Report a finding-specific message for each result
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
Research direction
Start by tracing how the tool builds SARIF result messages and rule metadata, then inspect the Issue API used by platform and custom rule plugins. The issue names no files or tests, so locate the relevant code and tests before making changes. Done means each result can carry its own message, rule descriptions remain in rule metadata, and rules without a message fall back to the title.
Written by the indexing model from the issue text.
Description
Current Limitation
Every result in the SARIF report has the rule's title as its message.text, the same string as the rule's shortDescription/fullDescription. So every finding of a rule reads the same, and the message never says what is wrong at that location (which variable, which function, which value).
This makes the findings hard to triage in GitHub code scanning, SonarQube, PR annotations and job summaries, which all show the result message as the main text of the alert.
Suggested Improvement
- Give each issue its own message that describes the finding at its location, for example
Variable 'password' holds a hard-coded credentialinstead ofAvoid hard-coded credentials. - Keep the rule-level information in the rule metadata: the title in
shortDescription, the full description infullDescription, plushelp/helpUri, CWE/OWASP tags and the rule kind. Each result then has its own message, and the rule entry holds the shared description. - Expose the message through the scan tool's
IssueAPI, so that platform plugins and custom rule plugins can set and read it. Fall back to the rule title only when a rule does not provide a message.
Version
Scan tool 0.12.0
- Dominant language
- Java
- Stars
- 15
- Forks
- 12
- Avg merge
- 11h 57m
- Merged PRs (30d)
- 14
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from ballerina-platform/static-code-analysis-tool
-
Type/Improvement
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
ballerina-platform/static-code-analysis-tool#140 ·
Maintainers usually reply within 1 day
-
Type/Improvement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
ballerina-platform/static-code-analysis-tool#139 ·
Maintainers usually reply within 1 day
-
Type/Improvement
Difficulty 3/5 1-2 days Newbie friendliness 62/100
ballerina-platform/static-code-analysis-tool#138 ·
Maintainers usually reply within 1 day
-
Type/Improvement
Difficulty 3/5 1-2 days Newbie friendliness 63/100
ballerina-platform/static-code-analysis-tool#137 ·
Maintainers usually reply within 1 day
-
Type/Improvement
Difficulty 3/5 1-2 days Newbie friendliness 62/100
ballerina-platform/static-code-analysis-tool#136 ·
Maintainers usually reply within 1 day
All issues in ballerina-platform/static-code-analysis-tool
Similar issues
-
bug web-server
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
jooby-project/jooby#4035 ·
Maintainers usually reply within 1 day
-
L: javascript
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
dependabot/dependabot-core#16744 ·
Maintainers usually reply within 1 day
-
intake mcp-intake needs-human-review priority:high type:bug
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
Ikalus1988/MisakaNet#3987 · 3 comments ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
quarkiverse/quarkus-google-cloud-services#1187 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 82/100
locationtech/jts#1250 ·