Sarif.Converters Converts an xml log file of the Android Studio format into the SARIF format Initializes a new instance of the class. Converts an Android Studio formatted log as input into a SARIF SarifLog using the output. The Android Studio formatted log. The SarifLog to write the output to. Optionally emitted properties that should be written to log. Processes an Android Studio log and writes issues therein to an instance of . The XML reader from which AndroidStudio format shall be read. A list of the objects translated from the AndroidStudio format. Generates a user-facing description for a problem, using the description supplied at construction time if it is present; otherwise, generates a description from the problem type. The problem. A user usable description message. A Problem element from an Android Studio file. The file in which the problem occurs. The line on which the problem occurs in if known; otherwise, 0. The module in which the problem occurs. The package in which the problem occurs. Type of the entry point. Fully qualified name of the entry point. The severity of the problem type. The attribute key. (Not entirely sure what this is at the moment) The problem class; that is, the kind of problem. The hint values reported. The user-readable description. Initializes a new instance of the class. Thrown when one or more arguments have unsupported or illegal values. The from which the problem shall be constructed. A builder type to make it easier to construct objects. The file in which the problem occurs. The line on which the problem occurs in if known; otherwise, 0. The module in which the problem occurs. The package in which the problem occurs. Type of the entry point. Fully qualified name of the entry point. The severity of the problem type. The attribute key. (Not entirely sure what this is at the moment) The problem class; that is, the kind of problem. The hint values reported. The user-readable description. Gets a value indicating whether this instance is empty. true if this instance is empty, false if not. Parses a "problem" node from an Android Studio log and consumes that node. Thrown when the Android Studio file is incorrect. The reader from which the problem shall be parsed. NameTable strings used to parse Android Studio files. If the problem node is not empty, an instance of ; otherwise, null. Reads a "hints" element, consuming the element. Thrown when the Android Studio file is incorrect. The reader from which the hints shall be parsed. NameTable strings used to parse Android Studio files. The set of hint values from . Strings used for parsing Android Studio logs. The constant "problems". The constant "problem". The constant "file". The constant "line". The constant "module". The constant "package". The constant "entry_point". The constant "problem_class". The constant "hints". The constant "hint". The constant "description". The constant "TYPE". The constant "FQNAME". The constant "severity". The constant "attribute_key". The constant "value". Initializes a new instance of the class. The name table from which strings are generated. Convert a Clang plist report into the SARIF format. Thrown when one or more required arguments are null. CLang log file stream. Result log writer. Optionally emitted properties that should be written to log. Converts exported Contrast Security XML report files to SARIF format. Convert Contrast Security log to SARIF format stream Contrast log stream output stream Optionally emitted properties that should be written to log. Pluggable Contrast Security log reader. Current context of the result The context accumulates in memory during the streaming, but the information we gather is very limited, and there is only one context object per input file currently constructed Contrast Security exported XML elements and attributes. Constructor to hydrate the private members A strongly-typed resource class, for looking up localized strings, etc. Returns the cached ResourceManager instance used by this class. Overrides the current thread's CurrentUICulture property for all resource lookups using this strongly typed resource class. Looks up a localized string similar to The check {0} detected a failure.. Looks up a localized string similar to Android Studio input for entry point was missing FQNAME or TYPE.. Looks up a localized string similar to The file name was not present in an Android Studio problem, even though a line number was present.. Looks up a localized string similar to The Android Studio problem has no identifying location information.. Looks up a localized string similar to A "hint" element was missing a value in an Android Studio log.. Looks up a localized string similar to Expected the Hints element to contain only Hint elements, but another element was observed.. Looks up a localized string similar to Possible resolution: {0}. Looks up a localized string similar to Expected a non-negative line number for Android Studio problem element.. Looks up a localized string similar to Attempted to parse a Problem element, but some other data was present.. Looks up a localized string similar to An AndroidStudio problem could not be created because required "problem class" element was missing.. Looks up a localized string similar to The root URI of the web site that was analyzed.. Looks up a localized string similar to CppCheck file did not start with "results/cppcheck" element with version information.. Looks up a localized string similar to