microsoft / sarif-sdk

.NET code and supporting files for working with the 'Static Analysis Results Interchange Format' (SARIF, see https://github.com/oasis-tcs/sarif-spec)
Other
193 stars 93 forks source link

Add --kind and --level arguments for granular control of results reporting #2228

Closed michaelcfanning closed 3 years ago

michaelcfanning commented 3 years ago

Implementation notes:

@eddynaka @jameswinkler, FYI

michaelcfanning commented 3 years ago

For completeness, I will mention that when building this, we should at least consider the possibility we want an even more granular, per-rule mechanism to control reporting behavior.

For example:

-level Error;BadRuleId.Note

might do something like remap BadRuleId's output into a Note (which could be disabled). we should also consider whether this argument could contain a value like 'Disabled' which doesn't literally existing on the SARIF Level type. we could do this because we'll have a string [] representation we can process because constructing the SARIF types. On encountering a Disabled value, we would proactively add this id to the disabled skimmers set.

This would provide a super easy way for people to opt out of a poorly behaving check (one that's crashing in general code paths for example).