From 6d4d38de99202710929b886bc225c716327e3eab Mon Sep 17 00:00:00 2001 From: Larry Golding Date: Sat, 4 Jul 2020 09:17:14 -0700 Subject: [PATCH] Provide messages for SARIF1012.ProvideHelpUris. --- docs/Producing effective SARIF.md | 4 ++++ docs/Rule factoring.xlsx | Bin 13526 -> 13530 bytes .../Rules/RuleResources.Designer.cs | 4 ++-- src/Sarif.Multitool/Rules/RuleResources.resx | 4 ++-- .../Rules/SARIF2012.ProvideHelpUris.cs | 14 ++++++++++++-- .../SARIF2012.ProvideHelpUris_Invalid.sarif | 6 +++--- 6 files changed, 23 insertions(+), 9 deletions(-) diff --git a/docs/Producing effective SARIF.md b/docs/Producing effective SARIF.md index ac310d805..786b1335d 100644 --- a/docs/Producing effective SARIF.md +++ b/docs/Producing effective SARIF.md @@ -518,8 +518,12 @@ for example, 'CS2001' for a diagnostic from the Roslyn C# compiler. For uniformi #### Description +For each rule, provide a URI where users can find detailed information about the rule. This information should include a detailed description of the invalid pattern, an explanation of why the pattern is poor practice (particularly in contexts such as security or accessibility where driving considerations might not be readily apparent), guidance for resolving the problem (including describing circumstances in which ignoring the problem altogether might be appropriate), examples of invalid and valid patterns, and special considerations (such as noting when a violation should never be ignored or suppressed, noting when a violation could cause downstream tool noise, and noting when a rule can be configured in some way to refine or alter the analysis). + ##### `Default`: note +{0}: The rule '{1}' does not provide a help URI. Providing a URI where users can find detailed information about the rule helps users to understand the result and how they can best address it. + --- ### Rule `SARIF2013.ProvideEmbeddedFileContent` diff --git a/docs/Rule factoring.xlsx b/docs/Rule factoring.xlsx index 5331a0cdc67794458dcc071719a3ec06c9efdbeb..3febd826e1b12030a1c8d48a37c67d667892a89b 100644 GIT binary patch delta 4107 zcmV+m5cKcXY1(P9<^}~Npy>Hxlj{Z?e{FB0I1v7R()|a-cM3Ky0n~IALeN#(uBx`z z{ZeV=f+k`Ma0G)^YF~fGsEepUDsNVR7l4Axs6Ud+oFBR zE7m{E?Z0mdC$=rANMDhb_jGPQQE7iV`}2>}Ef?#1&es+I^m1-DN^Mftm1RRaePX^Ssx-va~=(!;GEx5fyp|ulmMes)+40w7InBKjr zW2NAd*XjhI-I4S=|B>e+^dU2ePlX^2Ua5bAgkzr6}^BV@3+wqNXuv? zh2VVvmu5}Hn0|~7{_>K zyJrVEUkaLCqK|iy2v$3?THjT?ly|RWN#57Me-I`qwYM&~ zJ5n0&e|8<1iF6X*r4kn0pXZ+;0oUXa(g8^aTBcghA>PRU)|Vnh-=4j2iTxyAIWt@= zoB#)bvsn0nKxw|(ebw)HeEap1#pYm8r6r5X@b9P1DQ4I(e{x?