search

tomasbjerre / violations-lib

Java library for parsing report files from static code analysis.
Apache License 2.0
148 stars 39 forks source link

SARIF Issue Severity Always INFO #144

Closed JoshStutts closed 2 years ago

JoshStutts commented 2 years ago

I'm using a couple different static analysis tools, both of which produce valid SARIF files according to https://sarifweb.azurewebsites.net/Validation

The SARIF files contain issues with their level set to "note", "warning", and "error", but the output from violations-lib after parsing a SARIF file only shows INFO severity items.

I've attached a sanitized SARIF file with my file paths removed and the extension changed to .txt so github would allow me to attach it, but it's still valid per the validator above. Parsing this file using the violations-command-line results in the following:

image

Actual levels in the file:

$ grep 'level":' security-scan.sarif | sort | uniq -c
   4           "level": "error",
   4           "level": "note",
  56           "level": "warning",

security-scan.txt

tomasbjerre commented 2 years ago

Should be fixed now in 1.21.3 of the command line tool.

Olstyle commented 2 years ago

I can confirm that this now works correctly for errors at least. Looks like the checker I use classifies everything as an error so I didn't see this when things I'd classify as info were marked like that.