SARIF: Please add support for fingerprints in SARIF format 🐾

[jamacku]

Fingerprints could be beneficial when used with GitHub and for a general comparison of scan results.

Documentation of fingerprints property: link

GitHub SARIF Documentation: link

[kdudka]

My initial thought was to compute a hash from all the data that are matched in DefLookup::lookup(). The problem is that DefLookup is able to count occurrences of defects with equal fields (which would result in identical hashes) whereas GitHub would see all of them as a single defect. This would not work well when a new instance of defect with previously seen fingerprint was introduced in an update.

[jamacku]

Here is scala example of creating partialFingerprints from codacy/codacy-analysis-cli:

partialFingerprints = SarifReport.PartialFingerprints("1", generatePrimaryLocationHash(issue, fileContents)))

// ...

final case class PartialFingerprints(primaryLocationStartColumnFingerprint: String, primaryLocationLineHash: String)

It seems they are counting only with line numbers and with the hash of line content.

[kdudka]

@jamacku The actual fingerprint computation is here: https://github.com/codacy/codacy-analysis-cli/blob/80c8baecbfea050feb5cee184051b996cdd7fed3/cli/src/main/scala/com/codacy/analysis/cli/formatter/Sarif.scala#L192

They compute MD5 hash of a string concatenated from fileName, patternId, and lineContentsWithoutSpaces.

[jamacku]

Here is an example of how fingerprints are handled by github/codeql-action - code

And also one comment how it works:

• Won't Fix alerts are still shown github/codeql-action#986 (comment)

[kdudka]

codeql-action seems to hash context lines with their own Ad-Hoc implemented hash function: https://github.com/github/codeql-action/blob/bb28e7e59e2ad6c1e5400e671795b2fa1b2fca6f/lib/fingerprints.js#L49