report semgrep findings and fix findings assertions #739
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
clavedeluna
changed the title
drdavella
requested changes
Jul 24, 2024
src/codemodder/result.py
Outdated
| rule=Rule( | ||
| id=rule_id, | ||
| name=rule_id, | ||
| url=semgrep_url_from_id(rule_id), |
There was a problem hiding this comment.
This is specific to Semgrep but it looks like this is being added to a more general SarifResult class?
There was a problem hiding this comment.
yeah do you think this is wrong? while it's a generic sarif result, wouldn't all sarif results have to have findings too?
There was a problem hiding this comment.
My concern is specifically about the call to semgrep_url_from_id, which only applies to Semgrep results, whereas this class appears to be used for multiple SARIF-based tools.
There was a problem hiding this comment.
wooops Im an idiot, of course! Good review Dan, will update
andrecsilva
approved these changes
Jul 25, 2024
|
drdavella
approved these changes
Jul 25, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I initially thought asserting findings is not None was sufficient, but in cases when the result of matching findings is
[]we also want to be aware.I updated some codemods where it was easy to do the matching, but created #738 for that codemod
This fix also brought to light that we weren't reporting semgrep findings so fixed that too