@GTjrXnc3=% z;;(f_MbM`8Y=UfCBGvB@=M^$ZoE|GlTY|#%WDX|C!-+mYcj~iLW(ILFpoao)G4qnZ z@m7B51aX3$IPkHv405~*XRCabg*rdF`=|d$4>TH2r_YLJ*$|;_1S!|>F}k94MkEMo zbO`vqCYyzE=J`M|Uno%F1Ss*GEQ29Vm9q)0C(Is#6!H zS*Lm|_PdA8dfeFO=}qmWSGkV+{^@@^cn#jS^vJ`-?U4tUUoLJgj5dDhfNKJ*M~lc5Y1vvLYV0tw6wE}F3l007^UzYI-()fYfL$Qu;fW%;n$K3#aff6Y!N-e6zn+lPEzZi@@=N3r*Qz5MH6&fm)F z+y1#I>H#op_ZQxCUGL6@!~OEP*yQ`ua#w8OFOOxl$!qvnJq`D}s>mPYmp1ERFd8L) z!%e>0dWzw!a^WZ+A6Lubx?H|&ifye(s$!kjF#rAYYPWCLHcJ<}OE; zSL;>%Ly~%f&GKyVv@NUrehusX?nn7@@V$cn0{9m;!^rDoq|ItsmHYCsJ_Y8XnloMg zbT}R6%L5Z#zY~og4XfgHB^-F93Vv>XN`8Fc3XWvqPm(1EGGVUj>}BXYq78 zo}XOJX5*7+KAoIgjbi^~mL`6h`B|1s!vA@f=MO9JuvpcgDjqMqnSb_i?0dt@a~VK? ztctgN>;0h4@9&Crv8)Ri#PHVP@_3%`7vS3BOf?hvG4R zS=V36x7%X%^jyPqqf;Q0p>+1}mOoe@b13Y*V#(YdV}SE%f2o*|I#oq$pZ~ISkl0&rirGf6F-SYNg$Timk)d_ z`QTOaP5umBr0L*Q(*>i`(PTP_!tu{c556O(C!DOz5l5#{9Qr@C*hI6zYvY5-X&eR9 zWYU@))K10$W6c4t4afL234=*{N7 z$vxlkGZOpE|;ATHE2R9;Dp$fXeetp0GwuJ=+4 zl0lHq1iK`JukRt@UoXS+;Vb0uQX{S?A}|qiittA!2Xa%@ZQ0NP-YAl+N)jT5`k7_ym3i{TtX4Zm~#sP zkz7+qjEs;{$OJ($1%Wg^*eO5*-DnmF+M_Ke=8A5+X+8uHosXCE&%b~Ay2$>Pon`+R zcwawXfA)SE{C!|vUVIw-_T}@(z>Bq&=b z!pE+$Kv2%56oNgY5Ugi33F{e_#xSK&rgouXqdXO8)08NcGmU`IIK<5qr@I5@md6-N zfcoBJ2?A{{0flv@5UdY03F`xv##n&Zu{ir+CeY>rP>s8y2p{Rg+yX&KaczO%c(y=L z;$#}a#)AXqmd6->=9GHtZci=GAPk3y^-;uLSukUSncH}9jj&;`QEeEasj8)5W3=I6 zgH(gwAu`R1dm6q}$QIv>Q>@pS#_-EfitY2uP#~ve^wRazS0V>{grim>-OeuM5Z_T z$*8Z?EtK0^(b0ds~GoMq_lKJ^7$q>nf>G2CNlcNfphr-~V(7Vye~2~dpBEg0$^ zI#z%*E7d%IMp?iLt}(oO^jLh6Rv@Rc02}%~?h$aCdjg@8hgP7|JrZtaPlzJ=%7!5u zIVI0VOF?#W6ceH>O!Zi8_k@Ti(-?j;r^jO5!xNcXW1|)5%$`80v#|_RlroLsm*LV1 z@I>Y^j8>p~8MGA$ak2z1TWhDiHA`eJ!)OJ%m(jF;0=Sk1h8A}x3*F6zxNnw}Xv2tW znFT{?nFT|Wh4uy^?hP~#A7w7R0Z(MQ$LI~Z-P802$A&Y+?Y}$$zVP^E=p8hl^9tlr zk^`d==~~7|2?x)Qh-3!6q<1Fa=wuB`rVT@CvXXGVCR0p=I~vx7+TeX{LahMR^ z-bQ`YX(rLghPZNAFcV^Dx=Z$nohfF2jE{mWVzBUZzwGD!TWDLA3lU!6qF}2t=c}a?keN+NS#<4rx8T3C?>&wTXfCC zuT=B!rB#7kQa`GFS(9?>3-M8zm3T>h+l?_Uh_oeGGMgBaaL!~91FCWbP3x2 zUs*6?yc4ltXwq56!sj;@9-4HDhqtO8i!XO9k!jUF5(dvi&|lJ#QbsXTd@5$)!Hq#` z8;hh9t6=I(rQzW%)=ji%h~)Dfh7prK>X=Ei2u<;zgZL%LO>;#(NFgqN-5Qt7!P>{V zoq3Sx)7bVe-A1^Vvw&h;0&N)F%ULjF^Ju}4M9>&E5gMNM9cCZ@FzD6^wa_S2fR2kZ z&EH4+v!vNhoi)TQA0JtM*tR3jDN6b!w@gh<7nzdilJU)Pmy)xYn~1-cA!iL z^*TzH4@hCl;-B$bKrudlOSWN%WvRAO%UaHx@upvo#pj2M{PIMmS$oNELM723VWqHw zumD>?WDjYfZM`D zP3xf44G*i-8pOr^LSxK&eoSh^_~TyMEzyQ{H&X}#du--0zDn91b(`vgPtl`;P z@dPVOtWpoT%J=Y8uDl8r^uDa&(bVSCGdvkyKz9buyn2JjvaFjApzebAuBcyjgR)w| zldUQb}0CmoO6FU=aOiC%ro=_+N4UxIP?RIKyoEg