Skip to content

Commit e5103da

Browse files
PavelBanskyPavelBansky
authored
Merge pull request #51 from PavelBansky/master
Master
2 parents 16db904 + 1bb4191 commit e5103da

File tree

5 files changed

+176
-20
lines changed

5 files changed

+176
-20
lines changed

‎src/Microsoft.DevSkim/Microsoft.DevSkim.CLI/Microsoft.DevSkim.CLI.csproj

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,23 +9,20 @@
99
<ApplicationIcon />
1010
<PackageId>Microsoft.DevSkim.CLI</PackageId>
1111
<Product>Microsoft DevSkim Command Line Interface</Product>
12-
<Version>0.1.9</Version>
12+
<Version>0.1.10</Version>
1313
<Authors>Microsoft</Authors>
1414
<Company>Microsoft</Company>
1515
<Copyright>(c) Microsoft Corporation. All rights reserved</Copyright>
1616
<Description>DevSkim is a framework and Language analyzer that provide inline security analysis</Description>
1717
</PropertyGroup>
1818

19-
<ItemGroup>
20-
<None Remove="Resources\devskim-rules.json" />
21-
</ItemGroup>
22-
2319
<ItemGroup>
2420
<EmbeddedResource Include="Resources\devskim-rules.json" />
2521
</ItemGroup>
2622

2723
<ItemGroup>
2824
<PackageReference Include="Microsoft.Extensions.CommandLineUtils" Version="1.1.1" />
25+
<PackageReference Include="Sarif.Sdk" Version="1.7.5" />
2926
</ItemGroup>
3027

3128
<ItemGroup>

‎src/Microsoft.DevSkim/Microsoft.DevSkim.CLI/Properties/launchSettings.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"profiles": {
33
"Microsoft.DevSkim.CLI": {
44
"commandName": "Project",
5-
"commandLineArgs": "test d:\\A\\rules -c"
5+
"commandLineArgs": " analyze d:\\GitHub\\DevSkim soubor.txt -f sarif"
66
}
77
}
88
}

