Skip to content

Fixed rule_id being inserted into finding_id field #1055

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
andrecsilva merged 2 commits into from
May 2, 2025
Merged

Fixed rule_id being inserted into finding_id field #1055

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
492dd78
Fixed rule_id being inserted into finding_id field
andrecsilva May 1, 2025
775cea8
Enforced finding_id in results and fixed some tests
andrecsilva May 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion src/codemodder/result.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,7 +126,9 @@ def from_sarif(
cls, sarif_result: ResultModel, sarif_run: Run, truncate_rule_id: bool = False
) -> Self:
rule_id = cls.extract_rule_id(sarif_result, sarif_run, truncate_rule_id)
finding_id = cls.extract_finding_id(sarif_result) or rule_id
finding_id = cls.extract_finding_id(sarif_result)
if not finding_id:
raise ValueError("Result does not have a finding_id.")
return cls(
rule_id=rule_id,
locations=cls.extract_locations(sarif_result, sarif_run),
Expand Down
17 changes: 16 additions & 1 deletion src/codemodder/semgrep.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
import itertools
import json
import subprocess
import uuid
from pathlib import Path
from tempfile import NamedTemporaryFile
from typing import Iterable, Optional
Expand Down Expand Up @@ -90,7 +92,9 @@ def run(
if not yaml_files:
raise ValueError("No Semgrep rules were provided")

with NamedTemporaryFile(prefix="semgrep", suffix=".sarif") as temp_sarif_file:
with NamedTemporaryFile(
prefix="semgrep", suffix=".sarif", mode="w+"
) as temp_sarif_file:
command = [
"semgrep",
"scan",
Expand All @@ -114,6 +118,17 @@ def run(
stdout=None if execution_context.verbose else subprocess.PIPE,
stderr=None if execution_context.verbose else subprocess.PIPE,
)
# Insert guid in results
temp_sarif_file.seek(0)
sarif = Sarif.model_validate(json.load(temp_sarif_file))
for run in sarif.runs:
for result in run.results or []:
if not result.guid:
result.guid = uuid.uuid4()
temp_sarif_file.seek(0)
temp_sarif_file.write(sarif.model_dump_json(exclude_none=True, by_alias=True))
temp_sarif_file.seek(0)

