combine Jas output

jfrog · attiasas · Oct 16, 2023 · Sep 21, 2023 · Sep 21, 2023 · Sep 21, 2023
commit 9fcc04fe54a72ef4458c40bdc174cb81f60fba19
diff --git a/utils/outputwriter/outputwriter.go b/utils/outputwriter/outputwriter.go
@@ -117,10 +117,6 @@ type OutputWriter interface {
 	SetVcsProvider(provider vcsutils.VcsProvider)
 	UntitledForJasMsg() string
 
-	ApplicableCveReviewContent(severity, finding, fullDetails, cve, cveDetails, impactedDependency, remediation string) string
-	// IacReviewContent(severity, finding, fullDetails string) string
-	SastReviewContent(severity, finding, fullDetails string, codeFlows [][]formats.Location) string
-
 	MarkInCenter(content string) string
 	MarkAsDetails(summary, content string) string
 }
@@ -263,9 +259,64 @@ func GetFallbackReviewCommentContent(content string, location formats.Location,
 	return MarkdownComment(ReviewCommentId) + GetLocationDescription(location) + content + writer.Footer()
 }
 
+func ApplicableCveReviewContent(severity, finding, fullDetails, cve, cveDetails, impactedDependency, remediation string, writer OutputWriter) string {
+	var contentBuilder strings.Builder
+	contentBuilder.WriteString(fmt.Sprintf("\n%s%s%s%s\n",
+		contextualAnalysisTitle,
+		writer.MarkInCenter(GetApplicabilityMarkdownDescription(writer.FormattedSeverity(severity, "Applicable"), cve, impactedDependency, finding)),
+		writer.MarkAsDetails("Description", fullDetails),
+		writer.MarkAsDetails("CVE details", cveDetails)),
+	)
+	if len(remediation) > 0 {
+		contentBuilder.WriteString(fmt.Sprintf("%s\n",
+			writer.MarkAsDetails("Remediation", remediation)),
+		)
+	}
+	return contentBuilder.String()
+}
+
 func IacReviewContent(severity, finding, fullDetails string, writer OutputWriter) string {
 	return fmt.Sprintf("\n%s%s%s\n",
 		iacTitle,
 		writer.MarkInCenter(GetJasMarkdownDescription(writer.FormattedSeverity(severity, "Applicable"), finding)),
 		writer.MarkAsDetails("Full description", fullDetails))
 }
+
+func SastReviewContent(severity, finding, fullDetails string, codeFlows [][]formats.Location, writer OutputWriter) string {
+	var contentBuilder strings.Builder
+	contentBuilder.WriteString(fmt.Sprintf("\n%s%s%s\n",
+		sastTitle,
+		writer.MarkInCenter(GetJasMarkdownDescription(writer.FormattedSeverity(severity, "Applicable"), finding)),
+		writer.MarkAsDetails("Full description", fullDetails),
+	))
+
+	if len(codeFlows) > 0 {
+		contentBuilder.WriteString(fmt.Sprintf("%s\n",
+			writer.MarkAsDetails("Code Flows", sastCodeFlowsReviewContent(codeFlows, writer)),
+		))
+	}
+	return contentBuilder.String()
+}
+
+func sastCodeFlowsReviewContent(codeFlows [][]formats.Location, writer OutputWriter) string {
+	var contentBuilder strings.Builder
+	for _, flow := range codeFlows {
+		contentBuilder.WriteString(writer.MarkAsDetails("Vulnerable data flow analysis result", sastDataFlowLocationsReviewContent(flow)))
+	}
+	return contentBuilder.String()
+}
+
+func sastDataFlowLocationsReviewContent(flow []formats.Location) string {
+	var contentBuilder strings.Builder
+	for _, location := range flow {
+		contentBuilder.WriteString(fmt.Sprintf(`
+%s %s (at %s line %d)
+`,
+			"↘️",
+			MarkAsQuote(location.Snippet),
+			location.File,
+			location.StartLine,
+		))
+	}
+	return contentBuilder.String()
+}
diff --git a/utils/outputwriter/simplifiedoutput.go b/utils/outputwriter/simplifiedoutput.go
@@ -130,67 +130,6 @@ func (smo *SimplifiedOutput) VulnerabilitiesContent(vulnerabilities []formats.Vu
 	return contentBuilder.String()
 }
 
