SARIF: add partialFingerprints, tags/precision, and ensure absolute Windows paths in artifactLocation.uri #1297

Akindotcome · 2025-09-11T06:53:45Z

This PR improves the SARIF formatter with the following changes:

Added partialFingerprints (primaryLocationLineHash) for stable deduplication across runs/refactors.
Included CWE tags and Bandit test IDs in tags for better rule categorization.
Set precision based on Bandit’s confidence levels (HIGH/MEDIUM/LOW → high/medium/low).
Ensured absolute Windows paths are preserved in artifactLocation.uri to match test expectations.
Added raw original_path property for clarity and debugging.

~ All unit tests in tests/unit/formatters/ pass.
~ Functional tests are unchanged by this PR.

This should make Bandit’s SARIF output more compliant and interoperable with tools that consume SARIF logs.

Closes #646
Related to #737

Akindotcome · 2025-09-17T08:26:37Z

Hi, I am still hoping my PR gets reviewed

Akindotcome · 2025-09-17T08:43:09Z

@sigmavirus24 , @ericwb , @lukehinds
Hi - friendly ping on this SARIF improvement PR.

It adds partialFingerprints, tags/precision, preserves Windows absolute paths, and unit tests/unit/formatters/ pass.

Could one of you kindly review when you have a moment?

Thanks

bandit/formatters/sarif.py

…indows paths in artifactLocation.uri

for more information, see https://pre-commit.ci

… 'warning' level

for more information, see https://pre-commit.ci

bandit/formatters/sarif.py

ericwb · 2025-09-30T05:34:46Z

bandit/formatters/sarif.py

-
-"""  # noqa: E501
+"""
+# noqa: E501


Any reason why you moved this to a new line?

None of these examples are valid restructuredtext.

ericwb · 2025-09-30T05:36:07Z

bandit/formatters/sarif.py

+    original_paths = set()

-    if len(rules) > 0:
+    for iss in issues:


Let's keep the same variable names to minimizing diffs.

Suggested change

for iss in issues:

for issue in issues:

ericwb · 2025-09-30T05:37:03Z

bandit/formatters/sarif.py

+                original_paths.add(iss.as_dict().get("filename", ""))
+            except (AttributeError, TypeError, KeyError):
+                # Best-effort only
+                pass


Bandit itself would raise an issue about an empty except block.

…er formatters

sigmavirus24

There's a lot of particularly bad LLM slop here. I was promised they were good at writing python because of how much python was out there. I feel lied to.

sigmavirus24 · 2025-09-30T22:46:11Z

bandit/formatters/sarif.py

+

 def create_result(issue, rules, rule_indices):
+    """Convert a Bandit Issue into a SARIF Result and ensure its rule


This is too long and needs to be rewritten

sigmavirus24 · 2025-09-30T22:46:30Z

bandit/formatters/sarif.py

+    """
    issue_dict = issue.as_dict()

+    # Ensure rule exists / get index


Why add this comment?

sigmavirus24 · 2025-09-30T22:47:21Z

bandit/formatters/sarif.py

-"""  # noqa: E501
+.. versionadded:: 1.7.8
+"""
+# noqa: E501


Why add a noqa here? It does absolutely nothing. Remove it

sigmavirus24 · 2025-09-30T22:48:26Z

bandit/formatters/sarif.py

+def _precision_from_confidence(confidence: str) -> str:
+    # Bandit uses HIGH/MEDIUM/LOW strings for confidence
+    c = (confidence or "").upper()
+    if c in ("HIGH", "MEDIUM", "LOW"):
+        return c.lower()
+    return "medium"
+


This is unnecessarily inefficient

sigmavirus24 · 2025-09-30T22:49:19Z

bandit/formatters/sarif.py

        issue_dict["code"],
    )

+    # Map severity -> SARIF level; omit default "warning" per SARIF (and tests)


These comments really are unnecessary. They're explaining what happens which the function names do a decent job of already

sigmavirus24 · 2025-09-30T22:50:27Z

bandit/formatters/sarif.py

+    result_props = {
+        "issue_confidence": issue_dict["issue_confidence"],
+        "issue_severity": issue_dict["issue_severity"],
+        # Ensure raw path appears in serialized SARIF


Also you repeated that comment here. One or both should disappear and be explained with one very clear explanation of why some windows test needs a raw filename (whatever that is)

sigmavirus24 · 2025-09-30T22:50:39Z

bandit/formatters/sarif.py

+        "original_path": filename_raw,
+    }
+
+    # Add a light-weight tags array on results too


Another useless comment

sigmavirus24 · 2025-09-30T22:51:13Z

bandit/formatters/sarif.py

    physical_location, line_range, col_offset, end_col_offset, code
 ):
+    """
+    Populates physical_location.region (and context_region if code provided).