if call.returncode != 0:
if not execution_context.verbose:
logger.error("captured semgrep stderr: %s", call.stderr)
Expand Down
1 change: 1 addition & 0 deletions tests/codemods/semgrep/test_semgrep_django_secure_set_cookie.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@ def index(request, template):
"tool": {"driver": {"name": "Semgrep OSS"}},
"results": [
{
"guid": "ecf8007d-0eac-4151-92c7-c5dc8290f28e",
"fingerprints": {"matchBasedId/v1": "123"},
"locations": [
{
Expand Down
1 change: 1 addition & 0 deletions tests/codemods/semgrep/test_semgrep_enable_jinja2_autoescape.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@ def test_import(self, tmpdir):
"tool": {"driver": {"name": "Semgrep OSS"}},
"results": [
{
"guid": "282ad4eb-3b68-4ee4-b8ff-f779ea14b589",
"fingerprints": {"matchBasedId/v1": "123"},
"locations": [
{
Expand Down
2 changes: 2 additions & 0 deletions tests/codemods/semgrep/test_semgrep_harden_pyyaml.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@ def test_pyyaml(self, tmpdir):
"tool": {"driver": {"name": "Semgrep OSS"}},
"results": [
{
"guid": "df15a793-eea0-4fee-a65d-8923ca058265",
"fingerprints": {"matchBasedId/v1": "123"},
"locations": [
{
Expand Down Expand Up @@ -88,6 +89,7 @@ def index(request):
"tool": {"driver": {"name": "Semgrep OSS"}},
"results": [
{
"guid": "2291849a-3e04-4969-94b8-87a21e818889",
"fingerprints": {"matchBasedId/v1": "123"},
"locations": [
{
Expand Down
1 change: 1 addition & 0 deletions tests/codemods/semgrep/test_semgrep_jwt_decode_verify.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ def test_import(self, tmpdir):
"tool": {"driver": {"name": "Semgrep OSS"}},
"results": [
{
"guid": "3efd541b-4c31-4e7e-89f2-7fe0d7ebd468",
"fingerprints": {"matchBasedId/v1": "123"},
"locations": [
{
Expand Down
9 changes: 9 additions & 0 deletions tests/codemods/semgrep/test_semgrep_nan_injection.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@ def home(request):
"tool": {"driver": {"name": "Semgrep OSS"}},
"results": [
{
"guid": "b796b74b-275c-4785-b341-76170b43f6d4",
"fingerprints": {"matchBasedId/v1": "1932"},
"locations": [
{
Expand Down Expand Up @@ -178,6 +179,7 @@ def view(request):
"tool": {"driver": {"name": "Semgrep OSS"}},
"results": [
{
"guid": "6470e0a8-2eeb-4268-8677-f96161207b40",
"fingerprints": {"matchBasedId/v1": "1fdbd5a"},
"locations": [
{
Expand All @@ -204,6 +206,7 @@ def view(request):
"ruleId": "python.django.security.nan-injection.nan-injection",
},
{
"guid": "b3056d9a-1618-40be-bf5e-989278305cf0",
"fingerprints": {"matchBasedId/v1": "1fdbd5a"},
"locations": [
{
Expand All @@ -230,6 +233,7 @@ def view(request):
"ruleId": "python.django.security.nan-injection.nan-injection",
},
{
"guid": "3356587c-dd3a-49e1-baee-0aafc0a91511",
"fingerprints": {"matchBasedId/v1": "1fdbd5a"},
"locations": [
{
Expand All @@ -256,6 +260,7 @@ def view(request):
"ruleId": "python.django.security.nan-injection.nan-injection",
},
{
"guid": "626d3911-ed0b-414d-a2c9-af2245b0baee",
"fingerprints": {"matchBasedId/v1": "1fdbd5a"},
"locations": [
{
Expand Down Expand Up @@ -315,6 +320,7 @@ def view(request):
"tool": {"driver": {"name": "Semgrep OSS"}},
"results": [
{
"guid": "60e089cd-472e-489e-a264-cfc6e33e651a",
"fingerprints": {"matchBasedId/v1": "asdfg"},
"locations": [
{
Expand Down Expand Up @@ -373,6 +379,7 @@ def view(request):
"tool": {"driver": {"name": "Semgrep OSS"}},
"results": [
{
"guid": "014e3945-144d-4c28-960b-4dd09f2a2b8f",
"fingerprints": {"matchBasedId/v1": "q324"},
"locations": [
{
Expand Down Expand Up @@ -429,6 +436,7 @@ def view(request):
"tool": {"driver": {"name": "Semgrep OSS"}},
"results": [
{
"guid": "d0540cd9-b999-4756-8392-ca2702e94438",
"fingerprints": {"matchBasedId/v1": "asdtg"},
"locations": [
{
Expand Down Expand Up @@ -487,6 +495,7 @@ def view(request):
"tool": {"driver": {"name": "Semgrep OSS"}},
"results": [
{
"guid": "33ffdd04-0f27-475c-8c11-2405e9b77526",
