snyk 1.809.0 → 1.813.0

package/README.md

@@ -168,7 +168,7 @@ snyk --help
 
 See the [full Snyk CLI help](./help/cli-commands).
 
-## Authorization
+## Authenticating Snyk CLI
 
 Snyk CLI depends on [Snyk.io](https://snyk.io) APIs. Connect your Snyk CLI with [Snyk.io](https://snyk.io) by running:
 
@@ -176,6 +176,12 @@ Snyk CLI depends on [Snyk.io](https://snyk.io) APIs. Connect your Snyk CLI with
 snyk auth
 ```
 
+## Setting up language support
+
+Depending on your project's language, you might need to setup your language environment before using Snyk.
+
+See our [Language Support documentation](https://support.snyk.io/hc/en-us/articles/360020352437-Language-support-summary).
+
 ## Scanning your project
 
 If you are already in a folder with a supported project, start by running:

package/dist/cli/293.index.js

@@ -1910,23 +1910,49 @@ function extractReportingDescriptor(results) {
         if (tool[issue.id]) {
             return;
         }
+        // custom rules may not have some of these fields so we check them first
+        const fullDescriptionText = issue.subType
+            ? `${upperFirst(issue.severity)} severity - ${issue.subType}`
+            : `${upperFirst(issue.severity)} severity`;
+        const issueText = issue.iacDescription.issue
+            ? `The issue is... \n${issue.iacDescription.issue}\n\n`
+            : '';
+        const issueMarkdown = issue.iacDescription.issue
+            ? `**The issue is...** \n${issue.iacDescription.issue}\n\n`
+            : '';
+        const impactText = issue.iacDescription.impact
+            ? ` The impact of this is... \n ${issue.iacDescription.impact}\n\n`
+            : '';
+        const impactMarkdown = issue.iacDescription.impact
+            ? ` **The impact of this is...** \n ${issue.iacDescription.impact}\n\n`
+            : '';
+        const resolveText = issue.iacDescription.resolve
+            ? ` You can resolve this by... \n${issue.iacDescription.resolve}`
+            : '';
+        const resolveMarkdown = issue.iacDescription.resolve
+            ? ` **You can resolve this by...** \n${issue.iacDescription.resolve}`
+            : '';
+        const tags = ['security'];
+        if (issue.subType) {
+            tags.push(issue.subType);
+        }
         tool[issue.id] = {
             id: issue.id,
             shortDescription: {
                 text: `${upperFirst(issue.severity)} severity - ${issue.title}`,
             },
             fullDescription: {
-                text: `${upperFirst(issue.severity)} severity - ${issue.subType}`,
+                text: fullDescriptionText,
             },
             help: {
-                text: `The issue is... \n${issue.iacDescription.issue}\n\n The impact of this is... \n ${issue.iacDescription.impact}\n\n You can resolve this by... \n${issue.iacDescription.resolve}`.replace(/^\s+/g, ''),
-                markdown: `**The issue is...** \n${issue.iacDescription.issue}\n\n **The impact of this is...** \n ${issue.iacDescription.impact}\n\n **You can resolve this by...** \n${issue.iacDescription.resolve}`.replace(/^\s+/g, ''),
+                text: `${issueText}${impactText}${resolveText}`.replace(/^\s+/g, ''),
+                markdown: `${issueMarkdown}${impactMarkdown}${resolveMarkdown}`.replace(/^\s+/g, ''),
             },
             defaultConfiguration: {
                 level: getIssueLevel(issue.severity),
             },
             properties: {
-                tags: ['security', `${issue.subType}`],
+                tags,
                 documentation: issue.documentation,
             },
         };
@@ -1937,10 +1963,14 @@ exports.extractReportingDescriptor = extractReportingDescriptor;
 function mapIacTestResponseToSarifResults(issues) {
     return issues.map(({ targetPath, issue }) => {
         const hasLineNumber = issue.lineNumber && issue.lineNumber >= 0;
+        // custom rules may not have some of these fields so we check them first
+        const affectingText = issue.subType
+            ? ` affecting the ${issue.subType}`
+            : '';
         return {
             ruleId: issue.id,
             message: {
-                text: `This line contains a potential ${issue.severity} severity misconfiguration affecting the ${issue.subType}`,
+                text: `This line contains a potential ${issue.severity} severity misconfiguration${affectingText}`,
             },
             locations: [
                 {