Could not parse CppCheck error node; element name was not error.. Looks up a localized string similar to CppCheck file did not contain the errors element in the expected location.. Looks up a localized string similar to Could not parse CppCheck location node; element name was not 'location'.. Looks up a localized string similar to {0} line {1}. Looks up a localized string similar to The `line` attribute for a CppCheck <location> was not set.. Looks up a localized string similar to The `file` attribute for a CppCheck <location> was not set.. Looks up a localized string similar to The `file` value for a CppCheckLocation was empty.. Looks up a localized string similar to The `line` value for a CppCheckLocation must be positive.. Looks up a localized string similar to A CppCheck entry must have a nonzero number of locations.. Looks up a localized string similar to The converter plugin assembly "{0}" contains more than one public class "{1}".. Looks up a localized string similar to The converter plugin assembly "{0}" does not exist.. Looks up a localized string similar to Expected to find an element named {0}.. Looks up a localized string similar to Fortify PathElement has non-positive line start value.. Looks up a localized string similar to Fortify failure in {0}.. Looks up a localized string similar to A node did not match the PathElement portion of the Fortify schema.. Looks up a localized string similar to Result did not match the Fortify schema.. Looks up a localized string similar to FxCop does not provide messages for suppressed results.. Looks up a localized string similar to The value "{0}" in the {1} field is not an integer.. Looks up a localized string similar to Line {0}: {1}. Looks up a localized string similar to The severity "{0}" does not correspond to a SARIF result level.. Initializes a new instance of the class. Interface implementation that takes a CppChecker log stream and converts its data to a SARIF json stream. Read in CppChecker data from an input stream and write Result objects. Stream of a CppChecker log SARIF json stream of the converted CppChecker log Optionally emitted properties that should be written to log. An error reported by CppCheck. The rule ID of the error generated by CppCheck. The message of the error generated by CppCheck. The verbose message of the error generated by CppCheck. The severity of the error generated by CppCheck. The locations to which the error generated by CppCheck refer. Initializes a new instance of the class. The rule ID of the error generated by CppCheck. The message of the error generated by CppCheck. The verbose message of the error generated by CppCheck. The severity of the error generated by CppCheck. The locations to which the error generated by CppCheck refer. Parses the element on which an is positioned as a CppCheck error node. The reader from which a CppCheck error shall be read. Strings used to parse the CppCheck log. A parsed from the XML on which is positioned. The xml on which is placed is in an incorrect format. Converts this instance to . This instance as an . A "location" structure from a CppCheck file. The file name from a CppCheck location node. The line number from a CppCheck location node. Initializes a new instance of the struct. Thrown if is null or whitespace. Thrown if is negative. The file value from the location. This must be a non-null non-whitespace value. The line value from the location. This value must be positive. Parses a "location" node from the supplied instance of . Thrown if points to XML of an incorrect format. The reader from which XML will be parsed. Upon entry to this method, this XML reader must be positioned on the location node to parse. Upon completion of this method, the reader will be positioned on the node following the location node. Strings used to parse the CppCheck log. A instance containing data from the current node of . Converts this instance to a . This instance as a . Tests if this is considered equal to another. Another object to compare to. true if the objects are considered equal, false if they are not. Tests if this is considered equal to another. The CppCheck location to compare to this instance. true if the objects are considered equal, false if they are not. Returns a hash code for this instance. A hash code for this instance. Equality operator. The left hand side. The right hand side. The result of the operation. Inequality operator. The left hand side. The right hand side. The result of the operation. Convert this instance into a string representation. A string that represents this instance. String constants for CppCheck from an . The string constant "results". The string constant "cppcheck". The string constant "version". The string constant "errors". The string constant "error". The string constant "id". The string constant "msg". The string constant "verbose". The string constant "severity". The string constant "location". The string constant "file". The string constant "line". Initializes a new instance of the class. The name table from which strings shall be obtained. An XmlReader extension method that reads optional element's content as string. The xmlReader from which line data shall be retrieved. Name of the element expected. The optional element content as string if the element is present; otherwise, null. Creates an exception with line number and position data from an . The xmlReader from which line data shall be retrieved. The message to attach to the