Issue with mapping problem to file

[markhermeling]

I can load the attached SARIF file in the SARIF-viewer plugin for CLion and all seems to work fine. (screenshot 1).

Then, I can click on the first issue and it loads the source file and navigates to the offending line.

However, now all lines in the viewer show 'No problems' (screenshot 2) and when I click on any of them, I get an error (screenshot 3).

This SARIF loads correctly in other SARIF compatible viewers.

You can use a clone of curl if you want to get the source code, won't have the problematic lines in it, but it will have the files.

warnings-4.sarif.zip

[adrienpessu]

@markhermeling the screenshots you have uploaded aren't from the SARIF viewer but from the intelliJ plug that is performing security analysis (Server-side analysis).

Do you have an issue with the SARIF viewer ? In that case, can you share screenshots of the plugin ?

[markhermeling]

Ha! Sorry about that. I did File -> Open and I thought that display was provided by the SARIF viewer.

Attached a screenshot with the SARIF viewer. It is unable to match the locations to source files. It seems to have a hard time parsing the SARIF. The rule name is not displayed, instead the message is being displayed.

[adrienpessu]

It displays the message because in many tools the ruleId isn't meaningful enough for users to understand the implication. It makes sense because it's an id.

For the source location, the information retrieved from the SARIF :

{
              "id": 1,
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "src/terminal.c",
                  "uriBaseId": "SRCROOT0"
                },
                "region": {
                  "startLine": 60,
                  "startColumn": 24,
                  "endColumn": 28
                }
              },
              "logicalLocations": [
                {
                  "name": "return_append_str"
                }
              ],
              "message": {
                "text": "The highlighted code will not execute under any circumstances. This may be because of:  - A function call that does not return.  - A test whose result is always the same: look for a preceding Redundant Condition - MisraC2023:14.3 - MisraC2023:2.1 warning.  - A crashing bug.  Look for a preceding Null Pointer Dereference - MisraC2023:D.4.11 - MisraC2023:D.4.1 - MisraC2023:1.3 or Division By Zero - MisraC2023:1.3 warning."
              }
            }

So it will get from the workspace directory, the file located in src/terminal.c. Do you have the file from the root directory of your workspace ?

[markhermeling]

Interesting approach re: the ruleId. For us the ruleId will be meaningful and for many of the other tools that I have seen (mostly in the C/C++ world) that is true as well.

For the file, it is present, but not in the root directory of the workspace, it is in curl/src/terminal.c.

Is there a way that I can correct for that?

[adrienpessu]

My main point of reference is CodeQL where it scans also C/C++ for security issue as well as quality (MISRA, AUTOSAR, ...). The id isn't representative enough in my opinion, but the message is good.
Among all the SAST, they have different way of using SARIF (at least there is a standard 😅)

For the two points, if you are familiar with Kotlin, you can create a PR to add a setting to :

• display the ruleId instead of the Description
• add a field to add the absolute path to override the workspace path

(I can work on that, but not for the next 2 weeks)

[markhermeling]

Let me see if I can implement it in the next week and send you a PR.

[markhermeling]

A PR has been submitted for the id vs message toggle is here: #134