[ADO:587]CxFlow: GH Action Updates
Feature 2. links + attack vector (captured in this FR)(Refer to CodeQL "Show Path" Link)
@@ -16,6 +16,7 @@ import lombok.extern.slf4j.Slf4j;
import org.springframework.stereotype.Service;
import java.util.*;
+import java.util.concurrent.atomic.AtomicInteger;
import java.util.stream.Collectors;
/**
@@ -178,9 +179,10 @@ public class SarifIssueTracker extends ImmutableIssueTracker {
.build())
.build()).collect(Collectors.toList());
//All issues to create the results/locations that are not all false positive
-
+ AtomicInteger count = new AtomicInteger();
filteredXIssues.forEach(
issue -> {
+ int i = count.getAndIncrement();
List<Location> locations = Lists.newArrayList();
issue.getDetails().forEach((k, v) -> {
if (!v.isFalsePositive()) {
@@ -188,21 +190,41 @@ public class SarifIssueTracker extends ImmutableIssueTracker {
.physicalLocation(PhysicalLocation.builder()
.artifactLocation(ArtifactLocation.builder()
.uri(issue.getFilename())
+ .uriBaseId("%SRCROOT%")
+ .index(i)
.build())
.region(Region.builder()
.startLine(k)
.endLine(k)
.build())
.build())
+ .message(Message.builder()
+ .text(v.getCodeSnippet()).build())
.build());
}
});
+ List<ThreadFlowLocation> threadFlowLocations = Lists.newArrayList();
+ locations.forEach(
+ location -> {
+ threadFlowLocations.add(ThreadFlowLocation.builder()
+ .location(location).build());
+ }
+ );
+
+ List<ThreadFlow> threadFlows = Lists.newArrayList();
+ threadFlows.add(ThreadFlow.builder()
+ .locations(threadFlowLocations).build());
+ List<CodeFlow> codeFlows = Lists.newArrayList();
+ codeFlows.add(CodeFlow.builder()
+ .threadFlows(threadFlows).build());
+
// Build collection of the results -> locations
sastScanresultList.add(
Result.builder()
.level(properties.getSeverityMap().get(issue.getSeverity()) != null ? properties.getSeverityMap().get(issue.getSeverity()) : DEFAULT_LEVEL)
.locations(locations)
+ .codeFlows(codeFlows)
.message(Message.builder()
.text(issue.getDescription())
.build())
@@ -346,6 +368,8 @@ public class SarifIssueTracker extends ImmutableIssueTracker {
private List<Location> locations;
@JsonProperty("partialFingerprints")
private PartialFingerprints partialFingerprints;
+ @JsonProperty("codeFlows")
+ private List<CodeFlow> codeFlows;
}
@Data
@@ -353,6 +377,8 @@ public class SarifIssueTracker extends ImmutableIssueTracker {
public static class Location {
@JsonProperty("physicalLocation")
public PhysicalLocation physicalLocation;
+ @JsonProperty("message")
+ public Message message;
}
@Data
@@ -360,6 +386,10 @@ public class SarifIssueTracker extends ImmutableIssueTracker {
public static class ArtifactLocation {
@JsonProperty("uri")
public String uri;
+ @JsonProperty("uriBaseId")
+ public String uriBaseId;
+ @JsonProperty("index")
+ public Integer index;
}
@Data
@@ -390,4 +420,26 @@ public class SarifIssueTracker extends ImmutableIssueTracker {
@JsonProperty("region")
public Region region;
}
+
+ @Data
+ @Builder
+ public static class CodeFlow {
+ @JsonProperty("threadFlows")
+ private List<ThreadFlow> threadFlows;
+ }
+
+ @Data
+ @Builder
+ public static class ThreadFlow {
+ @JsonProperty("locations")
+ private List<ThreadFlowLocation> locations;
+ }
+
+ @Data
+ @Builder
+ public static class ThreadFlowLocation {
+ @JsonProperty("location")
+ public Location location;
+ }
+
}
