Repository navigation
fix(sarif): store finding fingerprint in fingerprints to prevent code scanning warning - #466
Open
Tyagiquamar wants to merge 1 commit into
Open
Tyagiquamar wants to merge 1 commit into
Tyagiquamar wants to merge 1 commit into
Conversation
… scanning line hash warning In SARIF 2.1.0 and GitHub Code Scanning, partialFingerprints.primaryLocationLineHash is reserved for a hash of the code line containing the finding location. When uploading to GitHub Code Scanning via upload-sarif, GitHub computes its own line hash and warns when an inconsistent value is found under primaryLocationLineHash. Store the finding fingerprint in result.fingerprints (under findingFingerprint) instead of using the reserved primaryLocationLineHash key in partialFingerprints, allowing GitHub Code Scanning to automatically generate the location line hash without warnings. Fixes boostsecurityio#387.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
SARIF uploaded to GitHub code scanning no longer warns that
partialFingerprints.primaryLocationLineHashdoes not match GitHub's own line hash.Root cause
The finding fingerprint was stored in
partialFingerprints.primaryLocationLineHash. SARIF 2.1.0 reserves that field for a hash of the source line. GitHub computes that hash itself and warns when the uploaded value differs.Solution
The finding fingerprint is stored on
result.fingerprintsunderfindingFingerprint. The reserved line-hash field is left for GitHub.Test plan
formatters/sarif/sarif_test.gochecks the fingerprint location in the emitted SARIF.