More invalid, poorly written, style-inconsistent docstrings

sigmavirus24 · 2025-09-30T22:51:33Z

bandit/formatters/sarif.py

    )

-    if code:
+    # Wider context for viewer UX


This is not a helpful comment

sigmavirus24 · 2025-09-30T22:53:24Z

bandit/formatters/sarif.py

+    # Tags: always include "security"; include CWE tag only if present
+    # and non-zero
+    tags = ["security"]
+    cwe_id = (issue_dict.get("issue_cwe") or {}).get("id")


Again, this is unnecessarily bad python code. Just,

Suggested change

cwe_id = (issue_dict.get("issue_cwe") or {}).get("id")

cwe_id = issue_dict.get("issue_cwe", {}).get("id")

I don't know why I have to give you feedback for your LLM to process at this point.

I was wondering if it was just us getting spammed by this user so I went see what other PRs they made and found this. It looks suspiciously AI generated, glad you came to the same conclusion.

(4 PRs about the same topic in a week ! each time growing exponentially)
secdev/scapy#4843
secdev/scapy#4844
secdev/scapy#4845
secdev/scapy#4848

Anyway good luck. Personally I think I'll throw in a 30days ban.

Akindotcome · 2025-10-01T22:48:15Z

@sigmavirus24, @ericwb
Thank you for the thorough reviews and feedback. I appreciate the time and detail from everyone.

I’ll address the points you raised (docstring/reST fixes, variable naming consistency, removing the empty except, simplifying confidence/CWE handling, and trimming unnecessary comments) and push the updates immediately I have done the corrections. I’ll be available to iterate further if anything else comes up.

@gpotter2
Sorry for the misunderstanding here, I am only trying to contribute to meaningful open source projects and grow knowledge-wise as well. Thank you

Akindotcome requested review from ericwb, lukehinds and sigmavirus24 as code owners September 11, 2025 06:53

ericwb reviewed Sep 29, 2025

View reviewed changes

bandit/formatters/sarif.py Show resolved Hide resolved

bandit/formatters/sarif.py Outdated Show resolved Hide resolved

bandit/formatters/sarif.py Outdated Show resolved Hide resolved

Paul Anyebe and others added 4 commits September 29, 2025 21:43

SARIF: add partialFingerprints, tags/precision, and ensure absolute W…

6b7e3ee

…indows paths in artifactLocation.uri

[pre-commit.ci] auto fixes from pre-commit.com hooks

97108b4

for more information, see https://pre-commit.ci

Update sarif.py

7d3e3c7

[pre-commit.ci] auto fixes from pre-commit.com hooks

87da4ed

for more information, see https://pre-commit.ci

Akindotcome force-pushed the feature/sarif-cwe-fingerprints branch from 15e97ad to 87da4ed Compare September 29, 2025 20:44

Akindotcome and others added 2 commits September 30, 2025 00:55

sarif: restore docstring example; replace broad excepts; omit default…

e296a98

… 'warning' level

[pre-commit.ci] auto fixes from pre-commit.com hooks

3200231

for more information, see https://pre-commit.ci

ericwb reviewed Sep 30, 2025

View reviewed changes

sarif: docstring — add truncated JSON output example in line with oth…

072976d

…er formatters

sigmavirus24 requested changes Sep 30, 2025

View reviewed changes



		def create_result(issue, rules, rule_indices):
		"""Convert a Bandit Issue into a SARIF Result and ensure its rule

	cwe_id = (issue_dict.get("issue_cwe") or {}).get("id")
	cwe_id = issue_dict.get("issue_cwe", {}).get("id")

Uh oh!

SARIF: add partialFingerprints, tags/precision, and ensure absolute Windows paths in artifactLocation.uri #1297

Are you sure you want to change the base?

SARIF: add partialFingerprints, tags/precision, and ensure absolute Windows paths in artifactLocation.uri #1297

Uh oh!

Conversation

Akindotcome commented Sep 11, 2025

Uh oh!

Akindotcome commented Sep 17, 2025

Uh oh!

Akindotcome commented Sep 17, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sigmavirus24 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gpotter2 Sep 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Akindotcome commented Oct 1, 2025

Uh oh!

Uh oh!

gpotter2 Sep 30, 2025 •

edited

Loading