‎src/Microsoft.DevSkim/Microsoft.DevSkim.CLI/Resources/devskim-rules.json

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@
5151
"rule_info": "DS185832.md",
5252
"patterns": [
5353
{
54-
"pattern": "\\bstrcpy\\s*\\(([^,]+),([^,]+)\\)",
54+
"pattern": "\\bstrcpy\\s*\\(([^,]+),([^,]+?)\\)",
5555
"type": "regex",
5656
"modifiers": null,
5757
"scopes": [
@@ -66,7 +66,7 @@
6666
"name": "Change to strcpy_s (Recommended for VC++)",
6767
"type": "regex-replace",
6868
"pattern": {
69-
"pattern": "\\bstrcpy\\s*\\(([^,]+),([^,]+)\\)",
69+
"pattern": "\\bstrcpy\\s*\\(([^,]+),([^,]+?)\\)",
7070
"type": "regex",
7171
"modifiers": null,
7272
"scopes": [
@@ -80,7 +80,7 @@
8080
"name": "Change to strlcpy",
8181
"type": "regex-replace",
8282
"pattern": {
83-
"pattern": "\\bstrcpy\\s*\\(([^,]+),([^,]+)\\)",
83+
"pattern": "\\bstrcpy\\s*\\(([^,]+),([^,]+?)\\)",
8484
"type": "regex",
8585
"modifiers": null,
8686
"scopes": [
@@ -113,7 +113,7 @@
113113
"rule_info": "DS111237.md",
114114
"patterns": [
115115
{
116-
"pattern": "\\bstrncpy\\s*\\(([^,]+),([^,]+),([^,]+)\\)+",
116+
"pattern": "\\bstrncpy\\s*\\(([^,]+),([^,]+),([^,]+?)\\)+",
117117
"type": "regex",
118118
"modifiers": null,
119119
"scopes": [
@@ -128,7 +128,7 @@
128128
"name": "Change to strcpy_s (Recommended for VC++)",
129129
"type": "regex-replace",
130130
"pattern": {
131-
"pattern": "\\bstrncpy\\s*\\(([^,]+),([^,]+),([^,]+)\\)+",
131+
"pattern": "\\bstrncpy\\s*\\(([^,]+),([^,]+),([^,]+?)\\)+",
132132
"type": "regex",
133133
"modifiers": null,
134134
"scopes": [
@@ -142,7 +142,7 @@
142142
"name": "Change to strlcpy",
143143
"type": "regex-replace",
144144
"pattern": {
145-
"pattern": "\\bstrncpy\\s*\\(([^,]+),([^,]+),([^,]+)\\)+",
145+
"pattern": "\\bstrncpy\\s*\\(([^,]+),([^,]+),([^,]+?)\\)+",
146146
"type": "regex",
147147
"modifiers": null,
148148
"scopes": [
@@ -175,7 +175,7 @@
175175
"rule_info": "DS141863.md",
176176
"patterns": [
177177
{
178-
"pattern": "\\bstrcat\\s*\\(([^,]+),([^,]+)\\)",
178+
"pattern": "\\bstrcat\\s*\\(([^,]+),([^,]+?)\\)",
179179
"type": "regex",
180180
"modifiers": null,
181181
"scopes": [
@@ -190,7 +190,7 @@
190190
"name": "Change to strcat_s (Recommended for VC++)",
191191
"type": "regex-replace",
192192
"pattern": {
193-
"pattern": "\\bstrcat\\s*\\(([^,]+),([^,]+)\\)",
193+
"pattern": "\\bstrcat\\s*\\(([^,]+),([^,]+?)\\)",
194194
"type": "regex",
195195
"modifiers": null,
196196
"scopes": [
@@ -204,7 +204,7 @@
204204
"name": "Change to strlcat",
205205
"type": "regex-replace",
206206
"pattern": {
207-
"pattern": "\\bstrcat\\s*\\(([^,]+),([^,]+)\\)",
207+
"pattern": "\\bstrcat\\s*\\(([^,]+),([^,]+?)\\)",
208208
"type": "regex",
209209
"modifiers": null,
210210
"scopes": [
@@ -237,7 +237,7 @@
237237
"rule_info": "DS108330.md",
238238
"patterns": [
239239
{
240-
"pattern": "\\bstrncat\\s*\\(([^,]+),([^,]+),([^,]+)\\)+",
240+
"pattern": "\\bstrncat\\s*\\(([^,]+),([^,]+),([^,]+?)\\)+",
241241
"type": "regex",
242242
"modifiers": null,
243243
"scopes": [
@@ -252,7 +252,7 @@
252252
"name": "Change to strcat_s (Recommended for VC++)",
253253
"type": "regex-replace",
254254
"pattern": {
255-
"pattern": "\\bstrncat\\s*\\(([^,]+),([^,]+),([^,]+)\\)+",
255+
"pattern": "\\bstrncat\\s*\\(([^,]+),([^,]+),([^,]+?)\\)+",
256256
"type": "regex",
257257
"modifiers": null,
258258
"scopes": [
@@ -266,7 +266,7 @@
266266
"name": "Change to strlcat",
267267
"type": "regex-replace",
268268
"pattern": {
269-
"pattern": "\\bstrncat\\s*\\(([^,]+),([^,]+),([^,]+)\\)+",
269+
"pattern": "\\bstrncat\\s*\\(([^,]+),([^,]+),([^,]+?)\\)+",
270270
"type": "regex",
271271
"modifiers": null,
272272
"scopes": [
@@ -872,7 +872,7 @@
872872
},
873873
{
874874
"id": "DS113286",
875-
"name": "Do not include user-input directoy in format strings",
875+
"name": "Do not include user-input directly in format strings",
876876
"overrides": null,
877877
"schema_version": 0,
878878
"tags": [

