38
|
-
}
|
|
39
|
-
export interface SarifResult {
|
|
40
|
-
ruleId: string;
|
|
41
|
-
level: 'error' | 'warning' | 'note';
|
|
42
|
-
message: {
|
|
43
|
-
text: string;
|
|
44
|
-
};
|
|
45
|
-
locations: SarifLocation[];
|
|
46
|
-
codeFlows?: SarifCodeFlow[];
|
|
47
|
-
}
|
|
48
|
-
export interface SarifLocation {
|
|
49
|
-
physicalLocation: {
|
|
50
|
-
artifactLocation: {
|
|
51
|
-
uri: string;
|
|
52
|
-
};
|
|
53
|
-
region: {
|
|
54
|
-
startLine: number;
|
|
55
|
-
};
|
|
56
|
-
};
|
|
57
|
-
}
|
|
58
|
-
export interface SarifCodeFlow {
|
|
59
|
-
threadFlows: SarifThreadFlow[];
|
|
60
|
-
}
|
|
61
|
-
export interface SarifThreadFlow {
|
|
62
|
-
locations: SarifThreadFlowLocation[];
|
|
63
|
-
}
|
|
64
|
-
export interface SarifThreadFlowLocation {
|
|
65
|
-
location: SarifLocation;
|
|
66
|
-
state?: Record<string, string>;
|
|
67
|
-
}
|
|
68
|
-
export interface RuleInfo {
|
|
69
|
-
name: string;
|
|
70
|
-
shortDescription: string;
|
|
71
|
-
fullDescription: string;
|
|
72
|
-
remediation: string;
|
|
73
|
-
severity: string;
|
|
74
|
-
severityLevel: string;
|
|
75
|
-
}
|
|
76
|
-
/**
|
|
77
|
-
* Get rule information for a vulnerability type.
|
|
78
|
-
* Delegates to the central rules module for consistent definitions.
|
|
79
|
-
*/
|
|
80
|
-
export declare function getRuleInfo(type: string, _cwe: string): RuleInfo;
|
|
81
|
-
/**
|
|
82
|
-
* Convert severity level to SARIF level.
|
|
83
|
-
*/
|
|
84
|
-
export declare function getSarifLevel(severity: string): 'error' | 'warning' | 'note';
|
|
85
|
-
/**
|
|
86
|
-
* SARIF schema URL.
|
|
87
|
-
*/
|
|
88
|
-
export declare const SARIF_SCHEMA = "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json";
|
|
89
|
-
/**
|
|
90
|
-
* SARIF version.
|
|
91
|
-
*/
|
|
92
|
-
export declare const SARIF_VERSION = "2.1.0";
|
|
93
|
-
/**
|
|
94
|
-
* Tool information.
|
|
95
|
-
*/
|
|
96
|
-
export declare const TOOL_INFO: {
|
|
97
|
-
name: string;
|
|
98
|
-
version: string;
|
|
99
|
-
informationUri: string;
|
|
100
|
-
};
|
|
101
|
-
//# sourceMappingURL=sarif-shared.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"sarif-shared.d.ts","sourceRoot":"","sources":["../../../src/cli/formatters/sarif-shared.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,QAAQ,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE;QACJ,MAAM,EAAE;YACN,IAAI,EAAE,MAAM,CAAC;YACb,OAAO,EAAE,MAAM,CAAC;YAChB,cAAc,EAAE,MAAM,CAAC;YACvB,KAAK,EAAE,SAAS,EAAE,CAAC;SACpB,CAAC;KACH,CAAC;IACF,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,eAAe,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvB,UAAU,EAAE;QACV,IAAI,EAAE,MAAM,EAAE,CAAC;QACf,iBAAiB,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACpC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,aAAa,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,gBAAgB,EAAE;QAChB,gBAAgB,EAAE;YAChB,GAAG,EAAE,MAAM,CAAC;SACb,CAAC;QACF,MAAM,EAAE;YACN,SAAS,EAAE,MAAM,CAAC;SACnB,CAAC;KACH,CAAC;CACH;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,eAAe,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,uBAAuB,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,aAAa,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAMD,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,CAUhE;AAMD;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAY5E;AAED;;GAEG;AACH,eAAO,MAAM,YAAY,mGAAmG,CAAC;AAE7H;;GAEG;AACH,eAAO,MAAM,aAAa,UAAU,CAAC;AAErC;;GAEG;AACH,eAAO,MAAM,SAAS;;;;CAIrB,CAAC"}
|
|
@@ -1,57 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Shared SARIF types and utilities
|
|
3
|
-
*
|
|
4
|
-
* Common interfaces and functions used by both sarif.ts and project-sarif.ts formatters.
