Testing the sarif file parsing

Author: Orlando Barrera II

socketsecurity/core/messages.py

@@ -41,13 +41,16 @@ def find_line_in_file(packagename: str, packageversion: str, manifest_file: str)
         Supports:
           1) JSON-based manifest files (package-lock.json, Pipfile.lock, composer.lock)
              - Locates a dictionary entry with the matching package & version
-             - Searches the raw text for the key
-          2) Text-based (requirements.txt, package.json, yarn.lock, etc.)
-             - Uses regex patterns to detect a match line by line
+             - Searches the raw text for the dependency key
+          2) Text-based (requirements.txt, package.json, yarn.lock, pnpm-lock.yaml, etc.)
+             - Uses compiled regex patterns to detect a match line by line
         """
         file_type = Path(manifest_file).name
         logging.debug("Processing file for line lookup: %s", manifest_file)
 
+        # ----------------------------------------------------
+        # 1) JSON-based manifest files
+        # ----------------------------------------------------
         if file_type in ["package-lock.json", "Pipfile.lock", "composer.lock"]:
             try:
                 with open(manifest_file, "r", encoding="utf-8") as f:
@@ -85,11 +88,16 @@ def find_line_in_file(packagename: str, packageversion: str, manifest_file: str)
                 logging.error("Error reading %s: %s", manifest_file, e)
                 return 1, f"Error reading {manifest_file}"
 
-        # Text-based manifests
+        # ----------------------------------------------------
+        # 2) Text-based / line-based manifests
+        # ----------------------------------------------------
+        # Updated search patterns; note the new pattern for pnpm-lock.yaml.
         search_patterns = {
             "package.json":         rf'"{packagename}":\s*"[\^~]?{re.escape(packageversion)}"',
             "yarn.lock":            rf'{packagename}@{packageversion}',
-            "pnpm-lock.yaml":       rf'"{re.escape(packagename)}"\s*:\s*\{{[^}}]*"version":\s*"{re.escape(packageversion)}"',
+            # For pnpm-lock.yaml, look for a line in the packages section like:
+            # /bitget-main/19.4.9:
+            "pnpm-lock.yaml":       rf'^/{re.escape(packagename)}/{re.escape(packageversion)}:',
             "requirements.txt":     rf'^{re.escape(packagename)}\s*(?:==|===|!=|>=|<=|~=|\s+)?\s*{re.escape(packageversion)}(?:\s*;.*)?$',
             "pyproject.toml":       rf'{packagename}\s*=\s*"{packageversion}"',
             "Pipfile":              rf'"{packagename}"\s*=\s*"{packageversion}"',
@@ -168,7 +176,7 @@ def create_security_comment_sarif(diff) -> dict:
         This function now:
         - Accepts multiple manifest files from alert.introduced_by or alert.manifests.
         - Generates an individual SARIF result for each manifest file.
-        - Appends the manifest file name to the alert name to make each result unique.
+        - Appends the manifest file name to the alert name (and rule ID) to make each result unique.
         - Does NOT fall back to 'requirements.txt' if no manifest file is provided.
         - Adds detailed logging to validate our assumptions.
         """
@@ -201,7 +209,6 @@ def create_security_comment_sarif(diff) -> dict:
             base_rule_id = f"{pkg_name}=={pkg_version}"
             severity = alert.severity
 
-            # Log raw alert data for manifest extraction.
             logging.debug("Alert %s - introduced_by: %s, manifests: %s", base_rule_id, alert.introduced_by, getattr(alert, 'manifests', None))
 
             manifest_files = []
@@ -216,42 +223,42 @@ def create_security_comment_sarif(diff) -> dict:
                 manifest_files = [mf.strip() for mf in alert.manifests.split(";") if mf.strip()]
 
             logging.debug("Alert %s - extracted manifest_files: %s", base_rule_id, manifest_files)
+
             if not manifest_files:
                 logging.error("Alert %s: No manifest file found; cannot determine file location.", base_rule_id)
                 continue
 
             logging.debug("Alert %s - using manifest_files for processing: %s", base_rule_id, manifest_files)
 
-            # For each manifest file, create an individual SARIF result.
+            # For each manifest file, generate a separate result
             for mf in manifest_files:
                 logging.debug("Alert %s - Processing manifest file: %s", base_rule_id, mf)
                 socket_url = Messages.get_manifest_type_url(mf, pkg_name, pkg_version)
                 line_number, line_content = Messages.find_line_in_file(pkg_name, pkg_version, mf)
                 if line_number < 1:
                     line_number = 1
                 logging.debug("Alert %s: Manifest %s, line %d: %s", base_rule_id, mf, line_number, line_content)
-
-                # Create a unique rule id and name by appending the file prefix.
+                
+                # Create a unique rule id and name by appending the manifest file name
                 unique_rule_id = f"{base_rule_id} ({mf})"
-                rule_name = unique_rule_id
-
+                rule_name = f"Alert {base_rule_id} ({mf})"
+                
                 short_desc = (f"{alert.props.get('note', '')}<br/><br/>Suggested Action:<br/>{alert.suggestion}"
                               f"<br/><a href=\"{socket_url}\">{socket_url}</a>")
                 full_desc = "{} - {}".format(alert.title, alert.description.replace('\r\n', '<br/>'))
-
-                # Add the rule if not already defined.
+                
                 if unique_rule_id not in rules_map:
                     rules_map[unique_rule_id] = {
                         "id": unique_rule_id,
                         "name": rule_name,
-                        "shortDescription": {"text": f"Alert generated for {unique_rule_id} by Socket Security"},
+                        "shortDescription": {"text": rule_name},
                         "fullDescription": {"text": full_desc},
                         "helpUri": socket_url,
                         "defaultConfiguration": {
                             "level": Messages.map_severity_to_sarif(severity)
                         },
                     }
-
+                
                 result_obj = {
                     "ruleId": unique_rule_id,
                     "message": {"text": short_desc},