microsoft / microsoft/PSRule

[BUG] artifactLocation.uri in SARIF output is missing a leading `/`

Open
#3,289 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

.NET feature: output
Dominant language
C#
Stars
474
Forks
65
Avg merge
22h 25m
Merged PRs (30d)
26

Description

Description of the issue

When using the SARIF output type with the SARIF SAST Scans Tab extension in Azure DevOps, the failing rules that are shown under the scans tab have a broken url (Leads to a completely blank page). This seems to be caused by a missing / from the artifactLocation.uri in the generated SARIF output.

For example:

Current URL: https://dev.azure.com/sampleOrg/projectName/_git/repoName?path=path/to/file/with/issue.bicepparam&version={sha}&line=1&lineEnd=2&lineStartColumn=1
Correct URL: https://dev.azure.com/sampleOrg/projectName/_git/repoName?path=/path/to/file/with/issue.bicepparam&version={sha}&line=1&lineEnd=2&lineStartColumn=1

Not sure if there's something I should have set in the options via the ps-rule.yaml file or if this is a relatively simple bug in the sarif generator.

Thanks

Error messages

No response

Reproduction
  1. Install the SARIF SAST Scans Tab extension in Azure DevOps if not already present.
  2. Trigger an Azure Pipeline that runs a scan of any .bicepparam file which will output the result as a SARIF file
  3. Ensure that the pipeline uploads the SARIF file as an artifact.
  4. Go to the Scans tab and click on a link for a failing rule.
  5. Append a / at the start of the path in the URL.
Version of PSRule

2.9.0

How are you running PSRule

Azure Pipelines

Additional context

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the SARIF output from an Azure Pipeline scan of a .bicepparam file, then inspect artifactLocation.uri in the generated SARIF. Done means the path includes its leading slash and the SARIF SAST Scans Tab opens the failing-rule link correctly.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
ci-cd, devops
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.