zxr_1ZX6a2aGL}ifG9@9#6&O5EuCF3qP_8sQYgK@@DH!BP(okN+cyDb%2{C*RIWxX< zNGEQU&Y5*by(0zVpKJ$Y5Cnf?l7nS}Sw?E0S9C;tLJHm?i-XP@fZzl&$U#~|LO&!w zUJE)me-1QC&zYyTDqN>i+&)|IR_xqIlXk|kEd6rW#BljT^1fcZG*!J+*1O_>lSpvN zH887mvSJ7AmI~-mW%Xhs(i7`NX3W^N+xa#HabG#V*45dJZq}7fnLtzvCCwqTZXP{J zejAbBgYMC$WBW1)^ZoD70N;00qZyxW8mI-1dN_EG1$n6F#37x^jO zzr=|bj5gtz1`|4*_K0Ud(&WDUImtJZp$rwXt1deO1tp;9`C^mnF;W3%lRh#n8_W$Z znz0H10N*|U02lxO000000000000021lZG-y0g{ulZrD? z0WFi;GgJXSlQ1+R9BH|}!Ds;h0EPkp01*HH000000000000002ER%0EJprMUtu!MB JU@-sy006b$Cq?5dHPDoWDy zB~s;p3DyGMYn$vwQU80#X4xc7RqajhinX!F9L~&~8IC`0yViQ3LNeaZ5k7K}Mf;Lh ztiPY5uh&aEMwV2huSm;#I!BLGqK_y4d^p~4vAW}YWdT4h=crL?ojQ&z8`=?hf5g|c z2TRRGM-(i@y(8Cxl1es|s;+fB*NvQxupW&FsW=3K*EK6?!ONkey&6FTZHWT^dUa2*k=VQrVZTLZ)$Yngg9pvdaV^z6Rpg50&>_7;cMR=^d(AG5M*!`Nq~G|DT?gY=A=ti+f5Bl$fg|Vx(>dI;645(ZMSHC184SCBjfO#5Mk^@< z@11Djo|}hGj%(J^n^C$JS+Bp4PG_n`R!gK>R7}xoj%Kjr8~SQP4C`!QEm%D-_GZXA z*~|GtSQV|w(5hXRUh(^gT@6Ge00E70N2ufNrt!Oj~Fe+suQ>AwRL z6bcLU1-`;a%9Py63!)lp5bYf0>1{=tt#~PKU&xZYt%3g_Oj2rZ9dLJ~ zG~WN}IxrLIB)$tJEVw@_K0^Yo$OEJUk`A;?wVpw|vH!gk}=s60)-zmNkKrvY2TqTGpaqTRN0y`|0emKKLz6h7kWVQSCJ3CP9n5QXG15~FjOtVh) zxZLgTH|ud@m#0^?mtGb+?z^Y|bnptiZ|Q-Dmp2C<%)gvppBrub)&a)^SdT^)&Xksu zpR-^JSpp8=H%=0<3IG7&J^%n10F#R{8k6A+E`NQa#I7nAo3p^qN~Vubch~JyH_7u~ zzi-xq*P`05%I$^cpN_miv0auAtL@W;_xsoEWa16>b-sPb*X6dj@O~6~@7K$}{^k6w ztiJ7^i=rL~hVA~sd#>x<*>JdDJ{OyOe_HN}t@zDjS#9!K{8&8=_q(ddAJiXh*27>l zN`Ho%e6{s7!&&9RQ9eGdmc@0seAyJ+T9Z`8I_3dSMvMe_{ zL2^X@vF`7FlrIP0EAd|-{)Npj>N*-}vszZ=zI?1t1@lnP z883f2oDTElfeEkQiN=qHRq?u#4m?r?KYuqRKR$2;N3!rI$&v$^G*@-@vU<4i{+q=mt?NWQFBuZ5<(i3NQBZ#6ghT}*6vm|6RKGs{e6!f(~! zp?J(+*7cY2?Y3AwJ=bEo(WxL)p>+1}xv;S$q?h_Vo|BGV$%c*w@)g(tmn`<;%VXo7bUK<$Cs8>5ndynYQPY!7*5-(#(h7F~T3&kZS_s+mMtPXKF(- z44I5=$PG0Rpt&V50hsVYV}C@#9PBayG#@a{^th&>@ZQ0NqRdz>q^n)y5{cGjym3hc zT!In6m~#RFNUkv?21ZCRWC9?WhKMvi*eL)5-53@Tv`1S`>=oU1(|ia-bUt3rKmY#e z>mvJGc9#8P;C=mk{n`6v@b`gzdGTrR+n3KbU(&lf@0au8qYUfg#D6W-vLf~fC3mLSpg5fRO!SKt_itY2u&>*K}^wRaz*CHqO2uH01 zx}6yezYG^a<%w)>h#B>$dU87{s)n@;5O|rv@XOFV9p2C&Cx37BlJZoJ3zp%-@@+8u zGF(KIC$hcKPey&MZlT)V%8venxe};ddAkesd#T$@!9mu+Zim7^eIPKX;h`|7m}wPk z#~tcM4G-@y7scg?Y=?=_j_D&$d*pE$I?FKKed+@I?03*lGnjvnSB%Y%K#6 zrOaUXWw^8gJdwQ&s}<;825tpHm@I+I*4k-r%@Wzmuzy;C?qxKs0IX$!rN!OJf_Jka z?3)!O*f7FcMqp4aBQQ8waBmR8-oWtiQRdPc@IH=Jbd)J>~76qE}9?p5$jZ; zfvUhG6ocVc;j+1PAX*qqyZrgBo27Q5_7czt-)K(YjiUy`-W_!T-FATNb@YqU~iQ zVEcbXV8(DKLSS&x5o5vg8-fQXo#x@KYR2Nr9ZO_ewU2~}cOvkUbf}bJ%oLuA5j?Ol zNU5<7$OBLd(#UFFMF4L2jBW`b7$P>3`O`WDnLp z*6qxL#GJ;qpL83+UXB38umn;V*vkXO@xN0eTUhH4+h;jp%w;Z3(#?K zw)y*Lf0i`cX}B{@dYwiqG$_g=cmzOzV)(!!g+X4#$I;k}7=yjYo+6vbH#{9)>_FKL z>UETy;Nx9?1RvukKruW^rhhQVvUo6TS>n7IZu-qwe0~_74$F3+Y|Hji-~_9pKZ0UG zf}jQyAheAnFxa$sMmT64G`Jb7!?b3!