Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Read the confidence and the related locations of every analyzer into the merged log

Aperta
  • Qualcosa non va?
#209 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
56/100
Tipo di issue
Funzionalità
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
cpp, json
Ambito
backend, testing

Direzione di ricerca

Start with diagnosticsFromSarif in src/Process/Tools/Sarif.cpp and toDiagnostics in src/Process/Tools/StackAnalyzerToolImplementation.cpp, then check the model fields and existing unit tests for diagnostics. Add tests showing related locations and recognized confidence reach the model, unknown confidence is ignored, and stack confidence maps to a level. Run the unit tests and ctest with the fake runtime analyzer; done means the merged heap finding retains its "allocated here" location.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

enhancement

Observed

The merged SARIF log carries a finding's confidence and related locations: the result property confidence, and relatedLocations. Only the concurrency analyzer reaches them today, through its bridge. The other paths drop them:

  • SARIF reader: diagnosticsFromSarif (src/Process/Tools/Sarif.cpp), used for flawfinder and the Python and runtime analyzers, reads neither relatedLocations nor properties.confidence. The runtime analyzer already writes a related location, the allocation of a heap finding ("allocated here"), and it is lost.
  • Stack analyzer bridge: toDiagnostics (src/Process/Tools/StackAnalyzerToolImplementation.cpp) drops Diagnostic::confidence, a number in [0, 1].

Proposed

  • SARIF reader: read relatedLocations (location and message) and properties.confidence.
    • Accept low, medium and high in any case: the concurrency analyzer's own SARIF writes HIGH.
    • Ignore any other value.
  • Stack analyzer bridge: map the stack analyzer's confidence to a level, with the thresholds or the level CoreTrace/coretrace-stack-analyzer#244 settles on.

The analyzers' side:

  • CoreTrace/coretrace-python-analyzer#271: confidence and related locations in the Python analyzer's SARIF;
  • CoreTrace/coretrace-runtime-analyzer#30: confidence in the runtime analyzer's SARIF;
  • CoreTrace/coretrace-stack-analyzer#244: related locations and confidence level in the stack analyzer.

Acceptance

  • Unit tests:
    • a SARIF result's related locations and confidence reach the model;
    • an unknown confidence value is ignored;
    • a stack analyzer confidence maps to a level.
  • ctest: with the fake runtime analyzer, a heap finding keeps its "allocated here" related location in the merged log.
Lingua principale
C++
Stelle
5
Fork
4
Merge medio
5h 56m
PR unite (30g)
65

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di CoreTrace/coretrace

Tutte le issue di CoreTrace/coretrace

Issue simili

Altre issue su C++

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.