gosec/output/sonarqube_format.go

package output

import (
	"github.com/securego/gosec/v2"
	"github.com/securego/gosec/v2/sonar"
	"strconv"
	"strings"
)

const (
	//SonarqubeEffortMinutes effort to fix in minutes
	SonarqubeEffortMinutes = 5
)

func convertToSonarIssues(rootPaths []string, data *reportInfo) (*sonar.Report, error) {
	si := &sonar.Report{Issues: []*sonar.Issue{}}
	for _, issue := range data.Issues {
		sonarFilePath := parseFilePath(issue, rootPaths)

		if sonarFilePath == "" {
			continue
		}

		textRange, err := parseTextRange(issue)
		if err != nil {
			return si, err
		}

		primaryLocation := buildPrimaryLocation(issue.What, sonarFilePath, textRange)
		severity := getSonarSeverity(issue.Severity.String())

		s := &sonar.Issue{
			EngineID:        "gosec",
			RuleID:          issue.RuleID,
			PrimaryLocation: primaryLocation,
			Type:            "VULNERABILITY",
			Severity:        severity,
			EffortMinutes:   SonarqubeEffortMinutes,
		}
		si.Issues = append(si.Issues, s)
	}
	return si, nil
}

func buildPrimaryLocation(message string, filePath string, textRange *sonar.TextRange) *sonar.Location {
	return &sonar.Location{
		Message:   message,
		FilePath:  filePath,
		TextRange: textRange,
	}
}

func parseFilePath(issue *gosec.Issue, rootPaths []string) string {
	var sonarFilePath string
	for _, rootPath := range rootPaths {
		if strings.HasPrefix(issue.File, rootPath) {
			sonarFilePath = strings.Replace(issue.File, rootPath+"/", "", 1)
		}
	}
	return sonarFilePath
}

func parseTextRange(issue *gosec.Issue) (*sonar.TextRange, error) {
	lines := strings.Split(issue.Line, "-")
	startLine, err := strconv.Atoi(lines[0])
	if err != nil {
		return nil, err
	}
	endLine := startLine
	if len(lines) > 1 {
		endLine, err = strconv.Atoi(lines[1])
		if err != nil {
			return nil, err
		}
	}
	return &sonar.TextRange{StartLine: startLine, EndLine: endLine}, nil
}

func getSonarSeverity(s string) string {
	switch s {
	case "LOW":
		return "MINOR"
	case "MEDIUM":
		return "MAJOR"
	case "HIGH":
		return "BLOCKER"
	default:
		return "INFO"
	}
}