search

microsoft / DevSkim

DevSkim is a set of IDE plugins, language analyzers, and rules that provide security "linting" capabilities.
MIT License
901 stars 114 forks source link

Add Export Report option to IDE #597

Open arunpradhan opened 8 months ago

arunpradhan commented 8 months ago

Is your feature request related to a problem? Please describe. There were no options to export the consolidated report of the project within Microsoft Visual Code. The report will help in so many cases for marking of solution status. Currently I can view the report with JSON and table format but there was no option to export that report apart from copy paste functionality for one-by-one file. JFYI, I am using PHP language for application.

gfs commented 7 months ago

@arunpradhan thanks for the feedback. There is currently no capability in the IDE extension to export a sarif/json of the results. If you want a standalone report you can use the CLI to generate one. In the simplest case (which should match the default behavior in the ide for issues surfaced) install the CLI (https://github.com/microsoft/DevSkim/wiki/Command-Line-Interface) and then run devskim analyze --source-code /path/to/src --output-file out.sarif to generate a sarif report of detected issues.

arunpradhan commented 7 months ago

Hi @gfs, Thanks for the help, I am able to generate the report.

gfs commented 7 months ago

Changed the title of this issue to reflect a feature request for this. I'm not sure of the feasibility, as the IDE extensions operate on only open files, and do not have access to files that aren't opened so it would be difficult to generate a holistic report. Considering arun was satisfied with the workaround of using the CLI to generate a portable report I'll leave this open for feedback but we aren't actively pursuing adding this at this time.