-Finding: %s
+### 🎯 Static Application Security Testing (SAST) Vulnerability
+
+%s
#### 👇 Details
Full description
+
%s
`,
- so.FormattedSeverity(severity, "Applicable"),
- MarkAsQuote(finding),
+ GetJasMarkdownDescription(so.FormattedSeverity(severity, "Applicable", false),finding),
fullDetails,
))
if len(codeFlows) > 0 {
+ contentBuilder.WriteString(`
+
+`)
dataFlowId := 1
for _, codeFlow := range codeFlows {
for _, threadFlow := range codeFlow.ThreadFlows {
contentBuilder.WriteString(fmt.Sprintf(`
- %d. Vulnerable data flow analysis result
+ Vulnerable data flow analysis result
`,
dataFlowId,
))
- for i, threadFlowLocation := range threadFlow.Locations {
+ for _, threadFlowLocation := range threadFlow.Locations {
contentBuilder.WriteString(fmt.Sprintf(`
-%d. %s (at %s line %d)
+%s. %s (at %s line %d)
`,
- i+1,
- xrayutils.GetLocationSnippet(threadFlowLocation.Location),
+ "↘️",
+ MarkAsQuote(xrayutils.GetLocationSnippet(threadFlowLocation.Location)),
xrayutils.GetLocationFileName(threadFlowLocation.Location),
xrayutils.GetLocationStartLine(threadFlowLocation.Location),
))
@@ -278,12 +277,27 @@ func (so *StandardOutput) Footer() string {
`, CommentGeneratedByFrogbot)
}
+func (so *StandardOutput) ReviewFooter() string {
+ return fmt.Sprintf(`
+---
+
+
+%s
+
+
+`, ReviewCommentGeneratedByFrogbot)
+}
+
func (so *StandardOutput) Separator() string {
return "
"
}
-func (so *StandardOutput) FormattedSeverity(severity, applicability string) string {
- return fmt.Sprintf("%s%8s", getSeverityTag(IconName(severity), applicability), severity)
+func (so *StandardOutput) FormattedSeverity(severity, applicability string, addName bool) string {
+ s := fmt.Sprintf("%s", getSeverityTag(IconName(severity), applicability))
+ if addName {
+ s = fmt.Sprintf(s + "%8s", severity)
+ }
+ return s
}
func (so *StandardOutput) UntitledForJasMsg() string {
@@ -300,3 +314,12 @@ func (so *StandardOutput) UntitledForJasMsg() string {
}
return msg
}
+
+func wrapInDetails(str, summary string) string {
+ var contentBuilder strings.Builder
+ contentBuilder.WriteString(`
+
+`)
+
+ return contentBuilder.String()
+}
\ No newline at end of file
diff --git a/utils/reviewcomment.go b/utils/reviewcomment.go
index 9b1ba51bb..9033fef80 100644
--- a/utils/reviewcomment.go
+++ b/utils/reviewcomment.go
@@ -186,7 +186,11 @@ func getCommentsToUpdate(repo *Repository, pullRequestID int, client vcsclient.V
err = errors.New("couldn't list existing review comments: " + err.Error())
return
}
+ log.Debug("Detected", len(existingComments), "existing comments")
existingApplicableComments, existingIacComments, existingSastComments := extractFrogbotReviewComments(existingComments)
+ log.Debug("Detected", len(existingApplicableComments), "JFrog Applicable review comments")
+ log.Debug("Detected", len(existingIacComments), "JFrog Iac review comments")
+ log.Debug("Detected", len(existingSastComments), "JFrog Sast review comments")
writer := repo.OutputWriter
// Get comments related to updates on applicable review
@@ -247,6 +251,7 @@ func extractRunReviewChanges(commentType ReviewCommentType, data *sarif.Run, exi
id := generateFrogbotReviewCommentId(commentType, location)
if _, exists := existingCommentsForType[id]; exists {
// Location review comment for this type exist already and not changed
+ log.Debug("Review comment still relevant", id)
delete(existingCommentsForType, id)
} else {
log.Debug("Adding new review comment", id)
@@ -303,7 +308,7 @@ func generateReviewCommentContent(id string, commentType ReviewCommentType, loca
)
}
- content += outputwriter.ReviewCommentGeneratedByFrogbot
+ content += writer.ReviewFooter()
return
}
diff --git a/utils/utils.go b/utils/utils.go
index 9e7dc81b2..3c77beae7 100644
--- a/utils/utils.go
+++ b/utils/utils.go
@@ -354,14 +354,3 @@ func GetSortedPullRequestComments(client vcsclient.VcsClient, repoOwner, repoNam
})
return pullRequestsComments, nil
}
-
-func GetJasMarkdownDescription(scanType xrayutils.JasScanType, location *sarif.Location, severity, content string) string {
- dataColumnHeader := "Finding"
- if scanType == xrayutils.Secrets {
- dataColumnHeader = "Secret"
- }
- headerRow := fmt.Sprintf("| Severity | File | Line:Column | %s |\n", dataColumnHeader)
- separatorRow := "| :---: | :---: | :---: | :---: |\n"
- tableHeader := headerRow + separatorRow
- return tableHeader + fmt.Sprintf("| %s | %s | %s | %s |", severity, xrayutils.GetLocationFileName(location), xrayutils.GetStartLocationInFile(location), content)
-}