goodwithtech · tomoyamachi · Oct 25, 2022 · Oct 23, 2022
diff --git a/pkg/report/sarif.go b/pkg/report/sarif.go
@@ -21,6 +21,7 @@ type sarifResult struct {
 	link            string
 	description     string
 	severity        string
+	locations       []string
 }
 
 func (sw SarifWriter) Write(assessMap types.AssessmentMap) (abend bool, err error) {
@@ -47,12 +48,27 @@ func (sw SarifWriter) Write(assessMap types.AssessmentMap) (abend bool, err erro
 	run := sarif.NewRunWithInformationURI("Dockle", "https://github.com/goodwithtech/dockle")
 	report.AddRun(run)
 	for _, r := range rules {
+		result := sarif.NewRuleResult(r.ruleID).
+			WithLevel(strings.ToLower(r.severity)).
+			WithMessage(sarif.NewTextMessage(r.description))
+
+		for _, uri := range r.locations {
+			result.AddLocation(
+				sarif.NewLocation().WithPhysicalLocation(
+					sarif.NewPhysicalLocation().WithArtifactLocation(
+						sarif.NewArtifactLocation().WithUri(
+							uri,
+						),
+					),
+				),
+			)
+		}
+
 		run.AddRule(r.ruleID).
+			WithName(r.ruleID).
 			WithDescription(r.ruleDescription).
 			WithHelpURI(r.link)
-		run.AddResult(sarif.NewRuleResult(r.ruleID).
-			WithLevel(strings.ToLower(r.severity)).
-			WithMessage(sarif.NewTextMessage(r.description)))
+		run.AddResult(result)
 	}
 	if err := report.PrettyWrite(sw.Output); err != nil {
 		return false, fmt.Errorf("failed to write sarif: %w", err)
@@ -65,14 +81,17 @@ func sarifDetail(code string, level int, assessments []*types.Assessment) (jsonI
 		return nil
 	}
 	alerts := []string{}
+	locations := []string{}
 	for _, assessment := range assessments {
 		alerts = append(alerts, assessment.Desc)
+		locations = append(locations, assessment.Filename)
 	}
 	return &sarifResult{
 		ruleID:          code,
 		severity:        sarifAlertLabels[level],
 		ruleDescription: types.TitleMap[code],
 		link:            fmt.Sprintf("https://github.com/goodwithtech/dockle/blob/master/CHECKPOINT.md#%s", code),
 		description:     strings.Join(alerts, ", "),
+		locations:       locations,
 	}
 }
diff --git a/pkg/report/sarif_test.go b/pkg/report/sarif_test.go
@@ -0,0 +1,88 @@
+package report
+
+import (
+	"bytes"
+	"encoding/json"
+	"os"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+
+	"github.com/goodwithtech/dockle/pkg/types"
+)
+
+func TestSarifWriter_Write(t *testing.T) {
+	tests := []struct {
+		description string
+		assessments types.AssessmentSlice
+		sarif       string
+	}{
+		{
+			description: "Should include location when URI",
+			assessments: types.AssessmentSlice{
+				{
+					Code:     "DKL-DI-0006",
+					Filename: "docker://alpine:latest",
+					Desc:     "Avoid 'latest' tag",
+				},
+			},
+			sarif: "./testdata/DKL-DI-0006.sarif",
+		},
+		{
+			description: "Should include location when file path",
+			assessments: types.AssessmentSlice{
+				{
+					Code:     "CIS-DI-0010",
+					Filename: "/some/abs/path",
+					Desc:     "Suspicious filename found",
+				},
+			},
+			sarif: "./testdata/CIS-DI-0010.sarif",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.description, func(t *testing.T) {
+			// Generate the assessment map
+			am := types.CreateAssessmentMap(
+				tt.assessments,
+				map[string]struct{}{},
+				false,
+			)
+
+			// Write the serif report to a buffer
+			output := &bytes.Buffer{}
+			writer := &SarifWriter{Output: output}
+			_, err := writer.Write(am)
+			if err != nil {
+				t.Errorf("Write error: %v", err)
+			}
+
+			// parse that JSON into a map for easy comparison
+			var actual map[string]interface{}
+			err = json.NewDecoder(output).Decode(&actual)
+			if err != nil {
+				t.Errorf("Decode error: %v", err)
+			}
+
+			expected := loadSarifFixture(t, tt.sarif)
+			if diff := cmp.Diff(expected, actual); diff != "" {
+				t.Errorf("diff: %v", diff)
+			}
+		})
+	}
+}
+
