Function Sarif

cmd/format/sarif.go:81–143

(report Report, out string)

}

func Sarif(report Report, out string) {

	s := sarifReport{
		Version: "2.1.0",
		Schema:  "https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0.json",
	}

	run := sarifRun{}
	run.Tool.Driver.Name = "opensca-cli"
	run.Tool.Driver.Version = strings.TrimLeft(report.TaskInfo.ToolVersion, "vV")
	run.Tool.Driver.InformationUri = "https://opensca.xmirror.cn"

	vulnInfos := map[string]*detail.VulnInfo{}

	report.ForEach(func(n *detail.DepDetailGraph) bool {
		for _, vuln := range n.Vulnerabilities {

			if vuln.Id == "" {
				continue
			}

			vulnInfos[vuln.Id] = &detail.VulnInfo{Vuln: vuln, Language: n.Language}

			result := sarifResult{
				RuleId: vuln.Id,
				Level:  vuln.SarifLevel(),
			}
			result.Message.Text = fmt.Sprintf("引入的组件 %s 中存在 %s", n.Dep.Key()[:strings.LastIndex(n.Dep.Key(), ":")], vuln.Name)
			for i, path := range n.Paths {
				if truncIndex := strings.Index(path, "["); truncIndex > 0 {
					path = strings.Trim(path[:truncIndex], `\/`)
				}
				location := sarifLocation{}
				location.PhysicalLocation.ArtifactLocation.Uri = path
				location.PhysicalLocation.ArtifactLocation.Index = i
				location.PhysicalLocation.Region.StartColumn = 1
				location.PhysicalLocation.Region.EndColumn = 1
				location.PhysicalLocation.Region.StartLine = 1
				location.PhysicalLocation.Region.EndLine = 1
				result.Locations = append(result.Locations, location)
			}

			run.Results = append(run.Results, result)
		}
		return true
	})

	for _, vuln := range vulnInfos {
		run.Tool.Driver.Rules = append(run.Tool.Driver.Rules, sarifRule{
			Id:               vuln.Id,
			Name:             vuln.Name,
			ShortDescription: sarifRuleShortDescription{Text: vuln.Name},
			FullDescription:  sarifRuleFullDescription{Text: vuln.Description},
			Help:             sarifRuleHelp{Markdown: formatDesc(vuln)},
			Properties:       sarifRuleProperties{Tags: formatTags(vuln)},
		})
	}