"fingerprints": {"matchBasedId/v1": "asd2"},
"locations": [
{
Expand Down
2 changes: 2 additions & 0 deletions tests/codemods/semgrep/test_semgrep_no_csrf_exempt.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,7 @@ def foo():
"tool": {"driver": {"name": "Semgrep OSS"}},
"results": [
{
"guid": "8a8007b3-404d-4107-9e0d-4bb11536b78c",
"fingerprints": {"matchBasedId/v1": "a3ca2"},
"locations": [
{
Expand All @@ -105,6 +106,7 @@ def foo():
"ruleId": "python.django.security.audit.csrf-exempt.no-csrf-exempt",
},
{
"guid": "71260758-6dee-4c96-a4e3-22b143b2633e",
"fingerprints": {"matchBasedId/v1": "1cc62"},
"locations": [
{
Expand Down
1 change: 1 addition & 0 deletions tests/codemods/semgrep/test_semgrep_rsa_key_size.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ def _run_and_assert_with_results(self, tmpdir, input_code, expected_output):
"tool": {"driver": {"name": "Semgrep OSS"}},
"results": [
{
"guid": "55b6e8fa-8e41-4470-b887-05c02a5e1196",
"fingerprints": {"matchBasedId/v1": "123"},
"locations": [
{
Expand Down
5 changes: 5 additions & 0 deletions tests/codemods/semgrep/test_semgrep_sql_parametrization.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,7 @@ def f():
"tool": {"driver": {"name": "Semgrep OSS"}},
"results": [
{
"guid": "2273caac-50fa-409d-97e8-a39219eb9afe",
"fingerprints": {"matchBasedId/v1": "123"},
"locations": [
{
Expand Down Expand Up @@ -110,6 +111,7 @@ def f():
"ruleId": "python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute",
},
{
"guid": "8e8fed36-7e72-4b1f-ad49-2e1a50587595",
"fingerprints": {"matchBasedId/v1": "123"},
"locations": [
{
Expand Down Expand Up @@ -137,6 +139,7 @@ def f():
"ruleId": "python.lang.security.audit.formatted-sql-query.formatted-sql-query",
},
{
"guid": "300df87d-e713-4cd4-a245-d64f25be03de",
"fingerprints": {"matchBasedId/v1": "123"},
"locations": [
{
Expand Down Expand Up @@ -164,6 +167,7 @@ def f():
"ruleId": "python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query",
},
{
"guid": "24695222-6db9-4e12-8555-c5e74eb7fe0f",
"fingerprints": {"matchBasedId/v1": "123"},
"locations": [
{
Expand Down Expand Up @@ -191,6 +195,7 @@ def f():
"ruleId": "python.django.security.injection.tainted-sql-string.tainted-sql-string",
},
{
"guid": "c8355088-665d-4fe1-8790-725964ba0769",
"fingerprints": {"matchBasedId/v1": "123"},
"locations": [
{
Expand Down
1 change: 1 addition & 0 deletions tests/codemods/semgrep/test_semgrep_subprocess_shell_false.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@ def test_import(self, tmpdir):
"tool": {"driver": {"name": "Semgrep OSS"}},
"results": [
{
"guid": "84d249d9-2a25-4279-a5af-2a7739a06de6",
"fingerprints": {"matchBasedId/v1": "123"},
"locations": [
{
Expand Down
2 changes: 2 additions & 0 deletions tests/codemods/semgrep/test_semgrep_url_sandbox.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,7 @@ def example():
"tool": {"driver": {"name": "Semgrep OSS"}},
"results": [
{
"guid": "9cbf64ee-ea3d-418f-bdf8-97ec7a2d3418",
"fingerprints": {"matchBasedId/v1": "370059975f"},
"locations": [
{
Expand Down Expand Up @@ -71,6 +72,7 @@ def example():
"ruleId": "python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests",
},
{
"guid": "ba4cedcd-88fd-468b-be73-7df829d11802",
"fingerprints": {"matchBasedId/v1": "cd899"},
"locations": [
{
Expand Down
1 change: 1 addition & 0 deletions tests/codemods/semgrep/test_semgrep_use_defused_xml.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@ def test_etree_parse(self, add_dependency, tmpdir):
"tool": {"driver": {"name": "Semgrep OSS"}},
"results": [
{
"guid": "e76d2149-3b55-4292-a4c6-49f67dc73f97",
"fingerprints": {"matchBasedId/v1": "123"},
"locations": [
{
Expand Down
3,360 changes: 3,359 additions & 1 deletion tests/samples/codeql/python/vulnerable-code-snippets.json
View file
Open in desktop

Large diffs are not rendered by default.

Loading
Loading