SARIF Importer for CodeSonar: Example

• Sample Files
• Set Up and Run the Analysis
• Analysis Results

Sample Files

We have provided the following files for this example.

This example will set up a Makefile to be used with make to compile the source code and invoke the SARIF importer. If you use a different build system, replace the Makefile edits and make invocations described below with their equivalents in the system you are using.

Note

Set Up and Run the Analysis

1. Choose a name for the new CodeSonar project. In the remainder of these instructions, we will call it Hello.
2. Create a working directory. The working directory location must be outside both your CodeSonar installation directory and your hub directory.
3. Save (right-click on the link and select Save Target As... or equivalent) hello.c and hello.sarif to a working directory.
4. cd to the working directory.
5. Set up a build using your regular build system. It should compile hello.c with a C compiler.

   For example, if you are using make then create a Makefile like the following.

   CC = gcc
   .PHONY: all clean
   
   all: hello
   
   hello: hello.o
           $(CC) -o hello hello.o
   
   hello.o: hello.c
           $(CC) -c hello.c
   
   clean:
           rm -f *.o *.exe *~ core
   

6. Check the build you just created.
   1. Execute the build.
      make all
   2. Check the results: has the expected binary file been created?
   3. Clean up the build artifacts.
      make clean
7. Extend the build to add a variant that invokes codesonar import_sarif.py hello.sarif once the compilation has taken place.

   If you are using make, your Makefile will now look like the following.

   CC = gcc
   .PHONY: all clean csonar_scan
   
   all: hello
   
   hello: hello.o
           $(CC) -o hello hello.o
   
   hello.o: hello.c
           $(CC) -c hello.c
   
   clean:
           rm -f *.o *.exe *~ core
   
   csonar_scan: all hello.sarif
           codesonar import_sarif.py hello.sarif
   
   

8. Build and analyze a CodeSonar project, using a codesonar analyze command based on the build variant you just added.
   codesonar build Hello make csonar_scan
9. Open the hub GUI Analysis page for the analysis and go on to Analysis Results.

Analysis Results

The Analysis: Warnings tab will list one warning of class "C1023 name" and one warning of class "C1729 name", as shown in the following screenshot fragment.

1. Click the warning class name "C1023 name" to navigate to its Warning Report.
2. Inspect the warning report.
   

   The warning location (highlighted in red and with the warning description box attached) is line 10 of hello.c. There are two interesting locations (code lines highlighted in blue).

3. The features of the warning instance described by the report are specified by the properties of the object at results[0] in hello.sarif, which is reproduced below.
   • The runs property is an array containing one run object.
   • The runs[0].tool.driver.rules property is an array that contains two rule objects, which the SARIF importer will use to create two warning classes. The warning class names are "C1023 name" and "C1729 name", and they can be referenced in the remainder of the SARIF file using ID "C1023" and "C1729" respectively.
   • The runs[0].results property contains two result objects, which the SARIF importer will use to create two warning instances. The following details are specific to runs[0].results[0]:
     • The message value is "End point" and will be reproduced in the warning's warning description box.
     • This result object uses a ruleIndex whose value is "1" and does not use a ruleID.
     • That ruleIndex property navigates to the runs[0].tool.driver.rules[1] object. This object defines the "C1023 name" warning class, adds the text "This is a pathy warning", and a link to more information about the warning in the warning description box.
   • There is a codeFlows property and a locations property. Because both are present, the SARIF importer will take information about the warning location and core path from the codeFlows and locations properties.
     • Contained within the results object is a codeFlows array with a single element whose threadFlows array contains two locations objects. These locations objects correspond to the interesting locations described above (code lines highlighted in blue).
     • The results object also contains a locations array whose sole element corresponds to the warning location described above (highlighted in red).

hello.sarif

{
  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
  "version": "2.1.0",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "CodeSkanner",
          "rules": [
            {
              "id": "C1729",
              "name": "C1729 name",
              "fullDescription": {
                "text": "This is a simple warning."
              },
              "helpUri": "https://example.com/rules/C1729"
            },
            {
              "id": "C1023",
              "name": "C1023 name",
              "fullDescription": {
                "text": "This is a pathy warning."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://example.com/rules/C1023"
            }
          ]
        }
      },
      "artifacts": [
        {
          "location": {
            "uri": "hello.c"
          },
          "mimeType": "text/c"
        }
      ],
      "results": [
        {
          "ruleId": "C1023",
          "ruleIndex": 1,
          "message": {
            "text": "end point."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                    "index": 0
                },
                "region": {
                  "startLine": 10,
                  "startColumn": 5,
                  "endLine": 10,
                  "endColumn": 6
                }
              }
            }
          ],
          "codeFlows": [
            {
              "threadFlows": [
                {
                  "locations": [
                    {
                      "location": {
                        "physicalLocation": {
                          "artifactLocation": {
                              "index": 0
                          },
                          "region": {
                            "startLine": 16,
                            "startColumn": 5,
                            "endLine": 16,
                            "endColumn": 6
                          }
                        },
                        "message": {
                          "text": "First point; essential."
                        }
                      },
                      "importance": "essential"
                    },
                    {
                      "location": {
                        "physicalLocation": {
                          "artifactLocation": {
                              "index": 0
                          },
                          "region": {
                            "startLine": 19,
                            "startColumn": 5,
                            "endLine": 19,
                            "endColumn": 9
                          }
                        },
                        "message": {
                          "text": "Second point in flow: important."
                        }
                      },
                      "importance": "essential"
                    }
                  ]
                }
              ]
            }
          ]
        },
        {
          "ruleId": "C1729",
          "ruleIndex": 0,
          "message": {
            "text": "This is a violation of C1729."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                    "index": 0
                },
                "region": {
                  "startLine": 4
                }
              }
            }
          ],
          "hostedViewerUri": "https://example.com/search?q=1729"
        }
      ],
      "columnKind": "utf16CodeUnits"
    }
  ]
}