Customizing string representation of data flow nodes in SARIF or CSV results for Taint Tracking
- Langage dominant
- CodeQL
- Étoiles
- 10.1k
- Forks
- 2.1k
- Merge moyen
- 2 j 15 h
- PR mergées (30 j)
- 141
Description
Hi,
Currently, when running a cwe query such as TaintedPath (cwe 22) on a java project, I retrieve the CodeFlow for each result in the SARIF files as shown below. Is there an easy way to customize the string representation of nodes in the output, such as, in the message["text"] part for the node? For instance, for a method call I would like the string to have the format "package:class:methodname" instead of "methodname(...)" -- which is the default. Would I need to override the data flow node for this?
Thanks in advance!
```SARIF
...
"codeFlows" : [ {
"threadFlows" : [ {
"locations" : [ {
"location" : {
"physicalLocation" : {
"artifactLocation" : {
"uri" : "one-java-agent/src/main/java/com/alibaba/oneagent/AgentImpl.java",
"uriBaseId" : "%SRCROOT%",
"index" : 0
},
"region" : {
"startLine" : 81,
"startColumn" : 35,
"endColumn" : 69
}
},
"message" : {
"text" : "getFile(...) : String"
}
}
},
....
```
Guide de contribution
Ouvrir le guide de contribution
Piste de recherche
Start with the TaintedPath CodeFlow output shown in the issue, focusing on how SARIF or CSV produces each node's message text. Determine whether the requested package:class:methodname format is supported by an existing customization point, and document the expected behavior or the required scope for implementing it.
Rédigé par le modèle d'indexation à partir du texte de l'issue.
Évaluation
- Stack technique
- java
- Domaine
- security
- Type d'issue
- Fonctionnalité
- Difficulté
- 5/5
- Temps estimé
- Plus d'une semaine
- Activité
- À l'abandon
- Clarté
- Plutôt claire
- Accessibilité débutants
- 25/100