Add Sast and Review tests

jfrog · attiasas · Oct 16, 2023 · Sep 21, 2023 · Sep 21, 2023 · Sep 21, 2023
commit b62cdee81e717c33468ca735a61f3f4d1fefb029
diff --git a/go.mod b/go.mod
@@ -115,3 +115,5 @@ require (
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 )
+
+replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 v2.31.1-0.20230921113452-0414290c7deb
diff --git a/go.sum b/go.sum
@@ -883,8 +883,8 @@ github.com/jfrog/froggit-go v1.14.2 h1:55x1anQtaiARlSBMVT59aFU6Mmx90tpcvvAuuPsZm
 github.com/jfrog/froggit-go v1.14.2/go.mod h1:0jRAaZZusaFFnITosmx6CA60SKryuoaCasJyUrP/c1s=
 github.com/jfrog/gofrog v1.3.0 h1:o4zgsBZE4QyDbz2M7D4K6fXPTBJht+8lE87mS9bw7Gk=
 github.com/jfrog/gofrog v1.3.0/go.mod h1:IFMc+V/yf7rA5WZ74CSbXe+Lgf0iApEQLxRZVzKRUR0=
-github.com/jfrog/jfrog-cli-core/v2 v2.43.3 h1:aZN+ZP2vIBBw2+U9F/iQ4Q2USmfXcxB8yN755azvjQo=
-github.com/jfrog/jfrog-cli-core/v2 v2.43.3/go.mod h1:DKTOX9TsPkyI68GM4XdDTD7XDr+tOBqeK70DZZmu+4Q=
+github.com/jfrog/jfrog-cli-core/v2 v2.31.1-0.20230921113452-0414290c7deb h1:XZwpeMkPPlaRvqqdPTZYdz+y5H9s19kYNEAHSp+j6x4=
+github.com/jfrog/jfrog-cli-core/v2 v2.31.1-0.20230921113452-0414290c7deb/go.mod h1:DKTOX9TsPkyI68GM4XdDTD7XDr+tOBqeK70DZZmu+4Q=
 github.com/jfrog/jfrog-client-go v1.32.3 h1:B2M8Gu8EMrokbHWPPDgN1b7YRWwf0oe746epvQASK6c=
 github.com/jfrog/jfrog-client-go v1.32.3/go.mod h1:UewnwkIf/77HzBgwCPzOHZCK6V/Nw5/JwdzN/tRb4aU=
 github.com/jordan-wright/email v4.0.1-0.20210109023952-943e75fe5223+incompatible h1:jdpOPRN1zP63Td1hDQbZW73xKmzDvZHzVdNYxhnTMDA=

diff --git a/utils/outputwriter/outputwriter_test.go b/utils/outputwriter/outputwriter_test.go
@@ -62,3 +62,118 @@ func testGetLicensesTableContent(t *testing.T, writer OutputWriter) {
 	expected = "\n| License1 | Comp1 1.0 | Dep1 2.0 |\n| License2 | Comp2 2.0 | Dep2 3.0 |"
 	assert.Equal(t, expected, result)
 }
+
+func TestMarkAsQuote(t *testing.T) {
+	testCases := []struct {
+		input          string
+		expectedOutput string
+	}{
+		{
+			input:          "",
+			expectedOutput: "``",
+		},
+		{
+			input:          "quote",
+			expectedOutput: "`quote`",
+		},
+	}
+	for _, tc := range testCases {
+		assert.Equal(t, tc.expectedOutput, MarkAsQuote(tc.input))
+	}
+}
+
+func TestMarkAsCodeSnippet(t *testing.T) {
+	testCases := []struct {
+		input          string
+		expectedOutput string
+	}{
+		{
+			input:          "",
+			expectedOutput: "```\n\n```",
+		},
+		{
+			input:          "snippet",
+			expectedOutput: "```\nsnippet\n```",
+		},
+	}
+	for _, tc := range testCases {
+		assert.Equal(t, tc.expectedOutput, MarkAsCodeSnippet(tc.input))
+	}
+}
+
+func TestGetLocationDescription(t *testing.T) {
+	testCases := []struct {
+		input          formats.Location
+		expectedOutput string
+	}{
+		{
+			input: formats.Location{
+				File:      "file1",
+				StartLine: 1,
+				Snippet:   "snippet",
+			},
+			expectedOutput: "\n```\nsnippet\n```\nat `file1` (line 1)\n",
+		},
+		{
+			input: formats.Location{
+				File:      "dir/other-dir/file1",
+				StartLine: 134,
+				Snippet:   "clientTestUtils.ChangeDirAndAssert(t, prevWd)",
+			},
+			expectedOutput: "\n```\nclientTestUtils.ChangeDirAndAssert(t, prevWd)\n```\nat `dir/other-dir/file1` (line 134)\n",
+		},
+	}
+	for _, tc := range testCases {
+		assert.Equal(t, tc.expectedOutput, GetLocationDescription(tc.input))
+	}
+}
+
+func TestGetJasMarkdownDescription(t *testing.T) {
+	testCases := []struct {
+		severity       string
+		finding        string
+		expectedOutput string
+	}{
+		{
+			severity:       "High",
+			finding:        "finding",
+			expectedOutput: "| Severity | Finding |\n| :--------------: | :---: |\n| High | finding |",
+		},
+		{
+			severity:       "Low",
+			finding:        "finding (other)",
+			expectedOutput: "| Severity | Finding |\n| :--------------: | :---: |\n| Low | finding (other) |",
+		},
+	}
+	for _, tc := range testCases {
+		assert.Equal(t, tc.expectedOutput, GetJasMarkdownDescription(tc.severity, tc.finding))
+	}
+}
+
+func TestGetApplicabilityMarkdownDescription(t *testing.T) {
+	testCases := []struct {
+		severity           string
+		cve                string
+		impactedDependency string
+		finding            string
+		expectedOutput     string
+	}{
+		{
+			severity:           "High",
+			cve:                "CVE-100-234",
+			impactedDependency: "dependency:1.0.0",
+			finding:            "applicable finding",
+			expectedOutput:     "| Severity | Impacted Dependency | Finding | CVE |\n| :--------------: | :---: | :---: | :---: |\n| High | dependency:1.0.0 | applicable finding | CVE-100-234 |",
+		},
+		{
+			severity:           "Low",
+			cve:                "CVE-222-233",
+			impactedDependency: "dependency:3.4.1",
+			finding:            "applicable finding (diff)",
+			expectedOutput:     "| Severity | Impacted Dependency | Finding | CVE |\n| :--------------: | :---: | :---: | :---: |\n| Low | dependency:3.4.1 | applicable finding (diff) | CVE-222-233 |",
+		},
+	}
+	for _, tc := range testCases {
+		assert.Equal(t, tc.expectedOutput, GetApplicabilityMarkdownDescription(tc.severity, tc.cve, tc.impactedDependency, tc.finding))
+	}
+}
diff --git a/utils/reviewcomment.go b/utils/reviewcomment.go
@@ -102,8 +102,7 @@ func getFrogbotReviewComments(existingComments []vcsclient.CommentInfo) (reviewC
 }
 
