
    >/i'*                         S r SSKrSSKrSSKrSSKrSSKJr  SSKr	SSK
Jr  SSKrSSKJr  \R                  " \5      rSrSrSrSS jrS	 rS
 rS rS rS rS rS rS rg)a[  
===============
SARIF formatter
===============

This formatter outputs the issues in SARIF formatted JSON.

:Example:

.. code-block:: javascript

    {
      "runs": [
        {
          "tool": {
            "driver": {
              "name": "Bandit",
              "organization": "PyCQA",
              "rules": [
                {
                  "id": "B101",
                  "name": "assert_used",
                  "properties": {
                    "tags": [
                      "security",
                      "external/cwe/cwe-703"
                    ],
                    "precision": "high"
                  },
                  "helpUri": "https://bandit.readthedocs.io/en/1.7.8/plugins/b101_assert_used.html"
                }
              ],
              "version": "1.7.8",
              "semanticVersion": "1.7.8"
            }
          },
          "invocations": [
            {
              "executionSuccessful": true,
              "endTimeUtc": "2024-03-05T03:28:48Z"
            }
          ],
          "properties": {
            "metrics": {
              "_totals": {
                "loc": 1,
                "nosec": 0,
                "skipped_tests": 0,
                "SEVERITY.UNDEFINED": 0,
                "CONFIDENCE.UNDEFINED": 0,
                "SEVERITY.LOW": 1,
                "CONFIDENCE.LOW": 0,
                "SEVERITY.MEDIUM": 0,
                "CONFIDENCE.MEDIUM": 0,
                "SEVERITY.HIGH": 0,
                "CONFIDENCE.HIGH": 1
              },
              "./examples/assert.py": {
                "loc": 1,
                "nosec": 0,
                "skipped_tests": 0,
                "SEVERITY.UNDEFINED": 0,
                "SEVERITY.LOW": 1,
                "SEVERITY.MEDIUM": 0,
                "SEVERITY.HIGH": 0,
                "CONFIDENCE.UNDEFINED": 0,
                "CONFIDENCE.LOW": 0,
                "CONFIDENCE.MEDIUM": 0,
                "CONFIDENCE.HIGH": 1
              }
            }
          },
          "results": [
            {
              "message": {
                "text": "Use of assert detected. The enclosed code will be removed when compiling to optimised byte code."
              },
              "level": "note",
              "locations": [
                {
                  "physicalLocation": {
                    "region": {
                      "snippet": {
                        "text": "assert True\n"
                      },
                      "endColumn": 11,
                      "endLine": 1,
                      "startColumn": 0,
                      "startLine": 1
                    },
                    "artifactLocation": {
                      "uri": "examples/assert.py"
                    },
                    "contextRegion": {
                      "snippet": {
                        "text": "assert True\n"
                      },
                      "endLine": 1,
                      "startLine": 1
                    }
                  }
                }
              ],
              "properties": {
                "issue_confidence": "HIGH",
                "issue_severity": "LOW"
              },
              "ruleId": "B101",
              "ruleIndex": 0
            }
          ]
        }
      ],
      "version": "2.1.0",
      "$schema": "https://json.schemastore.org/sarif-2.1.0.json"
    }

.. versionadded:: 1.7.8

    N)to_json)
docs_utilsz-https://json.schemastore.org/sarif-2.1.0.jsonz2.1.0z%Y-%m-%dT%H:%M:%SZc                    [         R                  " [        [        [         R                  " [         R
                  " [         R                  " S[        R                  [        R                  [        R                  S9S9[         R                  " [        R                  R                  [        R                  R                  5      R                  [         5      SS9/SU R"                  R$                  0S9/S9nUR&                  S	   nUR(                  S	   nU R+                  5       n[-        X5        U R/                  X#S
9n	[1        X5        [3        U5      n
U   UR5                  U
5        SSS5        UR6                  [8        R:                  R6                  :w  a!  [<        R?                  SUR6                  5        gg! , (       d  f       NX= f)a  Prints issues in SARIF format

