feat: improve SARIF memory usage - #386
Conversation
…p writing report to console
cx-diogo-rocha
changed the title
|
KICS version: v1.7.13
|
|
New Issues (1)Checkmarx found the following issues in this Pull Request
|
| maxSecretSizeFlagName = "max-secret-size" | ||
| validate = "validate" | ||
| customRulesFileFlagName = "custom-rules-path" | ||
| disableConsoleReportFlagName = "disable-console-report" |
There was a problem hiding this comment.
We should add this new flag to the Readme
| } | ||
|
|
||
| // buildSarifResult converts a single Secret into a SARIF Results object. | ||
| func buildSarifResult(secret *secrets.Secret) Results { |
There was a problem hiding this comment.
This code is mostly duplicated from the inner loop of getResults.
Can we call this function there or update this function's caller to reuse getResults to make sure we always keep the behavior consistent?
Security Policy Alert: Runner Label Policy ViolationThis workflow run has been blocked by StepSecurity's runner label policy because it uses runner labels that are not allowed by your organization's policy. Disallowed Runner Labels:
To fix this issue, please modify the For more information, see StepSecurity's Runner Label Policy documentation. |
Security Policy Alert: Actions Policy ViolationThis workflow run has been blocked by StepSecurity's actions policy. Disallowed Actions:
To fix this issue, please modify the workflow to use only allowed actions. Contact your organization administrator to request changes to the allowed actions list if needed. For more information, see StepSecurity's Actions Policy documentation. |
Security Policy Alert: Secret Policy ViolationThis workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch. Secret references detected:
To approve this workflow, please add the Note: The label must be added by someone other than the PR author (cx-diogo-rocha) or automation bots to ensure proper security review. After the label is added, you can re-run the blocked workflow to proceed. This workflow will be automatically approved once merged into the default branch. For more information, see StepSecurity's Secret Exfiltration Policy documentation. |
Security Policy Alert: Secret Policy ViolationThis workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch. Secret references detected:
To approve this workflow, please add the Note: The label must be added by someone other than the PR author (cx-diogo-rocha) or automation bots to ensure proper security review. After the label is added, you can re-run the blocked workflow to proceed. This workflow will be automatically approved once merged into the default branch. For more information, see StepSecurity's Secret Exfiltration Policy documentation. |
<!-- Thanks for contributing to 2ms by offering a pull request. --> Closes # **Proposed Changes** 1. Reduced the amount of time the report was held in memory for Sarif report. Now only in memory once (this can be reduced later with a deeper refactor). 2. Added a flag to disable console report, since this was another point in the code where the full report was duplicated in memory. We should later stream to console as well even with the flag absent. Replaces #386, having all commits signed <!-- Please describe the big picture of your changes here. If it fixes a bug or resolves a feature request, be sure to link to that issue. --> **Checklist** - [x] I covered my changes with tests. - [x] I Updated the documentation that is affected by my changes: - [x] Change in the CLI arguments - [ ] Change in the configuration file I submit this contribution under the Apache-2.0 license.
2 participants
Closes #
Proposed Changes
Checklist
I submit this contribution under the Apache-2.0 license.