-func (smo *SimplifiedOutput) ApplicableCveReviewContent(severity, finding, fullDetails, cve, cveDetails, impactedDependency, remediation string) string {
-	var contentBuilder strings.Builder
-	contentBuilder.WriteString(fmt.Sprintf("\n%s%s%s%s\n",
-		contextualAnalysisTitle,
-		smo.MarkInCenter(GetApplicabilityMarkdownDescription(smo.FormattedSeverity(severity, "Applicable"), cve, impactedDependency, finding)),
-		smo.MarkAsDetails("Description", fullDetails),
-		smo.MarkAsDetails("CVE details", cveDetails)),
-	)
-	if len(remediation) > 0 {
-		contentBuilder.WriteString(fmt.Sprintf("%s\n",
-			smo.MarkAsDetails("Remediation", remediation)),
-		)
-	}
-	return contentBuilder.String()
-}
-
-// func (smo *SimplifiedOutput) IacReviewContent(severity, finding, fullDetails string) string {
-// 	return fmt.Sprintf("\n%s%s%s\n",
-// 		iacTitle,
-// 		smo.MarkInCenter(GetJasMarkdownDescription(smo.FormattedSeverity(severity, "Applicable"), finding)),
-// 		smo.MarkAsDetails("Full description", fullDetails))
-// }
-
-func (smo *SimplifiedOutput) SastReviewContent(severity, finding, fullDetails string, codeFlows [][]formats.Location) string {
-	var contentBuilder strings.Builder
-	contentBuilder.WriteString(fmt.Sprintf("\n%s%s%s\n",
-		sastTitle,
-		smo.MarkInCenter(GetJasMarkdownDescription(smo.FormattedSeverity(severity, "Applicable"), finding)),
-		smo.MarkAsDetails("Full description", fullDetails),
-	))
-	if len(codeFlows) > 0 {
-		contentBuilder.WriteString(fmt.Sprintf("%s\n",
-			smo.MarkAsDetails("Code Flows", smo.sastCodeFlowsReviewContent(codeFlows)),
-		))
-	}
-	return contentBuilder.String()
-}
-
-func (smo *SimplifiedOutput) sastCodeFlowsReviewContent(codeFlows [][]formats.Location) string {
-	var contentBuilder strings.Builder
-	for _, flow := range codeFlows {
-		contentBuilder.WriteString(smo.MarkAsDetails("Vulnerable data flow analysis result", smo.sastDataFlowLocationsReviewContent(flow)))
-	}
-	return contentBuilder.String()
-}
-
-func (smo *SimplifiedOutput) sastDataFlowLocationsReviewContent(flow []formats.Location) string {
-	var contentBuilder strings.Builder
-	for _, location := range flow {
-		contentBuilder.WriteString(fmt.Sprintf(`
-%s %s (at %s line %d)
-`,
-			"↘️",
-			MarkAsQuote(location.Snippet),
-			location.File,
-			location.StartLine,
-		))
-	}
-	return contentBuilder.String()
-}
-
 func (smo *SimplifiedOutput) LicensesContent(licenses []formats.LicenseRow) string {
 	if len(licenses) == 0 {
 		return ""

diff --git a/utils/outputwriter/simplifiedoutput_test.go b/utils/outputwriter/simplifiedoutput_test.go
@@ -287,7 +287,7 @@ func TestSimplifiedOutput_ApplicableCveReviewContent(t *testing.T) {
 	so := &SimplifiedOutput{}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			output := so.ApplicableCveReviewContent(tc.severity, tc.finding, tc.fullDetails, tc.cve, tc.cveDetails, tc.impactedDependency, tc.remediation)
+			output := ApplicableCveReviewContent(tc.severity, tc.finding, tc.fullDetails, tc.cve, tc.cveDetails, tc.impactedDependency, tc.remediation, so)
 			assert.Equal(t, tc.expectedOutput, output)
 		})
 	}
@@ -383,7 +383,7 @@ func TestSimplifiedOutput_SastReviewContent(t *testing.T) {
 	so := &SimplifiedOutput{}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			output := so.SastReviewContent(tc.severity, tc.finding, tc.fullDetails, tc.codeFlows)
+			output := SastReviewContent(tc.severity, tc.finding, tc.fullDetails, tc.codeFlows, so)
 			assert.Equal(t, tc.expectedOutput, output)
 		})
 	}

