Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Merged SARIF log drops rule descriptions

Aperta
  • Qualcosa non va?
#207 0 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@SizzleUnrlsd ci sta già lavorando.

Dal 19/10/2026.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

enhancement severity/minor

Observed

In the merged SARIF log written by --sarif-format, each rule in tool.driver.rules carries only its id:

ctrace --sarif-format --invoke ctrace_stack_analyzer,cppcheck --input demo.c --report-file r.sarif

"rules": [{"id": "StackBufferOverflow"}]

There is no shortDescription, fullDescription, help or helpUri. A SARIF consumer (GitHub code scanning, an IDE, an agent integration) can show a finding's message but cannot explain the rule behind it.

Cause

src/Process/Tools/Sarif.cpp:321 builds rules from the unified diagnostic model (#93: "rules collected from the diagnostics"), and Diagnostic (include/Process/Tools/Diagnostic.hpp) has no field for rule metadata, so there is nothing to write.

The text is available for some tools:

Tool Rule metadata today
coretrace-concurrency-analyzer Full catalog in src/internal/diagnostics/diagnostic_catalog.cpp (title, description, CWE title), already written to its own SARIF by report_renderer.cpp, but lost in the merged log
ctrace_stack_analyzer None: its native SARIF writer sets shortDescription to the rule id (ReportSerialization.cpp:431)
coretrace-python-analyzer None: shortDescription is the rule id (reporters/sarif.py:107)
cppcheck, flawfinder, tscancode Not checked

Consequences

  • GitHub code scanning shows the rule id as the rule's name and no help text.
  • Tools built on the merged log (a local MCP server's explain_rule, IDE hovers) need their own rule catalog, which would drift from the analyzers.

Proposed resolution (to be discussed)

  • Carry rule metadata alongside the diagnostics, for example a per-tool rule table (id → title, description, help URI) that tool implementations fill when the tool provides it, rendered into rules by Sarif.cpp.
  • First step: the concurrency analyzer, whose catalog already exists and is linked in process.
  • The stack and Python analyzers would need their own catalogs; that is work in their repositories and can come later.
  • Without metadata, keep writing {"id": ...} as today.

Open question: is this worth doing before 1.0, given that the SARIF format is among the interfaces to freeze (ROADMAP, theme 1)? Adding rules fields is additive and should not change the coretrace/v1 fingerprints.

Acceptance

  • Unit test: a diagnostic whose tool provides metadata renders shortDescription and fullDescription in its rule; one without keeps {"id": ...}.
  • ctest: --invoke coretrace-concurrency-analyzer on a racy fixture writes the rule's title and description to the merged log.
  • coretrace/v1 fingerprints are unchanged for the existing fixtures.
Lingua principale
C++
Stelle
5
Fork
4
Merge medio
5h 56m
PR unite (30g)
65

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di CoreTrace/coretrace

Tutte le issue di CoreTrace/coretrace

Issue simili

Altre issue su C++

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.