‎src/Microsoft.DevSkim/Microsoft.DevSkim.CLI/Writers/SarifWriter.cs

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
using Microsoft.CodeAnalysis.Sarif;
2+
using Microsoft.CodeAnalysis.Sarif.Readers;
3+
using Newtonsoft.Json;
4+
using System;
5+
using System.Collections.Generic;
6+
using System.Reflection;
7+
using System.Text;
8+
9+
namespace Microsoft.DevSkim.CLI.Writers
10+
{
11+
public class SarifWriter : Writer
12+
{
13+
public SarifWriter()
14+
{
15+
_results = new List<Result>();
16+
_rules = new Dictionary<string, CodeAnalysis.Sarif.Rule>();
17+
}
18+
19+
public override void WriteIssue(IssueRecord issue)
20+
{
21+
Result resultItem = new Result();
22+
MapRuleToResult(issue.Issue.Rule, ref resultItem);
23+
AddRuleToSarifRule(issue.Issue.Rule);
24+
25+
CodeAnalysis.Sarif.Location loc = new CodeAnalysis.Sarif.Location();
26+
loc.AnalysisTarget = new PhysicalLocation(new Uri(issue.Filename),
27+
null,
28+
new Region(issue.Issue.StartLocation.Line,
29+
issue.Issue.StartLocation.Column,
30+
issue.Issue.EndLocation.Line,
31+
issue.Issue.EndLocation.Column,
32+
issue.Issue.Boundary.Index,
33+
issue.Issue.Boundary.Length
34+
));
35+
resultItem.Snippet = issue.TextSample;
36+
37+
if (issue.Issue.Rule.Fixes != null)
38+
resultItem.Fixes = GetFixits(issue);
39+
40+
resultItem.Locations = new List<CodeAnalysis.Sarif.Location>();
41+
resultItem.Locations.Add(loc);
42+
_results.Add(resultItem);
43+
44+
}
45+
46+
public override void FlushAndClose()
47+
{
48+
SarifLog sarifLog = new SarifLog();
49+
sarifLog.Version = SarifVersion.OneZeroZero;
50+
Run runItem = new Run();
51+
runItem.Tool = new Tool();
52+
Assembly entryAssembly = Assembly.GetEntryAssembly();
53+
54+
runItem.Tool.Name = entryAssembly.GetName()
55+
.Name;
56+
57+
runItem.Tool.FullName = entryAssembly.GetCustomAttribute<AssemblyProductAttribute>()
58+
.Product;
59+
60+
runItem.Tool.Version = entryAssembly.GetCustomAttribute<AssemblyInformationalVersionAttribute>()
61+
.InformationalVersion;
62+
63+
runItem.Results = _results;
64+
runItem.Rules = _rules;
65+
sarifLog.Runs = new List<Run>();
66+
sarifLog.Runs.Add(runItem);
67+
68+
69+
JsonSerializerSettings settings = new JsonSerializerSettings()
70+
{
71+
ContractResolver = SarifContractResolver.Instance,
72+
Formatting = Formatting.Indented
73+
};
74+
75+
TextWriter.Write(JsonConvert.SerializeObject(sarifLog, settings));
76+
TextWriter.Flush();
77+
TextWriter.Close();
78+
}
79+
80+
private void MapRuleToResult(Rule rule, ref Result resultItem)
81+
{
82+
switch (rule.Severity)
83+
{
84+
case Severity.Critical:
85+
case Severity.Important:
86+
case Severity.Moderate:
87+
resultItem.Level = ResultLevel.Error;
88+
break;
89+
case Severity.BestPractice:
90+
resultItem.Level = ResultLevel.Warning;
91+
break;
92+
default:
93+
resultItem.Level = ResultLevel.Note;
94+
break;
95+
}
96+
97+
resultItem.RuleId = rule.Id;
98+
resultItem.Message = rule.Name;
99+
foreach (string tag in rule.Tags)
100+
{
101+
resultItem.Tags.Add(tag);
102+
}
103+
}
104+
105+
private List<Fix> GetFixits(IssueRecord issue)
106+
{
107+
List<Fix> fixes = new List<Fix>();
108+
if (issue.Issue.Rule.Fixes != null)
109+
{
110+
foreach (CodeFix fix in issue.Issue.Rule.Fixes)
111+
{
112+
List<Replacement> replacements = new List<Replacement>();
113+
replacements.Add(new Replacement(issue.Issue.Boundary.Index,
114+
issue.Issue.Boundary.Length,
115+
RuleProcessor.Fix(issue.TextSample, fix)
116+
));
117+
118+
List<FileChange> changes = new List<FileChange>();
119+
changes.Add(new FileChange(new Uri(issue.Filename), null, replacements));
120+
121+
fixes.Add(new Fix(fix.Name, changes));
122+
}
123+
}
124+
return fixes;
125+
}
126+
127+
private void AddRuleToSarifRule(Rule devskimRule)
128+
{
129+
if (!_rules.ContainsKey(devskimRule.Id))
130+
{
131+
CodeAnalysis.Sarif.Rule sarifRule = new CodeAnalysis.Sarif.Rule();
132+
sarifRule.Id = devskimRule.Id;
133+
sarifRule.Name = devskimRule.Name;
134+
sarifRule.FullDescription = devskimRule.Description;
135+
sarifRule.HelpUri = new Uri("https://github.com/Microsoft/DevSkim/blob/master/guidance/" + devskimRule.RuleInfo);
136+
137+
switch (devskimRule.Severity)
138+
{
139+
case Severity.Critical:
140+
case Severity.Important:
141+
case Severity.Moderate:
142+
sarifRule.DefaultLevel = ResultLevel.Error;
143+
break;
144+
case Severity.BestPractice:
145+
sarifRule.DefaultLevel = ResultLevel.Warning;
146+
break;
147+
default:
148+
sarifRule.DefaultLevel = ResultLevel.Note;
149+
break;
150+
}
151+
152+
_rules.Add(devskimRule.Id, sarifRule);
153+
}
154+
}
155+
156+
private Dictionary<string, CodeAnalysis.Sarif.Rule> _rules;
157+
private List<Result> _results;
158+
}
159+
}

‎src/Microsoft.DevSkim/Microsoft.DevSkim.CLI/Writers/WriterFactory.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ public static Writer GetWriter(string writerName, string defaultWritter, string
2424
case "text":
2525
return new SimpleTextWriter(format);
2626
case "sarif":
27-
throw new NotImplementedException("sarif not supported");
27+
return new SarifWriter();
2828
default:
2929
throw new Exception("wrong output");
3030
}

0 commit comments

Comments
 (0)