diff --git a/utils/outputwriter/standardoutput.go b/utils/outputwriter/standardoutput.go
@@ -117,68 +117,6 @@ func (so *StandardOutput) VulnerabilitiesContent(vulnerabilities []formats.Vulne
 	return contentBuilder.String()
 }
 
-func (so *StandardOutput) ApplicableCveReviewContent(severity, finding, fullDetails, cve, cveDetails, impactedDependency, remediation string) string {
-	var contentBuilder strings.Builder
-	contentBuilder.WriteString(fmt.Sprintf("\n%s%s%s%s\n",
-		contextualAnalysisTitle,
-		so.MarkInCenter(GetApplicabilityMarkdownDescription(so.FormattedSeverity(severity, "Applicable"), cve, impactedDependency, finding)),
-		so.MarkAsDetails("Description", fullDetails),
-		so.MarkAsDetails("CVE details", cveDetails)),
-	)
-	if len(remediation) > 0 {
-		contentBuilder.WriteString(fmt.Sprintf("%s\n",
-			so.MarkAsDetails("Remediation", remediation)),
-		)
-	}
-	return contentBuilder.String()
-}
-
-// func (so *StandardOutput) IacReviewContent(severity, finding, fullDetails string) string {
-// 	return fmt.Sprintf("\n%s%s%s\n",
-// 		iacTitle,
-// 		so.MarkInCenter(GetJasMarkdownDescription(so.FormattedSeverity(severity, "Applicable"), finding)),
-// 		so.MarkAsDetails("Full description", fullDetails))
-// }
-
-func (so *StandardOutput) SastReviewContent(severity, finding, fullDetails string, codeFlows [][]formats.Location) string {
-	var contentBuilder strings.Builder
-	contentBuilder.WriteString(fmt.Sprintf("\n%s%s%s\n",
-		sastTitle,
-		so.MarkInCenter(GetJasMarkdownDescription(so.FormattedSeverity(severity, "Applicable"), finding)),
-		so.MarkAsDetails("Full description", fullDetails),
-	))
-
-	if len(codeFlows) > 0 {
-		contentBuilder.WriteString(fmt.Sprintf("%s\n",
-			so.MarkAsDetails("Code Flows", so.sastCodeFlowsReviewContent(codeFlows)),
-		))
-	}
-	return contentBuilder.String()
-}
-
-func (so *StandardOutput) sastCodeFlowsReviewContent(codeFlows [][]formats.Location) string {
-	var contentBuilder strings.Builder
-	for _, flow := range codeFlows {
-		contentBuilder.WriteString(so.MarkAsDetails("Vulnerable data flow analysis result", so.sastDataFlowLocationsReviewContent(flow)))
-	}
-	return contentBuilder.String()
-}
-
-func (so *StandardOutput) sastDataFlowLocationsReviewContent(flow []formats.Location) string {
-	var contentBuilder strings.Builder
-	for _, location := range flow {
-		contentBuilder.WriteString(fmt.Sprintf(`
-%s %s (at %s line %d)
-`,
-			"↘️",
-			MarkAsQuote(location.Snippet),
-			location.File,
-			location.StartLine,
-		))
-	}
-	return contentBuilder.String()
-}
-
 func (so *StandardOutput) Footer() string {
 	return fmt.Sprintf(`
 ---%s`, so.MarkInCenter(CommentGeneratedByFrogbot))

