SAST findings rendering CWE titles due to missing name field
Proposal
In the Updates to the 15-x-x schema with %16.0 deprecations, we did not update our SARIF conversion logic to output the name
field in place of message
. This is resulting in vulnerability titles like <code data-sourcepos="5:262-5:292">CWE-89 in SQLiteRoleProvider.cs</code> instead of the more descriptive message
field "Sensitive cookie without 'HttpOnly' flag"
Implementation plan
- Update
sarif.go
to outputMessage
asName
- Ensure
Name
is truncated to the new maxLength of 255 (previousMessage
field had no max) - Update report dependency for all analyzers that rely off sarif converter; i.e. semgrep and kics
Edited by Lucas Charles