_fWQJd&zJ@>?B99uO&h79w-6Arp2S7Gj4(h zo7O?B8y;4y4TuZ>g~8Y*{g~I5@yEU7TcIuaZmzWC8(&&9mvH+a-hUYF(b+0A)B@Pr zQXu%Q*PH+$=TjKCp(HTK`3A$5tcHhmz5~&sA!?agzxJx%*W2Y!#mBsQT5b1(wRrtj zzQigfR_XU#)pzk?uDUA9<9%6+w^N&+p2f@Ig=o;kYp>qmu`KK62O;p1_pYd4c7w87 ziI-#5``#DcuB_@RUlG+}gfsbaakY5R6Fa<}e))fsUAIk!Lf;PF52@Xa+ zMj*Kox!flBC0ly87#Yi?V1<&9;2I2`rKQ`{k2@J{UAN0ax)!{IPGL~RV0KOk@G)pJ|b%Vo1G z4mgbkr(6TGN~bHf*KVnR9#qjRHYNkHS!BVCUAvucau9d5^J`t7&FE@f>zoNwv{2IQ z3+v|5qvY2y`90_!Z98@^gFr4d?K+;7*JyE{EpZz9q3`((#WULctAV@(l+uP!?S1%Bqo7+;g`F;W3!lR`2r z8{jui60r&Z0OCFX02lxO00000000000001}lZrA$0gsc=GC% - /// Looks up a localized string similar to Placeholder. + /// Looks up a localized string similar to For each rule, provide a URI where users can find detailed information about the rule. This information should include a detailed description of the invalid pattern, an explanation of why the pattern is poor practice (particularly in contexts such as security or accessibility where driving considerations might not be readily apparent), guidance for resolving the problem (including describing circumstances in which ignoring the problem altogether might be appropriate), examples of invalid and valid patterns, [rest of string was truncated]";. /// internal static string SARIF2012_ProvideHelpUris_FullDescription_Text { get { @@ -644,7 +644,7 @@ internal static string SARIF2012_ProvideHelpUris_FullDescription_Text { } /// - /// Looks up a localized string similar to {0}: Placeholder '{1}'. + /// Looks up a localized string similar to {0}: The rule '{1}' does not provide a help URI. Providing a URI where users can find detailed information about the rule helps users to understand the result and how they can best address it.. /// internal static string SARIF2012_ProvideHelpUris_Note_Default_Text { get { diff --git a/src/Sarif.Multitool/Rules/RuleResources.resx b/src/Sarif.Multitool/Rules/RuleResources.resx index f7585e6a6..37c22b007 100644 --- a/src/Sarif.Multitool/Rules/RuleResources.resx +++ b/src/Sarif.Multitool/Rules/RuleResources.resx @@ -349,10 +349,10 @@ This is part of a set of authoring practices that make your rule messages more r {0}: In rule '{1}', the message with id '{2}' includes dynamic content that is not enclosed in single quotes. Enquoting