[sarif] Sarif Conversion from Finding Node

[DavidBakerEffendi]

• Implemented an extensible SARIF 2.1.0 conversion from Finding Nodes.
• The actual design consists of SARIF-themed traits with the minimal properties we "want", followed by a version-specific case class implementation which may extend upon the base properties.
• The query step has an implicit configuration which allows one to rename the tool, version, description, etc. related component of what is exported.
• Test posts a sample SARIF file generated by joern-scan + toSarifJson to an online Microsoft SARIF validator.

Question to reviewers: Do we want the structure of a trait which is extended upon by versioned case classes? Or do we only want to support one version at a given time?

[DavidBakerEffendi]

Example file to be viewed at https://microsoft.github.io/sarif-web-component/
Uploading outfile.sarif.json…

[DavidBakerEffendi]

I see the Joern REPL has a version call, which I can use to dynamically load this - one sec...

[mpollmeier]

So semanticVersion refers to the joern version?
If you get that from joern via e.g. io.joern.joerncli.console.JoernConsole.version, then ocular would also refer to the joern version, which is probably fine.
That can be changed, but at the same time we should keep things simple...
just to make sure I understand correctly, can you elaborate on what that version means?

[DavidBakerEffendi]

This version refers to the tool. I have a branch on Ocular which implements this work and runs this configuration before the REPL begins: https://github.com/ShiftLeftSecurity/ocular/compare/master...dave/ocular-sarif#diff-36b4f70cbc3441ca2033a3f58698e662fabe8f4e3fcaae662f7ba3c414782d00R55

I should likely name organization and semanticVersion more consistently with the tool prefix

[DavidBakerEffendi]

@mpollmeier I see that joerncli is not accessible here - where do you suggest I initialize this kind of config value for the REPL? I see there are some runBefore-style hooks in the BridgeBase interface but I'm wondering where specifically may be best

[DavidBakerEffendi]

For now I've added something under BridgeBase which is able to obtain the version

[mpollmeier]

👍🏻 sounds good

[mpollmeier]

this looks nice and clean 👍🏻
left a few remarks / suggestions

[ml86]

Please also add further unit tests which check not just the SARIF case classes but instead the resulting SARIF json.