 func getRegularCommentContent(comment ReviewComment) string {
-	content := outputwriter.MarkdownComment(CommentId)
-	return content + outputwriter.GetLocationDescription(comment.Location) + comment.CommentInfo.Content
+	return outputwriter.MarkdownComment(CommentId) + outputwriter.GetLocationDescription(comment.Location) + comment.CommentInfo.Content
 }
 
 func getNewReviewComments(repo *Repository, issues *IssuesCollection) (commentsToAdd []ReviewComment) {

diff --git a/utils/utils_test.go b/utils/utils_test.go
@@ -9,6 +9,8 @@ import (
 	"github.com/jfrog/jfrog-cli-core/v2/utils/config"
 	"github.com/jfrog/jfrog-cli-core/v2/utils/coreutils"
 	"github.com/jfrog/jfrog-cli-core/v2/xray/formats"
+	"github.com/jfrog/jfrog-cli-core/v2/xray/utils"
+	"github.com/owenrumney/go-sarif/v2/sarif"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -374,3 +376,47 @@ func TestTechArrayToString(t *testing.T) {
 		})
 	}
 }
+
+func TestPrepareRunsForGithubReport(t *testing.T) {
+	testCases := []struct {
+		run *sarif.Run
+		expectedOutput *sarif.Run
+	}{
+		{
+			run: utils.CreateRunWithDummyResults(),
+			expectedOutput: sarif.NewRunWithInformationURI(sarifToolName, sarifToolUrl),
+		},
+		{
+			run: sarif.NewRunWithInformationURI("other tool", "other url").WithResults([]*sarif.Result{
+				utils.CreateResultWithOneLocation("file://root/dir/file", 0, 0, 0, 0, "snippet", "rule", "level"),
+			}).WithInvocations([]*sarif.Invocation{sarif.NewInvocation().WithWorkingDirectory(sarif.NewSimpleArtifactLocation("root/dir"))}),
+			expectedOutput: sarif.NewRunWithInformationURI(sarifToolName, sarifToolUrl).WithResults([]*sarif.Result{
+				utils.CreateResultWithOneLocation("file", 0, 0, 0, 0, "snippet", "rule", "level"),
+			}).WithInvocations([]*sarif.Invocation{sarif.NewInvocation().WithWorkingDirectory(sarif.NewSimpleArtifactLocation("root/dir"))}),
+		},
+		{
+			run: sarif.NewRunWithInformationURI("other tool", "other url").WithResults([]*sarif.Result{
+				utils.CreateResultWithLocations("findings", "rule", "level", 
+					utils.CreateLocation("file://root/dir/file", 0, 0, 0, 0, "snippet"),
+					utils.CreateLocation("file://root/dir/dir2/file2", 1, 1, 1, 1, "snippet2"),
+				).WithCodeFlows([]*sarif.CodeFlow{utils.CreateCodeFlow(utils.CreateThreadFlow(
+					utils.CreateLocation("file://root/dir/other/file", 2, 2, 2, 2, "other"),
+					utils.CreateLocation("file://root/dir/file", 0, 0, 0, 0, "snippet"),
+				))}),
+			}).WithInvocations([]*sarif.Invocation{sarif.NewInvocation().WithWorkingDirectory(sarif.NewSimpleArtifactLocation("root/dir"))}),
+			expectedOutput: sarif.NewRunWithInformationURI(sarifToolName, sarifToolUrl).WithResults([]*sarif.Result{
+				utils.CreateResultWithLocations("findings", "rule", "level", 
+					utils.CreateLocation("file", 0, 0, 0, 0, "snippet"),
+					utils.CreateLocation("dir2/file2", 1, 1, 1, 1, "snippet2"),
+				).WithCodeFlows([]*sarif.CodeFlow{utils.CreateCodeFlow(utils.CreateThreadFlow(
+					utils.CreateLocation("other/file", 2, 2, 2, 2, "other"),
+					utils.CreateLocation("file", 0, 0, 0, 0, "snippet"),
+				))}),
+			}).WithInvocations([]*sarif.Invocation{sarif.NewInvocation().WithWorkingDirectory(sarif.NewSimpleArtifactLocation("root/dir"))}),
+		},
+	}
+	for _, tc := range testCases {
+		prepareRunsForGithubReport([]*sarif.Run{tc.run})
+		assert.Equal(t, tc.expectedOutput, tc.run)
+	}
+}