|
|
5
|
-
*/
|
|
6
|
-
import { getRuleInfo as getCoreRuleInfo } from 'circle-ir';
|
|
7
|
-
/**
|
|
8
|
-
* Get rule information for a vulnerability type.
|
|
9
|
-
* Delegates to the central rules module for consistent definitions.
|
|
10
|
-
*/
|
|
11
|
-
export function getRuleInfo(type, _cwe) {
|
|
12
|
-
const coreRule = getCoreRuleInfo(type);
|
|
13
|
-
return {
|
|
14
|
-
name: coreRule.name,
|
|
15
|
-
shortDescription: coreRule.shortDescription,
|
|
16
|
-
fullDescription: coreRule.fullDescription,
|
|
17
|
-
remediation: coreRule.remediation,
|
|
18
|
-
severity: coreRule.cvssScore,
|
|
19
|
-
severityLevel: coreRule.severityLevel,
|
|
20
|
-
};
|
|
21
|
-
}
|
|
22
|
-
// ============================================================================
|
|
23
|
-
// Utility Functions
|
|
24
|
-
// ============================================================================
|
|
25
|
-
/**
|
|
26
|
-
* Convert severity level to SARIF level.
|
|
27
|
-
*/
|
|
28
|
-
export function getSarifLevel(severity) {
|
|
29
|
-
switch (severity) {
|
|
30
|
-
case 'critical':
|
|
31
|
-
case 'high':
|
|
32
|
-
return 'error';
|
|
33
|
-
case 'medium':
|
|
34
|
-
return 'warning';
|
|
35
|
-
case 'low':
|
|
36
|
-
return 'note';
|
|
37
|
-
default:
|
|
38
|
-
return 'warning';
|
|
39
|
-
}
|
|
40
|
-
}
|
|
41
|
-
/**
|
|
42
|
-
* SARIF schema URL.
|
|
43
|
-
*/
|
|
44
|
-
export const SARIF_SCHEMA = 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json';
|
|
45
|
-
/**
|
|
46
|
-
* SARIF version.
|
|
47
|
-
*/
|
|
48
|
-
export const SARIF_VERSION = '2.1.0';
|
|
49
|
-
/**
|
|
50
|
-
* Tool information.
|
|
51
|
-
*/
|
|
52
|
-
export const TOOL_INFO = {
|
|
53
|
-
name: 'circle-ir',
|
|
54
|
-
version: '1.0.0',
|
|
55
|
-
informationUri: 'https://github.com/anthropics/circle-ir',
|
|
56
|
-
};
|
|
57
|
-
//# sourceMappingURL=sarif-shared.js.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"sarif-shared.js","sourceRoot":"","sources":["../../../src/cli/formatters/sarif-shared.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,IAAI,eAAe,EAAiC,MAAM,WAAW,CAAC;AAiF1F;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,IAAY;IACpD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,QAAQ,EAAE,QAAQ,CAAC,SAAS;QAC5B,aAAa,EAAE,QAAQ,CAAC,aAAa;KACtC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,OAAO,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC;QACnB,KAAK,KAAK;YACR,OAAO,MAAM,CAAC;QAChB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,gGAAgG,CAAC;AAE7H;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AAErC;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,IAAI,EAAE,WAAW;IACjB,OAAO,EAAE,OAAO;IAChB,cAAc,EAAE,yCAAyC;CAC1D,CAAC"}
|
|
@@ -1,12 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* SARIF Formatter
|
|
3
|
-
*
|
|
4
|
-
* Outputs analysis results in SARIF (Static Analysis Results Interchange Format).
