am 199 - fix jfrog sast name

Author: hadarshjfrog

audit_test.go

@@ -621,6 +621,8 @@ func TestXrayAuditJasSarif(t *testing.T) {
 		Undetermined:    1,
 		NotCovered:      1,
 		NotApplicable:   2,
+
+		SastDescSuffix: "JFrog SAST",
 	})
 }
 

jas/analyzermanager.go

@@ -24,7 +24,7 @@ import (
 const (
 	ApplicabilityFeatureId                    = "contextual_analysis"
 	AnalyzerManagerZipName                    = "analyzerManager.zip"
-	defaultAnalyzerManagerVersion             = "1.9.8"
+	defaultAnalyzerManagerVersion             = "1.9.9"
 	analyzerManagerDownloadPath               = "xsc-gen-exe-analyzer-manager-local/v1"
 	analyzerManagerDirName                    = "analyzerManager"
 	analyzerManagerExecutableName             = "analyzerManager"

jas/sast/sastscanner.go

@@ -76,12 +76,16 @@ type sastScanConfig struct {
 }
 
 type scanConfiguration struct {
-	Roots              []string `yaml:"roots,omitempty"`
-	Type               string   `yaml:"type,omitempty"`
-	Language           string   `yaml:"language,omitempty"`
-	ExcludePatterns    []string `yaml:"exclude_patterns,omitempty"`
-	ExcludedRules      []string `yaml:"excluded-rules,omitempty"`
-	SignedDescriptions bool     `yaml:"signed_descriptions,omitempty"`
+	Roots           []string       `yaml:"roots,omitempty"`
+	Type            string         `yaml:"type,omitempty"`
+	Language        string         `yaml:"language,omitempty"`
+	ExcludePatterns []string       `yaml:"exclude_patterns,omitempty"`
+	ExcludedRules   []string       `yaml:"excluded-rules,omitempty"`
+	SastParameters  sastParameters `yaml:"sast_parameters,omitempty"`
+}
+
+type sastParameters struct {
+	SignedDescriptions bool `yaml:"signed_descriptions,omitempty"`
 }
 
 func (ssm *SastScanManager) createConfigFile(module jfrogappsconfig.Module, signedDescriptions bool, exclusions ...string) error {
@@ -96,12 +100,12 @@ func (ssm *SastScanManager) createConfigFile(module jfrogappsconfig.Module, sign
 	configFileContent := sastScanConfig{
 		Scans: []scanConfiguration{
 			{
-				Type:               sastScannerType,
-				Roots:              roots,
-				Language:           sastScanner.Language,
-				ExcludedRules:      sastScanner.ExcludedRules,
-				SignedDescriptions: signedDescriptions,
-				ExcludePatterns:    jas.GetExcludePatterns(module, &sastScanner.Scanner, exclusions...),
+				Type:            sastScannerType,
+				Roots:           roots,
+				Language:        sastScanner.Language,
+				ExcludedRules:   sastScanner.ExcludedRules,
+				SastParameters:  sastParameters{SignedDescriptions: signedDescriptions},
+				ExcludePatterns: jas.GetExcludePatterns(module, &sastScanner.Scanner, exclusions...),
 			},
 		},
 	}

utils/validations/test_validate_sarif.go

@@ -15,7 +15,8 @@ import (
 )
 
 const (
-	SastToolName = "USAF"
+	//TODO: Validate if we need a frog emoji before the name
+	SastToolName = " JFrog SAST"
 	IacToolName  = "JFrog Terraform scanner"
 	// #nosec G101 -- Not credentials.
 	SecretsToolName = "JFrog Secrets scanner"
@@ -50,7 +51,9 @@ func ValidateSarifIssuesCount(t *testing.T, params ValidationParams, report *sar
 	secrets := sarifutils.GetResultsLocationCount(sarifutils.GetRunsByToolName(report, SecretsToolName)...)
 	secrets += sarifutils.GetResultsLocationCount(sarifutils.GetRunsByToolName(report, sarifparser.BinarySecretScannerToolName)...)
 	vulnerabilities += secrets
-	sast := sarifutils.GetResultsLocationCount(sarifutils.GetRunsByToolName(report, SastToolName)...)
+
+	sastRuns := sarifutils.GetRunsByToolName(report, SastToolName)
+	sast := sarifutils.GetResultsLocationCount(sastRuns...)
 	vulnerabilities += sast
 
 	scaRuns := sarifutils.GetRunsByToolName(report, sarifparser.ScaScannerToolName)
@@ -88,6 +91,13 @@ func ValidateSarifIssuesCount(t *testing.T, params ValidationParams, report *sar
 		}
 	}
 
+	for _, run := range sastRuns {
+		for _, rule := range run.Tool.Driver.Rules {
+			ValidateContent(t, false,
+				StringValidation{Expected: params.SastDescSuffix, Actual: *rule.ShortDescription.Text, Msg: "rule description does not contain expected substring"},
+			)
+		}
+	}
 	ValidateContent(t, params.ExactResultsMatch,
 		CountValidation[int]{Expected: params.Sast, Actual: sast, Msg: GetValidationCountErrMsg("sast", "sarif report", params.ExactResultsMatch, params.Sast, sast)},
 		CountValidation[int]{Expected: params.Iac, Actual: iac, Msg: GetValidationCountErrMsg("Iac", "sarif report", params.ExactResultsMatch, params.Iac, iac)},

utils/validations/test_validation.go

@@ -28,6 +28,8 @@ type ValidationParams struct {
 	Expected interface{}
 	// If provided, the test will check exact values and not only the minimum values / existence.
 	ExactResultsMatch bool
+	// The Sast scanner addition to the description.
+	SastDescSuffix string
 	// Expected issues for each type to check if the content has the correct amount of issues.
 	Vulnerabilities       int
 	Licenses              int