diff --git a/utils/outputwriter/standardoutput_test.go b/utils/outputwriter/standardoutput_test.go
@@ -311,7 +311,7 @@ func TestStandardOutput_ApplicableCveReviewContent(t *testing.T) {
 	so := &StandardOutput{}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			output := so.ApplicableCveReviewContent(tc.severity, tc.finding, tc.fullDetails, tc.cve, tc.cveDetails, tc.impactedDependency, tc.remediation)
+			output := ApplicableCveReviewContent(tc.severity, tc.finding, tc.fullDetails, tc.cve, tc.cveDetails, tc.impactedDependency, tc.remediation, so)
 			assert.Equal(t, tc.expectedOutput, output)
 		})
 	}
@@ -407,7 +407,7 @@ func TestStandardOutput_SastReviewContent(t *testing.T) {
 	so := &StandardOutput{}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			output := so.SastReviewContent(tc.severity, tc.finding, tc.fullDetails, tc.codeFlows)
+			output := SastReviewContent(tc.severity, tc.finding, tc.fullDetails, tc.codeFlows, so)
 			assert.Equal(t, tc.expectedOutput, output)
 		})
 	}

diff --git a/utils/reviewcomment.go b/utils/reviewcomment.go
@@ -139,14 +139,15 @@ func generateApplicabilityReviewContent(issue formats.Evidence, relatedCve forma
 	if relatedVulnerability.JfrogResearchInformation != nil {
 		remediation = relatedVulnerability.JfrogResearchInformation.Remediation
 	}
-	return outputwriter.GenerateReviewCommentContent(writer.ApplicableCveReviewContent(
+	return outputwriter.GenerateReviewCommentContent(outputwriter.ApplicableCveReviewContent(
 		relatedVulnerability.Severity,
 		issue.Reason,
 		relatedCve.Applicability.ScannerDescription,
 		relatedCve.Id,
 		relatedVulnerability.Summary,
 		fmt.Sprintf("%s:%s", relatedVulnerability.ImpactedDependencyName, relatedVulnerability.ImpactedDependencyVersion),
 		remediation,
+		writer,
 	), writer)
 }
 
@@ -160,11 +161,12 @@ func generateSourceCodeReviewContent(commentType ReviewCommentType, issue format
 			writer,
 		), writer)
 	case SastComment:
-		return outputwriter.GenerateReviewCommentContent(writer.SastReviewContent(
+		return outputwriter.GenerateReviewCommentContent(outputwriter.SastReviewContent(
 			issue.Severity,
 			issue.Finding,
 			issue.ScannerDescription,
 			issue.CodeFlow,
+			writer,
 		), writer)
 	}
 	return

diff --git a/utils/reviewcomment_test.go b/utils/reviewcomment_test.go
@@ -175,7 +175,7 @@ func TestGetNewReviewComments(t *testing.T) {
 					Type: ApplicableComment,
 					CommentInfo: vcsclient.PullRequestComment{
 						CommentInfo: vcsclient.CommentInfo{
-							Content: outputwriter.GenerateReviewCommentContent(repo.ApplicableCveReviewContent("Low", "", "", "CVE-2023-4321", "summary-2", "component-C:", ""), repo.OutputWriter),
+							Content: outputwriter.GenerateReviewCommentContent(outputwriter.ApplicableCveReviewContent("Low", "", "", "CVE-2023-4321", "summary-2", "component-C:", "", repo.OutputWriter), repo.OutputWriter),
 						},
 						PullRequestDiff: vcsclient.PullRequestDiff{
 							OriginalFilePath:    "file1",
@@ -231,7 +231,7 @@ func TestGetNewReviewComments(t *testing.T) {
 					Type: SastComment,
 					CommentInfo: vcsclient.PullRequestComment{
 						CommentInfo: vcsclient.CommentInfo{
-							Content: outputwriter.GenerateReviewCommentContent(repo.SastReviewContent("High", "XSS Vulnerability", "", [][]formats.Location{}), repo.OutputWriter),
+							Content: outputwriter.GenerateReviewCommentContent(outputwriter.SastReviewContent("High", "XSS Vulnerability", "", [][]formats.Location{}, repo.OutputWriter), repo.OutputWriter),
 						},
 						PullRequestDiff: vcsclient.PullRequestDiff{
 							OriginalFilePath:    "file1",