fix: Improve navigation and testing for flow-less findings - #4
Merged
Conversation
Add regression tests for the flow-less navigation fix: - transformSarif parses `line` from the primary location's startLine - a result with no codeFlows still exposes `line` and `file` - generateContent keeps the primary-location file in `referenced` so a flow-less finding's source file survives pruning
Fold state was one shared set keyed by bare directory path, so a custom rules directory sharing its path with a builtin one (e.g. java/security in both) folded and unfolded together. Each origin section now owns its collapse set via OriginSection, making the key collision impossible. Phone initial folding seeds per section from that origin's tree.
Findings whose SARIF result has no code flows previously went nowhere: no file opened, no highlight, and their source file was not even bundled. The primary location is now a first-class navigation target: - sarif.ts synthesizes a single sink step from the result's primary location when no usable code flow exists (empty flows are dropped), built through the same buildSteps mapping as real traces - generateContent bundles every referenced file, including each finding's primary file and non-code extensions (.jsp etc. view as plaintext); referencedFiles() is shared with main.ts's guard, which had a stale steps-only copy of the formula - the store falls back to the finding's own bundled file when a flow has no steps (shared sinkFocus/bundledFile helpers), restores a persisted traceless selection across reloads, and never navigates to a file missing from the bundle (which blanked the code pane) - CodeView hides the step nav for zero-step flows instead of showing a phantom 1/0 counter, keeps the flow nav visible as the way back out of an empty flow, and omits tabs for unbundled step files
- main.ts: degrade the 'no source files found' hard-fail to a stderr warning and still export a findings-only viewer — the UI now handles missing files gracefully, and a report whose paths can't resolve locally (e.g. generated on another machine) is still useful - store.ts: guard selectFile itself so no caller can navigate to an unbundled path; bundledFile delegates to fileByPath so one predicate defines 'bundled'; generalize sinkFocus to flowFocus(stepIndex) and route the persisted-restore fallback through it, removing the hand-rolled duplicate chain and the misleading steps.at(?? -1)
…ed sink
A finding without code flows (e.g. a pattern match like a hardcoded
credential) has no source→sink path, so synthesizing a single 'sink' step
from its primary location was misleading: the Steps panel stamped a sink
severity badge on it and the toolbar showed a degenerate 1/1 navigator.
Drop the synthesis — a trace-less result now yields flows: [{ steps: [] }]
and the viewer navigates via the finding's own line/file (already wired in
store flowFocus and CodeView's finding.line fallback). This aligns sarif
with the rest of the codebase, whose store/generateContent tests already
model traceless findings as empty-step flows.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.