Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Merged SARIF log drops rule descriptions

Abierto
  • ¿Algo no está bien?
#207 0 comentarios 0 reacciones 1 asignado Ver en GitHub

Los mantenedores suelen responder en 1 día

@SizzleUnrlsd ya está trabajando en esto.

Desde el 19/10/2026.

Evaluación

Este issue todavía no se ha evaluado.

Descripción

enhancement severity/minor

Observed

In the merged SARIF log written by --sarif-format, each rule in tool.driver.rules carries only its id:

ctrace --sarif-format --invoke ctrace_stack_analyzer,cppcheck --input demo.c --report-file r.sarif

"rules": [{"id": "StackBufferOverflow"}]

There is no shortDescription, fullDescription, help or helpUri. A SARIF consumer (GitHub code scanning, an IDE, an agent integration) can show a finding's message but cannot explain the rule behind it.

Cause

src/Process/Tools/Sarif.cpp:321 builds rules from the unified diagnostic model (#93: "rules collected from the diagnostics"), and Diagnostic (include/Process/Tools/Diagnostic.hpp) has no field for rule metadata, so there is nothing to write.

The text is available for some tools:

Tool Rule metadata today
coretrace-concurrency-analyzer Full catalog in src/internal/diagnostics/diagnostic_catalog.cpp (title, description, CWE title), already written to its own SARIF by report_renderer.cpp, but lost in the merged log
ctrace_stack_analyzer None: its native SARIF writer sets shortDescription to the rule id (ReportSerialization.cpp:431)
coretrace-python-analyzer None: shortDescription is the rule id (reporters/sarif.py:107)
cppcheck, flawfinder, tscancode Not checked

Consequences

  • GitHub code scanning shows the rule id as the rule's name and no help text.
  • Tools built on the merged log (a local MCP server's explain_rule, IDE hovers) need their own rule catalog, which would drift from the analyzers.

Proposed resolution (to be discussed)

  • Carry rule metadata alongside the diagnostics, for example a per-tool rule table (id → title, description, help URI) that tool implementations fill when the tool provides it, rendered into rules by Sarif.cpp.
  • First step: the concurrency analyzer, whose catalog already exists and is linked in process.
  • The stack and Python analyzers would need their own catalogs; that is work in their repositories and can come later.
  • Without metadata, keep writing {"id": ...} as today.

Open question: is this worth doing before 1.0, given that the SARIF format is among the interfaces to freeze (ROADMAP, theme 1)? Adding rules fields is additive and should not change the coretrace/v1 fingerprints.

Acceptance

  • Unit test: a diagnostic whose tool provides metadata renders shortDescription and fullDescription in its rule; one without keeps {"id": ...}.
  • ctest: --invoke coretrace-concurrency-analyzer on a racy fixture writes the rule's title and description to the merged log.
  • coretrace/v1 fingerprints are unchanged for the existing fixtures.
Lenguaje dominante
C++
Estrellas
5
Forks
4
Merge medio
2 h 13 min
PR fusionados (30 d)
76

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de CoreTrace/coretrace

Todos los issues de CoreTrace/coretrace

Issues similares

Más issues de C++

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.