Documentation
¶
Overview ¶
Package rangefix turns a line-only finding into an editor range.
The SARIF writer emits StartLine, EndLine and a snippet, and never a column (internal/sast/sarif.go). SARIF's Region type supports columns; Vulnetix does not populate them, because the rule engine reports line granularity.
An editor needs a character range. Without one every finding underlines the whole line, the lightbulb anchors to the whole line, and "suppress this secret" reads as though it applies to the entire statement.
Columns are synthesized here rather than fixed in the SARIF writer on purpose. That writer's output feeds vdb-api ingestion, GitHub code scanning and the SARIF round-trip golden tests, so changing it has a blast radius far beyond the editor. Columns are also fingerprint-neutral: a fingerprint is sha256(RuleID \x00 ArtifactURI \x00 StartLine), so nothing downstream depends on their absence.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func SplitLines ¶
SplitLines splits document text into lines for Columns.
Handles LF, CRLF and a leading byte-order mark. The BOM is stripped from the first line only: left in place it shifts every column on line 1 by one, which is the kind of off-by-one that only shows up on Windows-authored files.
Types ¶
type Confidence ¶
type Confidence string
Confidence describes how the range was derived, so the editor can render an approximate position differently from an exact one instead of implying a precision it does not have.
const ( // ConfidenceExact means the snippet was found on the line and the range // covers it. ConfidenceExact Confidence = "exact" // ConfidenceSnippet means the snippet matched after normalisation, for // instance ignoring leading whitespace differences. ConfidenceSnippet Confidence = "snippet" // ConfidenceLine means no snippet match was possible and the range covers // the line's non-whitespace content. ConfidenceLine Confidence = "line" )
type Options ¶
type Options struct {
// Kind is the rule kind ("secrets", "sast", "iac", "oci"). Secrets get an
// extra narrowing pass; see narrowToSecretValue.
Kind string
// Snippet is the finding's captured source text. May be empty, and may span
// several lines when --snippet-context was used.
Snippet string
}
Options tune the derivation for a particular finding.
type Position ¶
Position is a zero-based line and a zero-based character offset measured in UTF-16 code units, matching the LSP default position encoding.
type Result ¶
type Result struct {
Range Range
Confidence Confidence
}
Result is a derived range plus how much to trust it.
func Columns ¶
Columns derives an editor range for a finding that carries only line numbers.
doc is the CURRENT text of the document, split into lines, which is not necessarily the text the finding was produced from: the user may have typed since. startLine and endLine are 1-based, as SARIF reports them.
Returns ok=false when the finding cannot be placed, which callers must treat as "drop this diagnostic" rather than "clamp it somewhere". A stale finding pointing confidently at the wrong line is worse than a missing one; the document is rescanned moments later anyway.
Source Files