dynamic content makes it easier to spot, and single quotes give a less cluttered appearance. - Placeholder + For each rule, provide a URI where users can find detailed information about the rule. This information should include a detailed description of the invalid pattern, an explanation of why the pattern is poor practice (particularly in contexts such as security or accessibility where driving considerations might not be readily apparent), guidance for resolving the problem (including describing circumstances in which ignoring the problem altogether might be appropriate), examples of invalid and valid patterns, and special considerations (such as noting when a violation should never be ignored or suppressed, noting when a violation could cause downstream tool noise, and noting when a rule can be configured in some way to refine or alter the analysis). - {0}: Placeholder '{1}' + {0}: The rule '{1}' does not provide a help URI. Providing a URI where users can find detailed information about the rule helps users to understand the result and how they can best address it. Placeholder diff --git a/src/Sarif.Multitool/Rules/SARIF2012.ProvideHelpUris.cs b/src/Sarif.Multitool/Rules/SARIF2012.ProvideHelpUris.cs index 0f0185644..12d8d6c03 100644 --- a/src/Sarif.Multitool/Rules/SARIF2012.ProvideHelpUris.cs +++ b/src/Sarif.Multitool/Rules/SARIF2012.ProvideHelpUris.cs @@ -15,7 +15,15 @@ public class ProvideHelpUris : SarifValidationSkimmerBase public override string Id => RuleId.ProvideHelpUris; /// - /// Placeholder + /// For each rule, provide a URI where users can find detailed information about the rule. + /// This information should include a detailed description of the invalid pattern, an + /// explanation of why the pattern is poor practice (particularly in contexts such as + /// security or accessibility where driving considerations might not be readily apparent), + /// guidance for resolving the problem (including describing circumstances in which ignoring + /// the problem altogether might be appropriate), examples of invalid and valid patterns, + /// and special considerations (such as noting when a violation should never be ignored or + /// suppressed, noting when a violation could cause downstream tool noise, and noting when + /// a rule can be configured in some way to refine or alter the analysis). /// public override MultiformatMessageString FullDescription => new MultiformatMessageString { Text = RuleResources.SARIF2012_ProvideHelpUris_FullDescription_Text }; @@ -57,7 +65,9 @@ private void AnalyzeReportingDescriptor(ReportingDescriptor reportingDescriptor, ruleMoniker += $".