|
|
5
|
-
* https://sarifweb.azurewebsites.net/
|
|
6
|
-
*/
|
|
7
|
-
import type { CircleIR } from 'circle-ir';
|
|
8
|
-
/**
|
|
9
|
-
* Format result as SARIF.
|
|
10
|
-
*/
|
|
11
|
-
export declare function formatSarif(result: CircleIR, filePath: string): string;
|
|
12
|
-
//# sourceMappingURL=sarif.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"sarif.d.ts","sourceRoot":"","sources":["../../../src/cli/formatters/sarif.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAa,MAAM,WAAW,CAAC;AAYrD;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAqBtE"}
|
|
@@ -1,92 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* SARIF Formatter
|
|
3
|
-
*
|
|
4
|
-
* Outputs analysis results in SARIF (Static Analysis Results Interchange Format).
|
|
5
|
-
* https://sarifweb.azurewebsites.net/
|
|
6
|
-
*/
|
|
7
|
-
import { getRuleInfo, getSarifLevel, SARIF_SCHEMA, SARIF_VERSION, TOOL_INFO, } from './sarif-shared.js';
|
|
8
|
-
/**
|
|
9
|
-
* Format result as SARIF.
|
|
10
|
-
*/
|
|
11
|
-
export function formatSarif(result, filePath) {
|
|
12
|
-
const rules = buildRules(result.taint.sinks);
|
|
13
|
-
const results = buildResults(result, filePath);
|
|
14
|
-
const sarif = {
|
|
15
|
-
$schema: SARIF_SCHEMA,
|
|
16
|
-
version: SARIF_VERSION,
|
|
17
|
-
runs: [
|
|
18
|
-
{
|
|
19
|
-
tool: {
|
|
20
|
-
driver: {
|
|
21
|
-
...TOOL_INFO,
|
|
22
|
-
rules,
|
|
23
|
-
},
|
|
24
|
-
},
|
|
25
|
-
results,
|
|
26
|
-
},
|
|
27
|
-
],
|
|
28
|
-
};
|
|
29
|
-
return JSON.stringify(sarif, null, 2);
|
|
30
|
-
}
|
|
31
|
-
/**
|
|
32
|
-
* Build SARIF rules from detected sink types.
|
|
33
|
-
*/
|
|
34
|
-
function buildRules(sinks) {
|
|
35
|
-
const ruleMap = new Map();
|
|
36
|
-
for (const sink of sinks) {
|
|
37
|
-
if (!ruleMap.has(sink.type)) {
|
|
38
|
-
ruleMap.set(sink.type, buildRule(sink));
|
|
39
|
-
}
|
|
40
|
-
}
|
|
41
|
-
return Array.from(ruleMap.values());
|
|
42
|
-
}
|
|
43
|
-
/**
|
|
44
|
-
* Build a SARIF rule from a sink type.
|
|
45
|
-
*/
|
|
46
|
-
function buildRule(sink) {
|
|
47
|
-
const ruleInfo = getRuleInfo(sink.type, sink.cwe);
|
|
48
|
-
return {
|
|
49
|
-
id: sink.cwe,
|
|
50
|
-
name: ruleInfo.name,
|
|
51
|
-
shortDescription: { text: ruleInfo.shortDescription },
|
|
52
|
-
fullDescription: { text: ruleInfo.fullDescription },
|
|
53
|
-
help: { text: ruleInfo.remediation },
|
|
54
|
-
properties: {
|
|
55
|
-
tags: ['security', sink.type],
|
|
56
|
-
security_severity: ruleInfo.severity,
|
|
57
|
-
},
|
|
58
|
-
};
|
|
59
|
-
}
|
|
60
|
-
/**
|
|
61
|
-
* Build SARIF results from analysis.
