[BUG] artifactLocation.uri in SARIF output is missing a leading `/`
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 474
- Forks
- 65
- Avg merge
- 22h 25m
- Merged PRs (30d)
- 26
Description
Description of the issue
When using the SARIF output type with the SARIF SAST Scans Tab extension in Azure DevOps, the failing rules that are shown under the scans tab have a broken url (Leads to a completely blank page). This seems to be caused by a missing / from the artifactLocation.uri in the generated SARIF output.
For example:
Current URL: https://dev.azure.com/sampleOrg/projectName/_git/repoName?path=path/to/file/with/issue.bicepparam&version={sha}&line=1&lineEnd=2&lineStartColumn=1
Correct URL: https://dev.azure.com/sampleOrg/projectName/_git/repoName?path=/path/to/file/with/issue.bicepparam&version={sha}&line=1&lineEnd=2&lineStartColumn=1
Not sure if there's something I should have set in the options via the ps-rule.yaml file or if this is a relatively simple bug in the sarif generator.
Thanks
Error messages
No response
Reproduction
- Install the SARIF SAST Scans Tab extension in Azure DevOps if not already present.
- Trigger an Azure Pipeline that runs a scan of any .bicepparam file which will output the result as a SARIF file
- Ensure that the pipeline uploads the SARIF file as an artifact.
- Go to the Scans tab and click on a link for a failing rule.
- Append a
/at the start of the path in the URL.
Version of PSRule
2.9.0
How are you running PSRule
Azure Pipelines
Additional context
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the SARIF output from an Azure Pipeline scan of a .bicepparam file, then inspect artifactLocation.uri in the generated SARIF. Done means the path includes its leading slash and the SARIF SAST Scans Tab opens the failing-rule link correctly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- ci-cd, devops
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100