Documentation
¶
Overview ¶
Package sarif provides Draugr's result currency: a pragmatic model of SARIF 2.1.0 findings, plus merge and deduplication. Every scanner normalizes its output to a Report; the engine merges reports and the result can be serialized to standard SARIF JSON for GitHub / Azure DevOps / GitLab.
Index ¶
Constants ¶
const Version = "2.1.0"
Version is the SARIF specification version Draugr emits.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Level ¶
type Level string
Level is the severity of a result, mirroring SARIF's result.level.
const ( LevelError Level = "error" LevelWarning Level = "warning" LevelNote Level = "note" LevelNone Level = "none" )
The SARIF result levels.
type Location ¶
type Location struct {
URI string `json:"uri,omitempty"`
StartLine int `json:"startLine,omitempty"`
}
Location points at where a finding was observed.
type Report ¶
Report is a set of findings, normalized to SARIF semantics. Tool names the primary scanner; when a report carries results from several tools (after Merge), each Result keeps its own Tool.
func FromSARIF ¶
FromSARIF parses standard SARIF 2.1.0 JSON into a Report, flattening all runs and setting each result's Tool from its run's driver name.
func Merge ¶
Merge combines reports into one, deduplicating results by fingerprint and preserving first-seen order. Each result's Tool is backfilled from its source report when unset.
func (Report) Dedup ¶
Dedup returns a copy with exact-duplicate results removed, preserving first-seen order.
func (Report) Highest ¶
Highest returns the most severe level present, or LevelNone when there are no results.
func (Report) MarshalSARIF ¶
MarshalSARIF serializes the report to standard SARIF 2.1.0 JSON as a single "Draugr" run, with each result's originating scanner recorded in its property bag ("tool").
type Result ¶
type Result struct {
// Tool is the scanner that produced the finding.
Tool string `json:"tool,omitempty"`
RuleID string `json:"ruleId"`
Level Level `json:"level"`
Message string `json:"message"`
Location Location `json:"location,omitempty"`
// Score is the finding's numeric CVSS-style severity (0–10), sourced from the SARIF
// "security-severity" property. HasScore reports whether a score was present; without
// one, normalized Severity falls back to Level.
Score float64 `json:"score,omitempty"`
HasScore bool `json:"-"`
// Priority is the computed action band (P1–P4) for this finding, stamped by the engine
// from the component's risk classification. Empty when prioritization is not configured.
Priority string `json:"priority,omitempty"`
}
Result is a single finding.
func (Result) Fingerprint ¶
Fingerprint is a stable identifier for deduplication: two results with the same fingerprint are considered the same finding.
func (Result) Severity ¶ added in v0.5.0
Severity resolves a finding's normalized severity, in the order the SARIF/prioritization design prescribes:
- the finding's numeric score (CVSS / SARIF security-severity), if present;
- otherwise its SARIF level;
- then raised to floor if floor is more severe (a control-default floor, e.g. a leaked secret is never "low"). Pass an empty floor for no floor.
type Severity ¶ added in v0.5.0
type Severity string
Severity is Draugr's normalized, cross-control severity ladder. Unlike Level (the SARIF wire values error/warning/note), Severity is what prioritization ranks on: it splits a numeric CVSS-style score into four bands so a dependency CVE, a leaked secret, and an IaC misconfiguration can share one ordered list. See docs/concepts.md (prioritization).
const ( SeverityCritical Severity = "critical" SeverityHigh Severity = "high" SeverityMedium Severity = "medium" SeverityLow Severity = "low" )
Severity bands, from most to least severe.
Source Files