Visitar URL original
SARIF short titles by filling `tool.driver.rules` and CVSS score by dancewithheart · Pull Request #75 · MangoIV/cabal-audit · GitHub
Skip to content

SARIF short titles by filling tool.driver.rules and CVSS score - #75

Draft
dancewithheart wants to merge 2 commits into
MangoIV:mainfrom
dancewithheart:sarif-github-code-scanning
Draft

SARIF short titles by filling tool.driver.rules and CVSS score#75
dancewithheart wants to merge 2 commits into
MangoIV:mainfrom
dancewithheart:sarif-github-code-scanning

Conversation

@dancewithheart

@dancewithheart dancewithheart commented Apr 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Changes in SARIF

  1. fill properties.tags

SARIF support for code scanning states that:

properties.tags[]
Code scanning uses tags to allow you to filter results on GitHub. For example, it is possible to filter to all results that have the tag security.

  1. fills properties.security-severity (recently improved in add CVSS 3.1 temporalMetrics and environmentalMetrics haskell/security-advisories#322 and Support missing features CVSS V4 haskell/security-advisories#327))

properties.security-severity
the results with the highest security-severity, and highest precision are shown first. Code scanning translates numerical scores as follows: over 9.0 is critical, from 7.0 to 8.9 is high, from 4.0 to 6.9 is medium and from 0.1 to 3.9 is low

tags includes security

this is why there is security in tags

before:

"properties": {}

now they are emitted:

"properties": {
  "security-severity": "7.5",
  "tags": [
    "security",
    "external/hsec/HSEC-2023-0007",
    "external/cwe/cwe-1284",
    "external/cwe/cwe-789"
  ]
}

I tested on Github code scanning UI properly render by severity and allow filtering using tags.

  1. fills tool.driver.rules that allows GitHub code scanning to show concise alert titles

before

"tool": {
  "driver": {
  "name": "cabal-audit",
  "rules": [],
  "version": "1.0.0.0"
}

after:

"tool": {
  "driver": {
    "name": "cabal-audit",
    "rules": [
      {
         "defaultConfiguration": { "level": "error" },
          "fullDescription": {
             "text": "Haskell Security Advisory: readFloat: memory exhaustion with large exponent. Keywords: toml, parser, dos"
          },
          "helpUri": "https://haskell.github.io/security-advisories/advisory/HSEC-2023-0007",
          "id": "HSEC-2023-0007",
          "name": "HSEC-2023-0007",
          "properties": {},
          "shortDescription": {
              "text": "readFloat: memory exhaustion with large exponent"
           }
          }
    ],
  "version": "1.0.0.0"
},

This fixes blackheaven/haskell-security-action#2

Pictures before and after rendering on Github: blackheaven/haskell-security-action#2 (comment)

@dancewithheart dancewithheart changed the title Files and code locations in output SARIF Short titles and file locations in output SARIF Apr 22, 2026
@dancewithheart dancewithheart mentioned this pull request Apr 22, 2026
Open
@dancewithheart
dancewithheart marked this pull request as ready for review April 22, 2026 16:42
This was referenced Apr 22, 2026
Open
Open
@dancewithheart dancewithheart mentioned this pull request May 10, 2026
Closed
@dancewithheart
dancewithheart marked this pull request as draft May 21, 2026 11:59
@dancewithheart
dancewithheart force-pushed the sarif-github-code-scanning branch from ae23f99 to e1661c8 Compare May 30, 2026 17:42
@dancewithheart dancewithheart changed the title Short titles and file locations in output SARIF SARIF short titles by filling tool.driver.rules and CVSS score May 30, 2026
@dancewithheart
dancewithheart force-pushed the sarif-github-code-scanning branch from 1e5802b to e1dc803 Compare May 30, 2026 19:46
@dancewithheart dancewithheart mentioned this pull request May 31, 2026
Merged
@dancewithheart
dancewithheart marked this pull request as ready for review May 31, 2026 22:08
This was referenced Jun 1, 2026
Open
Draft
@dancewithheart
dancewithheart marked this pull request as draft October 18, 2026 06:20
@dancewithheart
dancewithheart force-pushed the sarif-github-code-scanning branch from 1316054 to b0e62dc Compare October 31, 2026 00:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Give short titles

1 participant

@dancewithheart