microsoft / microsoft/sarif-web-component

Viewer does not handle embedded file content properly

Open
#17 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
108
Forks
36
Avg merge
5d 15h
Merged PRs (30d)
3

Description

We have a sarif file which has file content embedded. When viewed in the web viewer (using scans tab), the file link in points to this location:

https://sariftools.gallerycdn.vsassets.io/extensions/sariftools/sarif-viewer-build-tab/0.2.130/1576196245030/

Expected:

  • If possible to view this in some way, the actual file content (that can be extracted from the sarif file) should be viewable.

  • If it is not possible, we should remove the hyperlink from the scans tab file name.

image

Here is example of one such case:
https://secretscantest.visualstudio.com/SecDevOps/_build/results?buildId=1317&view=sariftools.sarif-viewer-build-tab.sariftools.sarif-viewer-build-tab

The associated sarif ifle can be downloaded from here:
https://secretscantest.visualstudio.com/SecDevOps/_build/results?buildId=1317&view=artifacts&type=publishedArtifacts

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue with the linked SARIF artifact and inspect how the scans tab handles file links when embedded file content is present. The work is done when embedded content can be viewed, or when the scans-tab filename no longer links to an invalid location.

Written by the indexing model from the issue text.

Assessment

Tech stack
react, typescript
Domain
frontend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.