{reportingDescriptor.Name}"; } - // {0}: Placeholder '{1}' + // {0}: The rule '{1}' does not provide a help URI. Providing a URI where users can + // find detailed information about the rule helps users to understand the result and + // how they can best address it. LogResult( reportingDescriptorPointer, nameof(RuleResources.SARIF2012_ProvideHelpUris_Note_Default_Text), diff --git a/src/Test.FunctionalTests.Sarif/TestData/Multitool/ValidateCommand/ExpectedOutputs/SARIF2012.ProvideHelpUris_Invalid.sarif b/src/Test.FunctionalTests.Sarif/TestData/Multitool/ValidateCommand/ExpectedOutputs/SARIF2012.ProvideHelpUris_Invalid.sarif index f168e1cf8..1f9a0e8b0 100644 --- a/src/Test.FunctionalTests.Sarif/TestData/Multitool/ValidateCommand/ExpectedOutputs/SARIF2012.ProvideHelpUris_Invalid.sarif +++ b/src/Test.FunctionalTests.Sarif/TestData/Multitool/ValidateCommand/ExpectedOutputs/SARIF2012.ProvideHelpUris_Invalid.sarif @@ -11,14 +11,14 @@ "id": "SARIF2012", "name": "ProvideHelpUris", "shortDescription": { - "text": "Placeholder." + "text": "For each rule, provide a URI where users can find detailed information about the rule." }, "fullDescription": { - "text": "Placeholder" + "text": "For each rule, provide a URI where users can find detailed information about the rule. This information should include a detailed description of the invalid pattern, an explanation of why the pattern is poor practice (particularly in contexts such as security or accessibility where driving considerations might not be readily apparent), guidance for resolving the problem (including describing circumstances in which ignoring the problem altogether might be appropriate), examples of invalid and valid patterns, and special considerations (such as noting when a violation should never be ignored or suppressed, noting when a violation could cause downstream tool noise, and noting when a rule can be configured in some way to refine or alter the analysis)." }, "messageStrings": { "Note_Default": { - "text": "{0}: Placeholder '{1}'" + "text": "{0}: The rule '{1}' does not provide a help URI. Providing a URI where users can find detailed information about the rule helps users to understand the result and how they can best address it." } }, "helpUri": "http://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html"