SARIF short titles by filling tool.driver.rules and CVSS score

[dancewithheart]

Changes in SARIF

1. fill properties.tags

SARIF support for code scanning states that:

properties.tags[]
Code scanning uses tags to allow you to filter results on GitHub. For example, it is possible to filter to all results that have the tag security.

2. fills properties.security-severity (recently improved in add CVSS 3.1 temporalMetrics and environmentalMetrics haskell/security-advisories#322 and Support missing features CVSS V4 haskell/security-advisories#327))

properties.security-severity
the results with the highest security-severity, and highest precision are shown first. Code scanning translates numerical scores as follows: over 9.0 is critical, from 7.0 to 8.9 is high, from 4.0 to 6.9 is medium and from 0.1 to 3.9 is low

tags includes security

this is why there is security in tags

before:

"properties": {}

now they are emitted:

"properties": {
  "security-severity": "7.5",
  "tags": [
    "security",
    "external/hsec/HSEC-2023-0007",
    "external/cwe/cwe-1284",
    "external/cwe/cwe-789"
  ]
}

I tested on Github code scanning UI properly render by severity and allow filtering using tags.

3. fills tool.driver.rules that allows GitHub code scanning to show concise alert titles

before

"tool": {
  "driver": {
  "name": "cabal-audit",
  "rules": [],
  "version": "1.0.0.0"
}

after:

"tool": {
  "driver": {
    "name": "cabal-audit",
    "rules": [
      {
         "defaultConfiguration": { "level": "error" },
          "fullDescription": {
             "text": "Haskell Security Advisory: readFloat: memory exhaustion with large exponent. Keywords: toml, parser, dos"
          },
          "helpUri": "https://haskell.github.io/security-advisories/advisory/HSEC-2023-0007",
          "id": "HSEC-2023-0007",
          "name": "HSEC-2023-0007",
          "properties": {},
          "shortDescription": {
              "text": "readFloat: memory exhaustion with large exponent"
           }
          }
    ],
  "version": "1.0.0.0"
},

This fixes blackheaven/haskell-security-action#2

Pictures before and after rendering on Github: blackheaven/haskell-security-action#2 (comment)