Skip to content

Fix description value of vulnerability report

Joey Khabie requested to merge jkhabie-fix-kicks-description into main

What does this MR do?

Take the description of vulnerability from identifier instead of message.text

I took advantage of the already existing iteration of kics's vulnerabilities , in order to overwrite the description attribute, using the identifer.name instead of the default behavior of sarif.go that uses the result.message.text .

There is no point of changing this specific behaviour at sarif.go by adding a condition thats checks if the analyzer is kics , then use the identifer.name instead of message.text, as we know this is a shared package that more than 1 analyzer is using .

it makes the change much smaller and impactful .

What are the relevant issue numbers?

gitlab-org/gitlab#381652 (closed)

Does this MR meet the acceptance criteria?

Edited by Craig Smith

Merge request reports