sarif-cli/notes

• The notes directory
  • The typegraphs
  • The automationDetails.id

The notes directory

This directory is for notes that may be useful, but aren't complete enough to serve as documentation in their current state.

Think of it as staging for ../docs.

Short notes start as sections in this README. They will be moved if separate file make more sense.

The typegraphs

The type graph files are derived from a sarif input file, with various options controlling output.

To produce dot maps of a sarif file type graph, from raw (largest) to fully filled (most compact):

  cd ../data/treeio/2022-02-25

  # Everything:
  ../../../bin/sarif-to-dot -t -d  results.sarif | dot -Tpdf > typegraph-td.pdf

  # Suppress edges to int/bool/string types in dot graph
  ../../../bin/sarif-to-dot -td -n results.sarif | dot -Tpdf > typegraph-tdn.pdf

  # Additionally, only report unique array entry signatures
  ../../../bin/sarif-to-dot -td -nu results.sarif | dot -Tpdf > typegraph-tdnu.pdf

  # Additionally, fill in missing (optional) entries in sarif input before other steps.
  ../../../bin/sarif-to-dot -td -nuf results.sarif | dot -Tpdf > typegraph-tdnuf.pdf

The automationDetails.id

The automationDetails.id entry is produced by CodeQL when using the --sarif-category flag.

Using

  0:$ codeql --version
  CodeQL command-line toolchain release 2.12.6.

and running

  cd ../data/codeql-dataflow-sql-injection/ &&
        sarif-extract-scans-runner - > /dev/null <<EOF
  sqlidb-0.sarif
  EOF

results in

  hohn@gh-hohn ~/local/sarif-cli
  0:$ cat data/codeql-dataflow-sql-injection/sqlidb-0.sarif.csv
  sarif_file,level,levelcode,message,extra_info
  sqlidb-0.sarif,WARNING,2,Input sarif is missing neccesary properties.,"Missing: {'versionControlProvenance', 'newlineSequences'}, "

An older version is needed.

  export GITHUB_TOKEN=...

  gh codeql list-versions
  gh codeql download v2.12.7
  gh codeql download v2.11.6
  gh codeql download v2.10.5
  gh codeql download v2.9.4

  gh codeql install-stub 

  gh codeql set-version v2.11.6

Some hacking around qlpacks is required; see ../data/build-multiple-sarifs.sh, Pack compatibility with CLI.

Using that, I get sarif files to examine:

  hohn@gh-hohn ~/local/sarif-cli/data/codeql-dataflow-sql-injection
  0:$ ls -la sqlidb*.sarif
  -rw-r--r-- 1 hohn staff 6.2K Jul 11 10:39 sqlidb-0.sarif
  -rw-r--r-- 1 hohn staff 6.3K Jul 11 10:40 sqlidb-1.sarif

and only the second has the additional field:

  0:$ grep -A2 automationDetails sqlidb*.sarif
  sqlidb-1.sarif:    "automationDetails" : {
  sqlidb-1.sarif-      "id" : "mast-issue/"
  sqlidb-1.sarif-    },