Change to jsonpath for tag processing (#11)

Author: ctcampbell

.github/workflows/codeql-analysis.yml

@@ -49,7 +49,7 @@ jobs:
         # If you wish to specify custom queries, you can do so here or in a config file.
         # By default, queries listed here will override any specified in a config file.
         # Prefix the list here with "+" to use these queries and those in the config file.
-        # queries: ./path/to/local/query, your-org/your-repo/queries@main
+        queries: +security-extended
 
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)

.github/workflows/test.yml

@@ -22,6 +22,7 @@ jobs:
       - uses: ./
         with:
           sarifFile: test-data/webgoat.sarif
+      - run: grep -c '"owasp-top10-2021"' test-data/webgoat.sarif
       - name: Archive SARIF output
         uses: actions/upload-artifact@v3
         with:

.gitignore

@@ -1,4 +1,4 @@
-test-data/java-with-security-standard-tag.sarif
+test-data/webgoat-with-security-standard-tag.sarif
 
 # Dependency directory
 node_modules

.vscode/tasks.json

@@ -6,7 +6,7 @@
         {
             "label": "Remove output SARIF file",
             "type": "shell",
-            "command": "rm ${workspaceFolder}/test-data/java-with-security-standard-tag.sarif"
+            "command": "rm ${workspaceFolder}/test-data/webgoat-with-security-standard-tag.sarif"
         },
         {
             "label": "Build & remove output SARIF file",

README.md

@@ -31,6 +31,9 @@ inputs:
   cweFile:
     required: false
     description: 'The CWE list XML file, defaults to OWASP Top 10 2021'
+  cweIdXpath:
+    required: false
+    description: 'The XPath query that selects CWE ID numbers from the CWE list file'
   securityStandardTag:
     required: false
     description: 'The security standard tag to add to the SARIF file'

action.yml

@@ -8,10 +8,12 @@ inputs:
   cweFile:
     required: false
     description: 'The CWE list XML file, defaults to OWASP Top 10 2021'
+  cweIdXpath:
+    required: false
+    description: 'The XPath query that selects CWE ID numbers from the CWE list file'
   securityStandardTag:
     required: false
-    description: 'The security standard tag to add to the SARIF file'
-    default: 'owasp-top10-2021'
+    description: 'The security standard tag to add to the SARIF file, defaults to "owasp-top10-2021"'
   outputFile:
     required: false
     description: 'The output SARIF file path, defaults to the input SARIF file path'