Function test_sarif_security_rules

test/cli/sarif_test.py:191–223

Test that security-related rules have proper security properties.

()

def test_sarif_security_rules():
    """Test that security-related rules have proper security properties."""
    sarif = run_sarif_check(TEST_CODE)

    run = sarif["runs"][0]
    driver = run["tool"]["driver"]
    rules = driver["rules"]

    # Check for security-related rules
    security_rule_ids = [
        "nullPointer",
        "arrayIndexOutOfBounds",
        "memleak",
        "uninitvar",
        "doubleFree",
    ]

    for rule_id in security_rule_ids:
        matching_rules = [r for r in rules if r["id"] == rule_id]
        if matching_rules:
            rule = matching_rules[0]
            props = rule.get("properties", {})

            # Security rules should have security-severity
            if "tags" in props and "security" in props["tags"]:
                assert "security-severity" in props
                assert float(props["security-severity"]) > 0

            # Should have problem.severity
            assert "problem.severity" in props

            # Should have precision
            assert "precision" in props


def test_sarif_rule_descriptions():