exception. The new exception with , and file and line information from . Creates an exception with line number and position data from an . The xmlReader from which line data shall be retrieved. The message to attach to the exception. A variable-length parameters list containing arguments formatted into . The new exception with , and file and line information from . Asserts that the local name of a given element is the name indicated, and ignores the element's contents. Thrown when the XML content pointed to by does not match the indicated and . The XML reader from which the element shall be read. Name of the element. Options deciding what content to skip. Creates a new region with the start line filled out. The line to set in the region. A with filled out. Represents one row of a FlawFinder CSV file. Initializes a new instance of the class. Interface implementation for converting a stream of Fortify report in XML format to a SARIF json format stream. Thrown when one or more required arguments are null. Stream of the Fortify report. Stream of SARIF json. Optionally emitted properties that should be written to log. Converts a Fortify result to a static analysis results interchange format result. The Fortify result convert. A SARIF result containing the same content as the supplied . Initializes a new instance of the class. Interface implementation for converting a stream in Fortify FPR format to a stream in SARIF format. Thrown when one or more required arguments are null. Stream in Fortify FPR format. Stream in SARIF format. Optionally emitted properties that should be written to log. Represents a Snippet in the Fortify format converted to SARIF types. Represents a Node in the Fortify format converted to SARIF types. The string constant "CreatedTS" The string constant "date" The string constant "time" The string constant "UUID" The string constant "Build". The string constant "BuildID" The string constant "SourceBasePath" The string constant "SourceFiles" The string constant "File" The string constant "size" The string constant "type" The string constant "encoding" The string constant "Name" The string constant "Vulnerabilities" The string constant "Vulnerability" The string constant "ClassID" The string constant "Kingdom" The string constant "Type" The string constant "Subtype" The string constant "DefaultSeverity" The string constant "InstanceSeverity" The string constant "Confidence" The string constant "Level" The string constant "AnalysisInfo" The string constant "ReplacementDefinitions" The string constant "Def" The string constant "key" The string constant "value" The string constant "Unified" The string constant "Trace" The string constant "Entry" The string constant "NodeRef" The string constant "isDefault" The string constant "label" The string constant "SourceLocation" The string constant "snippet" The string constant "path" The string constant "line" The string constant "lineEnd" The string constant "colStart" The string constant "colEnd" The string constant "Description" The string constant "CustomDescription" The string constant "classID" The string constant "Abstract" The string constant "Explanation" The string constant "UnifiedNodePool" The string constant "Node" The string constant "Action" The string constant "Snippets" The string constant "Snippet" The string constant "id" The string constant "StartLine" The string constant "EndLine" The string constant "Text" The string constant "CommandLine". The string constant "Argument". The string constant "Errors". The string constant "Error". The string constant "code". The string constant "MachineInfo". The string constant "FilterResult". The string constant "RuleInfo". The string constant "Rule". The string constant "MetaInfo". The string constant "Group". The string constant "NameAttribute". The string constant "Hostname". The string constant "Username". The string constant "Platform". The string constant "EngineVersion". The string constant "InstanceID". Initializes a new instance of the class. The name table from which strings shall be retrieved. A Fortify result element. The Rule ID stored in the Fortify result if present; otherwise, null. The Instance ID stored in the Fortify result if present; otherwise, null. The category of Fortify result. The kingdom of the Fortify result. The abstract (description) message of the Fortify result if present; otherwise, null. A custom user-provided abstract (description) message of the Fortify result if it is present; otherwise, null. The "friority" (which appears to be an intentional misspelling of "priority") of the Fortify result if present; otherwise, null. The primary location for the Fortify result; this will be the sink for data flow rules. Source for the flagged data flow if present; otherwise, null. List of CWE IDs stapled to the Fortify result, if present. Initializes a new instance of the class. The Rule ID stored in the Fortify result. The Instance ID stored in the Fortify result. The category of Fortify result. The kingdom of the Fortify result. The abstract (description) message of the Fortify result if present; otherwise, null. A custom user-provided abstract (description) message of the Fortify result if it is present; otherwise, null. The "friority" (which appears to be an intentional misspelling of "priority") of the Fortify result if present; otherwise, null. The primary location for the Fortify result; this will be the sink for data flow rules. Source for the flagged data