microsoft / sarif-website

SARIF web assets, including web controls, public site, etc.

Microsoft SARIF website

The Microsoft SARIF website provides resources for the Static Analysis Results Interchange Format (SARIF), an open standard log file specification for storing data produced by static analysis tools.

Find Links to Resources

• SARIF's OASIS open standard
  • Specification
  • Tutorials
  • GitHub project
• Tools and libraries for developers
  • Microsoft's open source SARIF SDK for .NET applications
  • NuGet package for third-party Visual Studio extension interop
  • JavaScript SDK
  • Python module
• Microsoft's open source viewers
  • Extensions for Visual Studio and VS Code
  • React component
• Web-based utility for viewing and validating SARIF log files

sarif-website's Issues

Add bug autofiling on/off switch when appropriate

Support multiple runs (potentially crossing domains)

FxCop test data needs to be updated to provide hosted file links for source files.

Hit count column should not appear for security only domain

Where the hit count is always 1

Details UI needs to be refreshed in the prototype

To unblock active testing.

Need to understand bug reporting requirements.

Querying active bugs may results in UX slowdowns. And so we need to understand what requirements are in play. In the MVP, we certainly need to query for possible issues against blocking (i.e., new) issues. Any of these for which there is an open bug are by definition non-blocking and need to be recategorized.

Missing link to SARIF GitHub repo

That text in the "Tools and Libraries" section should be a link

Implement 'blocking' vs 'non-blocking' states

In our first implementation, any issues that are new since the conceptual baseline build will be marked as blocking.

That is, developers must explicitly choose to act or not on any issues that relate to code changes they have introduced to the build.

Create Validator UI layout sketch

Implement separate extension that uses new web platform

Remove column headers

Preliminary view is collapsed down to rule or target child node.

And filtering is set to show 'blocking' only

Tracking: design principles for UX

default view is compact as possible
details pane provide rich data
hover over expansion of result provides low friction way to acquire more information.

open issue: text message vs. code

Need to generate list of open design issues for details page

"View and validate your SARIF files" link doesn't work

It just scrolls you down to the Viewers section.

Tab focus should stay within image viewer while it is active

Remove web view placeholders from viewer gallery

This is a public site; we can't have links to our intranet.

Design/implement multi-action user gesture

Should invoke 'file on bug per instance', 'file one bug for all selected issues' as well as 'mark these issues non-blocking'

Interop package link is broken.

Investigate how to invoke the bug creation UI

Implement ApplicationInsights

Editorial: "Large" group?

IMO six companies doesn't make a large group.

UI bundling issue

On VSTS, if I disable bundle, the UI displays properly. However, when I enable bundle on the page, the UI cannot display and I saw an 'Uncaught ReferenceError: module is not defined' error message.

Need a 'State' dropdown with values: Blocking, Non-Blocking

Unchecking both blocking and non-blocking is implicitly 'All'

Provide victory page when all issues are non-blocking

UI contains clickable gesture to show all non-blocking technical debt.

If there aren't any non-blocking issues, show a happy screen without the tech debt link. and use a happy jumping cat rather than a dog in the graphic.

Remove bug column

Investigate options for displaying and editing source log in Validator UI

Display detail view content to the separate page.

Right now, the detail view stays in the result explorer tab. This work item is going to move the detail view to the separate page.

Targets that refer to hosted source content should be clickable links

And these links, when clicked, should select the appropriate line location (expressed as the region associated with the result).

Remove Validator menu item from mobile layouts

Replace header strip items with hamburger menu

Escape key should dismiss image viewer

Keros test data needs to be refreshed

We are using outdated content.

Add slide effect to image viewer next/prev

Provide better 'collapse/expand all children' capabilities for exploring results

UI should show error icon and count

Need links for OASIS and OASIS SARIF Technical Committee.

OASIS: https://www.oasis-open.org/
OASIS and OASIS SARIF Technical Committee: https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=sarif

Enhance compat with small screens

TSLint stores entire file as code region

1. We need to fix this in the converter code.
2. We need to consider how a user would report this problem to us in the UX

Need to rationalize blocking/non-blocking with filed vs. unfiled

A preliminary suggestion for metrics:

X blocking issues, Y non-blocking, Z total bugs filed

A blocking issue with a bug filed against doesn't exist: that issue by definition is non-blocking in our first implementation. Since we will provide bucket bugs, there won't be an specific mapping of issue -> bug in all cases. Still, it is helpful to know how many active bugs there are.

Need to track whether group by/column picker/text filter needs to be moved

By plan, this screen territory is not currently ours.

Longhan will start this conversation.

"Legacy site" link doesn't work

It goes to "http://sarif.azurewebsites.net/" and then says "Site can't be reached."

But anyway... is there a "legacy site"? I don't think we maintained the old page; we published the new site right over it.

C# bracket in Tools section doesn't stretch on mobile Chrome

Integrate sarifview/disco UI into the VSTS extension

Implement SarifWeb Validator UI

Define range of reasons an issue is marked as non-blocking

Other languages section gets misaligned on narrow screens

Create "screen simulator" test utility that opens browser windows at various resolutions

Remove root node in single domain cases

When all issues belong to a single domain (i.e., 'Accessibility), we should eliminate the root node (while also making it clear somehow that all the results displayed are associated with the accessibility domain)

Consider validating in-memory streams rather than files on disk