+func loadSarifFixture(t testing.TB, path string) map[string]interface{} {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Errorf("Fixture read error: %v", err)
+	}
+
+	var sarif map[string]interface{}
+	err = json.Unmarshal(data, &sarif)
+	if err != nil {
+		t.Errorf("Fixture decode error: %v", err)
+	}
+
+	return sarif
+}
diff --git a/pkg/report/testdata/CIS-DI-0010.sarif b/pkg/report/testdata/CIS-DI-0010.sarif
@@ -0,0 +1,43 @@
+{
+    "version": "2.1.0",
+    "$schema": "https://json.schemastore.org/sarif-2.1.0-rtm.5.json",
+    "runs": [
+        {
+            "tool": {
+                "driver": {
+                    "informationUri": "https://github.com/goodwithtech/dockle",
+                    "name": "Dockle",
+                    "rules": [
+                        {
+                            "id": "CIS-DI-0010",
+                            "name": "CIS-DI-0010",
+                            "shortDescription": {
+                                "text": "Do not store credential in environment variables/files"
+                            },
+                            "helpUri": "https://github.com/goodwithtech/dockle/blob/master/CHECKPOINT.md#CIS-DI-0010"
+                        }
+                    ]
+                }
+            },
+            "results": [
+                {
+                    "ruleId": "CIS-DI-0010",
+                    "ruleIndex": 0,
+                    "level": "error",
+                    "message": {
+                        "text": "Suspicious filename found"
+                    },
+                    "locations": [
+                        {
+                            "physicalLocation": {
+                                "artifactLocation": {
+                                    "uri": "/some/abs/path"
+                                }
+                            }
+                        }
+                    ]
+                }
+            ]
+        }
+    ]
+}
diff --git a/pkg/report/testdata/DKL-DI-0006.sarif b/pkg/report/testdata/DKL-DI-0006.sarif
@@ -0,0 +1,43 @@
+{
+    "version": "2.1.0",
+    "$schema": "https://json.schemastore.org/sarif-2.1.0-rtm.5.json",
+    "runs": [
+        {
+            "tool": {
+                "driver": {
+                    "informationUri": "https://github.com/goodwithtech/dockle",
+                    "name": "Dockle",
+                    "rules": [
+                        {
+                            "id": "DKL-DI-0006",
+                            "name": "DKL-DI-0006",
+                            "shortDescription": {
+                                "text": "Avoid latest tag"
+                            },
+                            "helpUri": "https://github.com/goodwithtech/dockle/blob/master/CHECKPOINT.md#DKL-DI-0006"
+                        }
+                    ]
+                }
+            },
+            "results": [
+                {
+                    "ruleId": "DKL-DI-0006",
+                    "ruleIndex": 0,
+                    "level": "warning",
+                    "message": {
+                        "text": "Avoid 'latest' tag"
+                    },
+                    "locations": [
+                        {
+                            "physicalLocation": {
+                                "artifactLocation": {
+                                    "uri": "docker://alpine:latest"
+                                }
+                            }
+                        }
+                    ]
+                }
+            ]
+        }
+    ]
+}
diff --git a/pkg/run.go b/pkg/run.go
@@ -94,7 +94,7 @@ func Run(c *cli.Context) (err error) {
 	if useLatestTag {
 		assessments = append(assessments, &types.Assessment{
 			Code:     types.AvoidLatestTag,
-			Filename: "image tag",
+			Filename: "docker://" + imageName,
 			Desc:     "Avoid 'latest' tag",
 		})
 	}