microsoft / microsoft/sarif-web-component

Display "review" results as warnings

Open
#22 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
TypeScript
Stars
108
Forks
36
Avg merge
5d 15h
Merged PRs (30d)
3

Description

When a result has kind equal to "review", the extension displays it as "informational". But in fact, a "review" result should be displayed as "warning", because it means that it's an issue that requires human review to determine if there's actually a problem.

The guidance for viewers is:

  • Errors: results that break/block processes.
  • Warnings: items actively tracked that should always display to users but not block anything.
  • Informational: low-importance items that do not display by default.

Here is how the viewer should treat results with a kind value other than "fail":

kind value Viewer treatment
"notApplicable" Informational
"open" Warning [1]
"pass" Informational [2]
"review" Warning

[1] Because this value means that the tool didn't have enough information to know if there was a problem. This is used by program correctness provers. If a prover doesn't know (for example), if a particular function can throw an exception, it might not be able to decide whether a code path is safe.

[2] But I think the web viewer already shows a green check-mark for a "pass" results, right? This is good.

@michaelcfanning FYI

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in the viewer code that maps SARIF result kind values to displayed severities. Verify the existing treatments for notApplicable, open, pass, and fail, then make review display as a warning and confirm the viewer reflects the requested table.

Written by the indexing model from the issue text.

Assessment

Tech stack
react, typescript
Domain
frontend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.