flow if present; otherwise, null. List of CWE IDs stapled to the Fortify result, if present. Parses a Fortify Result element from an . The from which an element containing a Fortify result shall be consumed. When this method returns, this is positioned on the following element. Strings used in processing a Fortify report. A containing data from the node on which was placed when this method was called. Converts the CWE ID format from Fortify to a plain list of integers. The string from which CWE IDs shall be parsed. The CWE IDs from the supplied string as an immutable array. A Fortify path element structure, which serves as a location identifier. This type is typically used to represent result locations, datapath sources, and datapath sinks. Full pathname of the file. The line start index. Target function name; may be null. Initializes a new instance of the class. Thrown when null. Thrown when one or more arguments are outside the required range. Full pathname of the file. The line start index. Target function name; may be null. Parses an element as a Fortify PathElement node, consuming the node. The from which a node shall be parsed. When this function returns, this reader is placed directly after the element on which it is currently placed. Strings used in processing Fortify logs. A parsed from the element on which is positioned when this method is called. Strings from the Fortify XSD used for parsing Fortify logs. The string constant "ReportSection". The string constant "Title". The string constant "SubSection". The string constant "Description". The string constant "Text". The string constant "Issue". The string constant "iid". The string constant "ruleID". The string constant "Category". The string constant "Folder". The string constant "Kingdom". The string constant "Abstract". The string constant "AbstractCustom". The string constant "Friority" [sic]. The string constant "Tag". The string constant "Comment". The string constant "Primary". The string constant "Source". The string constant "TraceDiagramPath". The string constant "ExternalCategory". The string constant "type". The string constant "FileName". The string constant "FilePath". The string constant "LineStart". The string constant "Snippet". The string constant "SnippetLine". The string constant "TargetFunction". Initializes a new instance of the class. The name table from which strings shall be retrieved. Converts FxCop report files to sarif format FxCop project files are not supported due to loss of source location information Convert FxCop log to SARIF format stream FxCop log stream output stream Optionally emitted properties that should be written to log. Pluggable FxCop log reader Current context of the result The context accumulates in memory during the streaming, but the information we gather is very limited, and there is only one context object per input file currently constructed FxCop xml elements and attributes Constructor to hydrate the private members The control IDs in this group The unique identifier of the group The name of the group The raw source code of the control. Note that if this is an overlay control, it does not include the underlying source code The ID of this control A list of all results of the controls describe blocks. For instance, if in the controls code we had the following: describe sshd_config do its('Port') { should cmp 22 } end The result of this block as a ControlResult would be appended to the results list. The name of the platform this was run on. The version of the platform this was run on. The line at which this statement is located in the file Path to the file that this statement originates from Total number of controls (in this category) for this inspec execution. Breakdowns of control statistics by result Breakdowns of control statistics by result How long (in seconds) this inspec exec ran for. A bitfield of flags for specifying the method by which XML elements shall be ignored. Requires exactly one of the indicated XML node be present. Allows no instance of the XML node indicated to be present. Ignores an unbounded number of instances of the indicated XML node. Converts a log file from the Semmle format to the SARIF format. Converts a Semmle log file in CSV format to a SARIF log file. Input stream from which to read the Semmle log. Output string to which to write the SARIF log. Optionally emitted properties that should be written to log. Thrown when one or more required arguments are null. Create a Region object that contains only those properties required by the SARIF spec. Array of fields from a CSV record. A Region object that contains only those properties required by the SARIF spec. A Fast XML Reader that reads only the requested entities and uses delegates to create objects along the way Initializes a new instance of the class. The dispatch table used to fire delegates for XML elements on this instance. The reader from which XML shall be retrieved. This SparseReader takes ownership of this XML reader and destroys it upon destruction. Creates a new pointing to a rather than a . The dispatch table used to fire delegates for XML elements on this instance. The stream from which XML shall be retrieved. The SparseReader takes ownership of this stream and is responsible for destroying it. A wrapping the stream . Creates a new pointing to a rather than a . The dispatch table used to fire delegates for XML elements on this instance. The stream from which XML shall be retrieved. The