|
|
62
|
-
*/
|
|
63
|
-
function buildResults(result, filePath) {
|
|
64
|
-
const results = [];
|
|
65
|
-
// If we have sources and sinks, report potential vulnerabilities
|
|
66
|
-
if (result.taint.sources.length > 0) {
|
|
67
|
-
for (const sink of result.taint.sinks) {
|
|
68
|
-
const ruleInfo = getRuleInfo(sink.type, sink.cwe);
|
|
69
|
-
results.push({
|
|
70
|
-
ruleId: sink.cwe,
|
|
71
|
-
level: getSarifLevel(ruleInfo.severityLevel),
|
|
72
|
-
message: {
|
|
73
|
-
text: `Potential ${ruleInfo.name}: ${sink.location}. User-controlled data may reach this sink.`,
|
|
74
|
-
},
|
|
75
|
-
locations: [
|
|
76
|
-
{
|
|
77
|
-
physicalLocation: {
|
|
78
|
-
artifactLocation: {
|
|
79
|
-
uri: filePath,
|
|
80
|
-
},
|
|
81
|
-
region: {
|
|
82
|
-
startLine: sink.line,
|
|
83
|
-
},
|
|
84
|
-
},
|
|
85
|
-
},
|
|
86
|
-
],
|
|
87
|
-
});
|
|
88
|
-
}
|
|
89
|
-
}
|
|
90
|
-
return results;
|
|
91
|
-
}
|
|
92
|
-
//# sourceMappingURL=sarif.js.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../../../src/cli/formatters/sarif.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAIL,WAAW,EACX,aAAa,EACb,YAAY,EACZ,aAAa,EACb,SAAS,GACV,MAAM,mBAAmB,CAAC;AAE3B;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,MAAgB,EAAE,QAAgB;IAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAE/C,MAAM,KAAK,GAAa;QACtB,OAAO,EAAE,YAAY;QACrB,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,GAAG,SAAS;wBACZ,KAAK;qBACN;iBACF;gBACD,OAAO;aACR;SACF;KACF,CAAC;IAEF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,KAAkB;IACpC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;IAE7C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,IAAe;IAChC,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAElD,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,GAAG;QACZ,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,gBAAgB,EAAE;QACrD,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,eAAe,EAAE;QACnD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE;QACpC,UAAU,EAAE;YACV,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC;YAC7B,iBAAiB,EAAE,QAAQ,CAAC,QAAQ;SACrC;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,MAAgB,EAAE,QAAgB;IACtD,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,iEAAiE;IACjE,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAElD,OAAO,CAAC,IAAI,CAAC;gBACX,MAAM,EAAE,IAAI,CAAC,GAAG;gBAChB,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAC5C,OAAO,EAAE;oBACP,IAAI,EAAE,aAAa,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ,6CAA6C;iBAChG;gBACD,SAAS,EAAE;oBACT;wBACE,gBAAgB,EAAE;4BAChB,gBAAgB,EAAE;gCAChB,GAAG,EAAE,QAAQ;6BACd;4BACD,MAAM,EAAE;gCACN,SAAS,EAAE,IAAI,CAAC,IAAI;6BACrB;yBACF;qBACF;iBACF;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
|
|
@@ -1,11 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Summary Formatter
|
|
3
|
-
*
|
|
4
|
-
* Outputs a human-readable summary of the analysis.
|
|
5
|
-
*/
|
|
6
|
-
import type { CircleIR } from 'circle-ir';
|
|
7
|
-
/**
|
|
8
|
-
* Format result as human-readable summary.
|
|
9
|
-
*/
|
|
10
|
-
export declare function formatSummary(result: CircleIR, filePath: string): string;
|
|
11
|
-
//# sourceMappingURL=summary.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"summary.d.ts","sourceRoot":"","sources":["../../../src/cli/formatters/summary.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAA0B,MAAM,WAAW,CAAC;AAIlE;;GAEG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CA0KxE"}
|