basant307/AI_Governance_Project

1# node-sarif-builder2 3[![Version](https://img.shields.io/npm/v/node-sarif-builder.svg)](https://npmjs.org/package/node-sarif-builder)4[![Downloads/week](https://img.shields.io/npm/dw/node-sarif-builder.svg)](https://npmjs.org/package/node-sarif-builder)5[![Downloads/total](https://img.shields.io/npm/dt/node-sarif-builder.svg)](https://npmjs.org/package/node-sarif-builder)<!-- gh-dependents-info-used-by-start -->6[![Generated by github-dependents-info](https://img.shields.io/static/v1?label=Used%20by&message=4318&color=informational&logo=slickpic)](https://github.com/nvuillam/node-sarif-builder/blob/main/docs/github-dependents-info.md)<!-- gh-dependents-info-used-by-end -->7[![Test](https://github.com/nvuillam/node-sarif-builder/workflows/Test/badge.svg?branch=main)](https://github.com/nvuillam/node-sarif-builder/actions?query=workflow%3ATest+branch%3Amain)8[![Mega-Linter](https://github.com/nvuillam/node-sarif-builder/workflows/MegaLinter/badge.svg?branch=main)](https://megalinter.github.io/)9[![GitHub contributors](https://img.shields.io/github/contributors/nvuillam/node-sarif-builder.svg)](https://github.com/nvuillam/node-sarif-builder/graphs/contributors/)10[![GitHub stars](https://img.shields.io/github/stars/nvuillam/node-sarif-builder?label=stars&maxAge=3600)](https://github.com/nvuillam/node-sarif-builder/stargazers/)11[![License](https://img.shields.io/npm/l/node-sarif-builder.svg)](https://github.com/nvuillam/node-sarif-builder/blob/master/package.json)12[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=flat-square)](http://makeapullrequest.com)13 14## Introduction15 16Until today, every SAST tool (not exhaustive list available at <https://analysis-tools.dev/>) is using its own custom output format.17 18In order to **unify SAST tools output format**, more and more tools and services are implementing [**SARIF format**](https://sarifweb.azurewebsites.net/) ([example](https://github.com/microsoft/sarif-tutorials/blob/main/samples/1-Introduction/simple-example.sarif))19 20SARIF logs can be:21- **Uploaded to DevOps tools**, like [Github](https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning), [Azure DevOps](https://github.com/microsoft/sarif-azuredevops-extension) to show issues directly in their web UI <!-- markdown-link-check-disable-line -->22- **Visualized in IDEs**, like [Visual Studio Code](https://marketplace.visualstudio.com/items?itemName=MS-SarifVSCode.sarif-viewer), [Visual Studio](https://marketplace.visualstudio.com/items?itemName=WDGIS.MicrosoftSarifViewer), [Jetbrains editors](https://plugins.jetbrains.com/plugin/16938-qodana)23- **Aggregated by multi-language linters**, like [MegaLinter](https://megalinter.io/latest/)24 25Example of linters that can output logs in SARIF format:26 27- bandit (python)28- checkov (terraform)29- checkstyle (java)30- cfn-lint (AWS CloudFormation)31- codeql (multi-language)32- devskim (security)33- eslint (javascript,typescript,json)34- gitleaks (security)35- ktlint (Kotlin)36- hadolint (Dockerfile)37- MegaLinter (linters orchestrator)38- psalm (php)39- semgrep (multi-language)40- revive (Go)41- tflint (terraform)42- terrascan (terrasform)43- trivy (security)44- and many more...45 46If you are a **maintainer** of any **javascript/typescript based** SAST tool, but also IaC tool, or **any type of tool that can return a list of errors with a level of severity**, you can either:47 48- read the whole [OASIS Specification](https://docs.oasis-open.org/sarif/sarif/v2.1.0/csprd01/sarif-v2.1.0-csprd01.html) and implement it49- **simply use this library** to add SARIF as additional output format, so your tool will be natively compliant with any of SARIF-compliant tools !50 51## Installation52 53- with npm54 55```shell56npm install node-sarif-builder57```58 59- with yarn60 61```shell62yarn add node-sarif-builder63```64 65## Use66 67With node-sarif-builder, you can generate complex SARIF format with simple methods68 69___70 71- Start by importing module72 73```javascript74const { SarifBuilder, SarifRunBuilder, SarifResultBuilder, SarifRuleBuilder } = require("node-sarif-builder");75```76 77___78 79- Create and init **SarifBuilder** and **SarifRunBuilder** objects80 81```javascript82// SARIF builder83const sarifBuilder = new SarifBuilder();84// SARIF Run builder85const sarifRunBuilder = new SarifRunBuilder().initSimple({86    toolDriverName: "npm-groovy-lint",                           // Name of your analyzer tool87    toolDriverVersion: "9.0.5",                                  // Version of your analyzer tool88    url: "https://nvuillam.github.io/npm-groovy-lint/"           // Url of your analyzer tool89});90```91 92___93 94- Add all rules that can be found in your results (recommended but optional)95 96```javascript97// Add SARIF rules98for (const rule of rules) {                           // rules from your linter in any format99    const sarifRuleBuiler = new SarifRuleBuilder().initSimple({100        ruleId: rule.id,                              // ex: "no-any"101        shortDescriptionText: rule.description,       // ex: "Do not use any in your code !"102        helpUri: rule.docUrl                          // ex: "http://my.linter.com/rules/no-any"103    });104    sarifRunBuilder.addRule(sarifRuleBuiler);105}106```107 108___109 110- For each found issue, create a SarifResultBuilder and add it to the SarifRunBuilder object111 112```javascript113import { pathToFileURL } from 'url'114 115// Add results116for (const issue of issues) { // issues from your linter in any format117    const sarifResultBuilder = new SarifResultBuilder();118    const sarifResultInit = {119         // Transcode to a SARIF level:  can be "warning" or "error" or "note"120        level: issue.severity === "info" ? "note" : issue.severity,121        messageText: err.msg,                                     // Ex: "any is forbidden !"122        ruleId: err.rule,                                         // Ex: "no-any"123        fileUri: process.env.SARIF_URI_ABSOLUTE                   // Ex: src/myfile.ts124            ? pathToFileURL(fileNm)125            : path.relative(process.cwd(), fileNm).replace(/\\/g, '/'),126    };127    // When possible, provide location of the issue in the source code128    if (issue.range) {129        sarifResultInit.startLine = issue.range.start.line;        // any integer >= 1 (optional)130        sarifResultInit.startColumn = issue.range.start.character; // any integer >= 1 (optional)131        sarifResultInit.endLine = issue.range.end.line;            // any integer >= 1 (optional)132        sarifResultInit.endColumn = issue.range.end.character;     // any integer >= 1 (optional)133    }134    // Init sarifResultBuilder135    sarifResultBuilder.initSimple(sarifResultInit); 136    // Add result to sarifRunBuilder137    sarifRunBuilder.addResult(sarifResultBuilder);138}139```140 141___142 143- Add run to sarifBuilder then generate JSON SARIF output file144 145```javascript146    sarifBuilder.addRun(sarifRunBuilder);147    const sarifJsonString = sarifBuilder.buildSarifJsonString({ indent: false }); // indent:true if you like148    fs.writeFileSync(outputSarifFile,sarifJsonString);149    // const sarifObj = sarifBuilder.buildSarifOutput();                          // You could also just get the Sarif log as an object and not a string150```151 152## Full example153 154- Working in [npm-groovy-lint](https://github.com/nvuillam/npm-groovy-lint)155 156```javascript157import { pathToFileURL } from 'url'158 159function buildSarifResult(lintResult) {160    // SARIF builder161    const sarifBuilder = new SarifBuilder();162    // SARIF Run builder163    const sarifRunBuilder = new SarifRunBuilder().initSimple({164        toolDriverName: "npm-groovy-lint",165        toolDriverVersion: "9.0.5", 166        url: "https://nvuillam.github.io/npm-groovy-lint/"167    });168    // SARIF rules169    for (const ruleId of Object.keys(lintResult.rules || {})) {170        const rule = lintResult.rules[ruleId];171        const sarifRuleBuiler = new SarifRuleBuilder().initSimple({172            ruleId: ruleId,173            shortDescriptionText: rule.description,174            helpUri: rule.docUrl175        });176        sarifRunBuilder.addRule(sarifRuleBuiler);177    }178    // Add SARIF results (individual errors)179    for (const fileNm of Object.keys(lintResult.files)) {180        const fileErrors = lintResult.files[fileNm].errors;181        for (const err of fileErrors) {182            const sarifResultBuilder = new SarifResultBuilder();183            const sarifResultInit = {184                level: err.severity === "info" ? "note" : err.severity, // Other values can be "warning" or "error"185                messageText: err.msg,186                ruleId: err.rule,187                fileUri: process.env.SARIF_URI_ABSOLUTE188                    ? pathToFileURL(fileNm)189                    : path.relative(process.cwd(), fileNm).replace(/\\/g, '/')190            };191            if (err.range) {192                sarifResultInit.startLine = fixLine(err.range.start.line);193                sarifResultInit.startColumn = fixCol(err.range.start.character);194                sarifResultInit.endLine = fixLine(err.range.end.line);195                sarifResultInit.endColumn = fixCol(err.range.end.character);196            }197            sarifResultBuilder.initSimple(sarifResultInit);198            sarifRunBuilder.addResult(sarifResultBuilder);199        }200    }201    sarifBuilder.addRun(sarifRunBuilder);202    return sarifBuilder.buildSarifJsonString({ indent: false });203}204 205function fixLine(val) {206    if (val === null) {207        return undefined;208    }209    return val === 0 ? 1 : val;210}211 212function fixCol(val) {213    if (val === null) {214        return undefined;215    }216    return val === 0 ? 1 : val + 1;217}218```219 220## Test221 222You can confirm that your generated SARIF logs are valid on <https://sarifweb.azurewebsites.net/Validation>223