Skip to content

Add SARIF output support. #4651

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 46 commits into from
Closed

Add SARIF output support. #4651

Changes from 1 commit
Commits
Show all changes
46 commits
Select commit Hold shift + click to select a range
8f10eef
Refactor XML output through the new `XMLAnalysisReport` class.
mario-campos Dec 15, 2022
6f0b5f0
Refactor out CLI error messages into the new class `CLIAnalysisReport`.
mario-campos Dec 16, 2022
e736e59
Change snake-cased `add_finding` to camelCased `addFinding`.
mario-campos Dec 16, 2022
963267b
Add SARIF output format with the new `SARIFAnalysisReport` class.
mario-campos Dec 16, 2022
b495ccd
Reformat files to fix warnings.
mario-campos Dec 16, 2022
44ea258
Include externals/picojson for building cppcheck CLI with cmake.
mario-campos Dec 17, 2022
918d9cf
Abstract classes must implement a destructor, even if its virtual.
mario-campos Dec 17, 2022
f92e1fd
Add a parameter name to the XMLAnalysisReport method.
mario-campos Dec 17, 2022
a5298d3
Use std::unique_ptr instead of new/free.
mario-campos Dec 17, 2022
a1f442d
Output severity in SARIF report.
mario-campos Dec 17, 2022
349dc0b
Output precision in SARIF report.
mario-campos Dec 17, 2022
c501cdd
Output line/column numbers in SARIF report.
mario-campos Dec 17, 2022
ca7214f
Unify spacing and alignment in std::map literal.
mario-campos Dec 17, 2022
b81988e
Unify spacing around std::map literals.
mario-campos Dec 17, 2022
df790fd
Change static methods to static functions.
mario-campos Dec 17, 2022
b1b7239
Fix SARIF report by making `runs` property an array.
mario-campos Dec 18, 2022
6835c6a
Include Cppcheck homepage URL to SARIF report.
mario-campos Dec 18, 2022
d92b72b
Add SARIFAnalysisReport documentation as comment.
mario-campos Dec 18, 2022
551f7ed
Add missing <memory> include to use `std::unique_ptr`.
mario-campos Dec 19, 2022
5f13e12
Fix `switch`/`case` alignment to please uncrustify.
mario-campos Dec 19, 2022
9a73d59
Fix clang-tidy findings.
mario-campos Dec 19, 2022
9b5310f
Add analysis report objects to Makefile's testrunner target.
mario-campos Dec 19, 2022
c7a9611
Fix --errorlist by hoisting mReport assignment earlier in the code.
mario-campos Dec 19, 2022
b4058ca
Check (and error) if XML and SARIF outputs are both specified.
mario-campos Dec 19, 2022
915d9fb
Fix XML pretty-print by appending new-line to XML error message.
mario-campos Dec 19, 2022
455ab5f
Add CLI system test to test that the SARIF file has expected structur…
mario-campos Dec 19, 2022
a4671e5
Rename *AnalysisReport::emit() to serialize().
mario-campos Dec 19, 2022
2e88265
Fix forgotten `sarif` field initialization in settings.cpp.
mario-campos Dec 20, 2022
3a647e5
Refactor duplicate-branch conditional statement.
mario-campos Dec 20, 2022
4ecafee
Put `sarif` property in alphabetical order of other properties.
mario-campos Dec 20, 2022
a22a1ac
Refactor SARIFAnalysisReport::addFinding() from 2 to 1 line!
mario-campos Dec 20, 2022
1a20b60
Fix XML alignment by adding missing newline character.
mario-campos Dec 22, 2022
d1c2d83
Undo changes to merge CLI findings into separate class.
mario-campos Dec 22, 2022
13ce02e
`std::move` more objects in sarifanalysisreport.cpp.
mario-campos Jan 10, 2023
03d91ac
Use range-based for loop for SARIF generation.
mario-campos Jan 10, 2023
e14ff71
Use constant reference.
mario-campos Jan 10, 2023
74950dc
Improve error message to be more helpful.
mario-campos Jan 10, 2023
3abccfc
Add CLIAnalysisReport class for outputting findings to CLI.
mario-campos Jan 10, 2023
1cc3516
Indent the member initialization for uncrusty.
mario-campos Jan 10, 2023
21eba3b
Fix the extra new-line character that was added.
mario-campos Jan 11, 2023
b341465
Use `--output-format` instead of `--sarif`.
mario-campos Jan 11, 2023
1b32554
Use move semantics for SARIF generation if PicoJSON supports it.
mario-campos Jan 11, 2023
eacd087
Fix tests by using `--output-format=xml` instead of `--xml`.
mario-campos Jan 11, 2023
9995bb1
Forgot to include windows.h for Windows OSes.
mario-campos Jan 11, 2023
e53984e
Fix selfcheck and clang-tidy warnings about passing std::string by va…
mario-campos Jan 11, 2023
3b2fda2
Need to link the *analysisreport.o object files for testrunner.
mario-campos Jan 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Output line/column numbers in SARIF report.
  • Loading branch information
@mario-campos
mario-campos committed Dec 22, 2022
commit c501cddb83e722d942e2e81382bcd9cc6531e3de
66 changes: 36 additions & 30 deletions cli/sarifanalysisreport.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,37 +91,43 @@ std::string SARIFAnalysisReport::emit() {
rules.emplace_back(reportingDescriptor);

for (const ErrorMessage& err : it->second) {
// https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317427
picojson::object artifactLocation = {
// https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317430
{ "uri", picojson::value(err.file0) }
};

// https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317685
picojson::object region = {
// https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317690
{ "startLine", picojson::value(1.0) },
// https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317691
{ "startColumn", picojson::value(1.0) },
// https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317692
{ "endLine", picojson::value(1.0) },
// https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317693
{ "endColumn", picojson::value(1.0) },
};
picojson::array locations;

for (std::list<ErrorMessage::FileLocation>::const_iterator loc = err.callStack.begin(); loc != err.callStack.end(); ++loc) {
// https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317427
picojson::object artifactLocation = {
// https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317430
{"uri", picojson::value(loc->getfile())}
};

// https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317685
picojson::object region = {
// https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317690
{"startLine", picojson::value(double(loc->line))},
// https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317691
{"startColumn", picojson::value(double(loc->column))},
// https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317692
{"endLine", picojson::value(double(loc->line))},
// https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317693
{"endColumn", picojson::value(double(loc->column))},
};

// https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317678
picojson::object physicalLocation = {
// https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317681
{ "artifactLocation", picojson::value(artifactLocation) },
// https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317682
{ "region", picojson::value(region) },
};

// https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317670
picojson::object location = {
// https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317678
{ "physicalLocation", picojson::value(physicalLocation) },
};
picojson::object physicalLocation = {
// https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317681
{"artifactLocation", picojson::value(artifactLocation)},
// https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317682
{"region", picojson::value(region)},
};

// https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317670
picojson::object location = {
// https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317678
{"physicalLocation", picojson::value(physicalLocation)},
};

locations.emplace_back(location);
}

// https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317638
picojson::object result = {
Expand All @@ -130,7 +136,7 @@ std::string SARIFAnalysisReport::emit() {
// https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317649
{ "message", picojson::value(text(err.shortMessage())) },
// https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317650
{ "locations", picojson::value(location) },
{ "locations", picojson::value(locations) },
};
results.emplace_back(result);
}
Expand Down