Add Seqra SARIF reader support#266
Conversation
Add support for Seqra security static analysis tool: - SeqraReader.java: SARIF reader using CweSourceType.TAG - SeqraReaderTest.java: Unit tests for the reader - Benchmark_Seqra.sarif: Test data file - Register reader in Reader.java
|
@darkspirit510 - Can you review all this and the change to BencharkJava too. This tool's repo is apparently at: https://github.com/seqra/seqra-jvm and there is a wiki article about it here: https://deepwiki.com/seqra/seqra-jvm-sast. |
|
Hi @davewichers, If you have any questions, feel free to ask. Thanks for the quick response! |
darkspirit510
left a comment
darkspirit510
left a comment
There was a problem hiding this comment.
Just one minor thing, the rest looks good to me.
| } | ||
|
|
||
| @Override | ||
| public String toolName(ResultFile resultFile) { |
There was a problem hiding this comment.
Did you try without this method? The toolName method of SarifReader should already pick the correct name from the Sarif file.
There was a problem hiding this comment.
I just tested it — it works — so I removed that method.
3 participants
SeqraReader, a new SARIF-based parser for the Seqra static analysis toolcookie-issecure-falserule, which reports CWE-319 but should map to CWE-614 (Insecure Cookie) for Benchmark scoringReader.javaalongside existing parsers