github / github/codeql

Customizing string representation of data flow nodes in SARIF or CSV results for Taint Tracking

未关闭
#16,143 10 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
question
主要语言
CodeQL
星标
10.1k
派生
2.1k
平均合并
2 天 15 小时
30 天内合并 PR
141

描述

Hi,

Currently, when running a cwe query such as TaintedPath (cwe 22) on a java project, I retrieve the CodeFlow for each result in the SARIF files as shown below. Is there an easy way to customize the string representation of nodes in the output, such as, in the message["text"] part for the node? For instance, for a method call I would like the string to have the format "package:class:methodname" instead of "methodname(...)" -- which is the default. Would I need to override the data flow node for this?

Thanks in advance!

```SARIF
...
"codeFlows" : [ {
"threadFlows" : [ {
"locations" : [ {
"location" : {
"physicalLocation" : {
"artifactLocation" : {
"uri" : "one-java-agent/src/main/java/com/alibaba/oneagent/AgentImpl.java",
"uriBaseId" : "%SRCROOT%",
"index" : 0
},
"region" : {
"startLine" : 81,
"startColumn" : 35,
"endColumn" : 69
}
},
"message" : {
"text" : "getFile(...) : String"
}
}
},
....
```

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。