Move SAST titles out of cwe field and into shortDescription metadata field
Problem
Currently our SAST semgrep rules put the vulnerability title inside of a metadata.cwe property field. This is confusing and requires us to parse out the CWE number and the title. It's also unclear that this CWE field is what is actually used to generate the vulnerability title text in our gl-sast-report.json
files.
Proposed Solution
We can use the semgrep rules' metadata.shortDescription
field to be used as the vulnerability title text, and continue to use the message
part of a semgrep rule to be the vulnerability description / remediation text.
Implementation plan
- Update analyzers/report/sarif to check if FullDescription.Text != ShortDescription.Text, if it's different (we're using the new fields) we can return. By default
ShortDescription.Text
is the same asFullDescription.Text
. As such, if it's the same, continue to parse title out ofCWE
field. - Update all semgrep rules to move the title text out of the
CWE
field and into themetadata.shortDescription
field.
This works because semgrep allows us to override the sarif output's shortDescription field here. This was confirmed locally by creating a rule such as:
---
rules:
- id: "flawfinder.StrCat-1.StrCatA-1.StrcatW-1.lstrcatA-1.lstrcatW-1.strCatBuff-1.StrCatBuffA-1.StrCatBuffW-1.StrCatChainW-1._tccat-1._mbccat-1._ftcscat-1.StrCatN-1.StrCatNA-1.StrCatNW-1.StrNCat-1.StrNCatA-1.StrNCatW-1.lstrncat-1.lstrcatnA-1.lstrcatnW-1"
languages:
- "c"
message: |
Buffer overflow is not checked.
metadata:
shortDescription: "Some Better Title"
cwe: "CWE-120: Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120)"
The generated output from running our analyzer was:
"tool": {
"driver": {
"name": "semgrep",
"rules": [
{
"defaultConfiguration": {
"level": "error"
},
"fullDescription": {
"text": "Buffer overflow is not checked.\n"
},
"shortDescription": {
"text": "Some Better Title"
},
"id": "flawfinder.StrCat-1.StrCatA-1.StrcatW-1.lstrcatA-1.lstrcatW-1.strCatBuff-1.StrCatBuffA-1.StrCatBuffW-1.StrCatChainW-1._tccat-1._mbccat-1._ftcscat-1.StrCatN-1.StrCatNA-1.StrCatNW-1.StrNCat-1.StrNCatA-1.StrNCatW-1.lstrncat-1.lstrcatnA-1.lstrcatnW-1",
"name": "flawfinder.StrCat-1.StrCatA-1.StrcatW-1.lstrcatA-1.lstrcatW-1.strCatBuff-1.StrCatBuffA-1.StrCatBuffW-1.StrCatChainW-1._tccat-1._mbccat-1._ftcscat-1.StrCatN-1.StrCatNA-1.StrCatNW-1.StrNCat-1.StrNCatA-1.StrNCatW-1.lstrncat-1.lstrcatnA-1.lstrcatnW-1",
"properties": {
"precision": "very-high",
"tags": [
"CWE-120: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120)",
"security",
"test in tag"
]
}
}
],
"semanticVersion": "1.15.0"
}
Edited by Isaac Dawson