search

boostsecurityio / poutine

boostsecurityio/poutine
Apache License 2.0
229 stars 23 forks source link

URL in finding does not respect `--scm-base-url` #190

Closed rgmz closed 2 months ago

rgmz commented 3 months ago

Describe the bug When using --scm-base-url, the URL of a finding should reference that value. However, the domain appears to be hard-coded to github.com.

To Reproduce

$ ./poutine analyze_org corp --scm-base-url="https://github.contoso.com/" --token="..."

Rule: If condition always evaluates to true
Severity: error
Description: GitHub Actions expressions used in if condition of jobs or steps
must not contain extra characters or spaces.
Otherwise, the condition is always true.
Documentation: https://boostsecurityio.github.io/poutine/rules/if_always_true

+-----------------------------+----------------------------------+-----------------------------------------------------------------------------------------------+
|         REPOSITORY          |             DETAILS              |                                              URL                                              |
+-----------------------------+----------------------------------+-----------------------------------------------------------------------------------------------+
| corp/repo1                  | .github/workflows/reviewdog.yaml | https://github.com/corp/repo1/tree/HEAD/.github/workflows/reviewdog.yaml#L51                  |
|                             | Job: run                         |                                                                                               |
|                             | Step: 2                          |                                                                                               |
|                             |                                  |                                                                                               |
+-----------------------------+----------------------------------+-----------------------------------------------------------------------------------------------+
rgmz commented 2 months ago

This comes from the Package URL: https://github.com/boostsecurityio/poutine/blob/e259b09e5f955a241cb4510e8c188dbaa17292a7/models/purl.go#L46-L55