SparseReader takes ownership of this stream and is responsible for destroying it. The xml schema to validate the input against A wrapping the stream . Reads the children of . Name of the tag. The parent. Reads the children of . Name of the tag. The parent. The inner text, if any, associated with the tag. Gets the local name of the current element. The local name of the current element. Skips the element on which this is currently positioned. Reads an attribute value as a string. Name of the attribute to read. The attribute string if the attribute exists; or null if it doesn't exist. Reads an attribute value as an integer. Name of the attribute to read. The attribute value converted to an integer if it exists; otherwise, null. Reads an attribute value as a boolean. Name of the attribute to read. The attribute value converted to a boolean if it exists; otherwise, null. Reads the current element's content as a string and consumes the element. The element's content as a string. Reads the current element's content as an integer and consumes the element. The element's content as a integer. Read's the current element's content and attempts to convert it to an integer. Consumes the element. The element content as an int if it can be parsed as an int; otherwise, 0. Reads the current element's content as a double and consumes the element. The element's content as a double. Attempts to the current element's content as a double and consumes the element. The element's content as a double if it can be parsed as a double; otherwise, 0.0. Destroys this (and the underlying ). Sparse reader dispatch table. This is a table of element name to delegate that allows a caller to amortize the SparseReader delegate construction. Initializes a new instance of the class. Adds a handler for an element name. Name of the element for which a handler shall be installed. The handler delegate. Handles . Name of the element for which a handler was installed. Source for the. The context. true if a dispatcher was registered for that element name; otherwise, false. Gets the enumerator. The enumerator. Gets the enumerator. The enumerator. Initializes a new instance of the class. Interface implementation that takes a Static Driver Verifier log stream and converts its data to a SARIF json stream. Read in Static Driver Verifier data from an input stream and write Result objects. Stream of a Static Driver Verifier log SARIF json stream of the converted Static Driver Verifier log Optionally emitted properties that should be written to log. A class that makes atomized string reference comparison easier. Compares strings for reference equality and asserts if they are equal but not reference equal in debug mode. The first string to compare. The second string to compare. true if Object.ReferenceEquals(left, right); otherwise, false. Do not call this function. Prevents typo StringReference.Equals from compiling. Object to be compared. Object to be compared. Base class for tabular file readers. This class provides buffer management (refill and resize). Read the next row from the file. Implementers must find the cells and end of the next row, filling _currentRow with the new cell values. See TsvReader for a simple but full implementation. True if another row was found, False otherwise Read more from the file into the buffer. True if more was read, False if end of file was previously reached. Return the string values of the current row columns. Return the index of the comma or newline delimiter terminating the cell value starting at _nextIndex, or return _bufferFilledLength if one wasn't found in the buffer range. TsvReader provides a simple interface for reading TSV files. Loosely based on: https://github.com/Microsoft/elfie-arriba/blob/master/Elfie/Elfie/Serialization/TsvReader.cs Base class for tool file converters. Encapsulates the common logic for populating the logicalLocations array. Values referring to a source format to convert to the static analysis results interchange format. An unset tool format value. Android Studio's file format. Clang analyzer's file format. Clang analyzer's file format. Contrast Security's file format. CppCheck's file format. FlawFinder's file format. Fortify's report file format. Fortify's FPR file format. FxCop's file format. Heimdall Tools's file format. PREfast's file format. Pylint file format. Semmle's file format. Static Driver Verifier's file format. TSLint's file format. MSBuild's build log format, from which diagnostic messages can be parsed. A class that provides helpers for converting a log file produced by one of a well-known set of tools to the SARIF format. Converts a tool log file into the SARIF format. Thrown when one or more required arguments are null. Thrown when one or more arguments have unsupported or illegal values. Thrown when the requested operation is invalid. The tool format of the input file. The input log file name. The name of the file to which the resulting SARIF log shall be written. This cannot be a directory. Options for controlling the conversion. Path to plugin assembly containing converter types. Converts a tool log file represented as a stream into the SARIF format. Thrown when one or more required arguments are null. Thrown when one or more arguments have unsupported or illegal values. The tool format of the input file. A stream that contains tool log contents. A stream to which the converted output should be written. Path to plugin assembly containing converter types.