:param manager: the bandit manager object
:param fileobj: The output file object, which may be sys.stdout
:param sev_level: Filtering severity level
:param conf_level: Filtering confidence level
:param lines: Number of lines to report, -1 for all
Bandit)nameorganizationsemantic_versionversion)driverT)end_time_utcexecution_successfulmetrics)toolinvocations
properties)
schema_urir
   runsr   )	sev_level
conf_levelNz SARIF output written to file: %s) omSarifLog
SCHEMA_URI
SCHEMA_VERRunToolToolComponentbandit
__author____version__
Invocationdatetimenowtimezoneutcstrftime	TS_FORMATr   datar   r   get_skippedadd_skipped_file_notificationsget_issue_listadd_resultsr   writer   sysstdoutLOGinfo)managerfileobjr   r   lineslogrun
invocationskipsissuesserializedLogs              Q/home/james-whalen/.local/lib/python3.13/site-packages/bandit/formatters/sarif.pyreportr;      sY    ++FFWW++%%+%6%6)/);); & 2 2	 MM%-%6%6%:%:$--11&"(9--1	 &w';';<#
C4 ((1+C#J!E"55##i#OFCLM	m$ 
 ||szz&3W\\B ' 
s   F;;
G	c                 r   U b  [        U 5      S:X  a  g UR                  c  / Ul        U  H  nUu  p4[        R                  " S[        R                  " US9[        R
                  " [        R                  " [        R                  " [        U5      S9S9S9/S9nUR                  R                  U5        M     g )Nr   errortexturiartifact_locationphysical_location)levelmessage	locations)
len tool_configuration_notificationsr   NotificationMessageLocationPhysicalLocationArtifactLocationto_uriappend)r7   r6   skip	file_namereasonnotifications         r:   r)   r)      s    }E
a22:68
3"JJF+&(&9&9*,*=*= &y 1+'
 	33::<H#     c                    UR                   c  / Ul         0 n0 nU  H*  n[        XBU5      nUR                   R                  U5        M,     [        U5      S:  a3  [	        UR                  5       5      UR                  R                  l        g g )Nr   )	resultscreate_resultrQ   rI   listvaluesr   r   rules)r8   r5   r\   rule_indicesissueresults         r:   r+   r+      sr    
{{ELu\:6"  5zA~ $U\\^ 4 rV   c           
         U R                  5       n[        X1U5      u  pE[        R                  " [        R                  " [        US   5      S9S9n[        UUS   US   US   US   5        [        R                  " UR                  U[        R                  " US   S	9[        US
   5      [        R                  " US9/US   US
   S.S9$ )Nfilenamer@   rB   
line_range
col_offsetend_col_offsetcode
issue_textr>   issue_severityrD   issue_confidence)rh   rg   )rule_id
rule_indexrG   rF   rH   r   )as_dictcreate_or_find_ruler   rN   rO   rP   add_region_and_context_regionResultidrL   level_from_severityrM   )r^   r\   r]   
issue_dictrulerj   rE   s          r:   rY   rY      s    J*:lKD++--z*-.
 "< < #$6 99


< 89!*-=">?;;1BCD *+= >()9:

 
rV   c                 .    U S:X  a  gU S:X  a  gU S:X  a  gg)NHIGHr=   MEDIUMwarningLOWnote )severitys    r:   rp   rp     s&    6	X		U	rV   c           	         U(       a,  [        U5      u  pVXaS   U-
     n[        R                  " US9nOS n[        R                  " US   [	        U5      S:  a  US   OUS   US-   US-   US9U l        U(       aL  [        R                  " WU[	        W5      -   S-
  [        R                  " SR                  U5      S9S9U l        g g )Nr   r>      )
start_lineend_linestart_column
end_columnsnippet )r}   r~   r   )
parse_coder   ArtifactContentRegionrI   regionjoincontext_region)	rE   rb   rc   rd   re   first_line_numbersnippet_linessnippet_liner   s	            r:   rm   rm     s     +5d+;($]5F%FG$$,7!yya="%j/A"5A:a=!^!A%  +-99(&]);;a?&&BGGM,BC,
( rV   c                    U R                  S5      nU[        U5      S-
     nSn[        U5      S:X  a  UR                  5         Sn/ nSnSnU HE  nUR                  SS5      nU(       a  [        US   5      nSnUS   S-   n	UR	                  U	5        MG     U(       d1  U[        U5      S-
     nUS [        U5      S-
   U[        U5      S-
  '   XT4$ )N
r|   Fr   T )splitrI   popintrQ   )
re   
code_lines	last_linelast_real_line_ends_in_newliner   r   first	code_linenumber_and_snippet_liner   s
             r:   r   r   7  s    D!J 3z?Q./I%*"
9~)-&ME	"+//#q"9 #$;A$> ?E.q1D8\*   *!#m"4q"89	09:NC	NQ<N0Oc-(1,-++rV   c           
         U S   nX1;   a  X   X#   4$ [         R                  " UU S   [        R                  " U5      SSU S   R	                  S5       3/U S   R                  5       S.S	9n[        U5      nXAU'   XRU'   XE4$ )
Ntest_id	test_namesecurityzexternal/cwe/cwe-	issue_cwero   rh   )tags	precision)ro   r   help_urir   )r   ReportingDescriptorr   get_urlgetlowerrI   )rq   r\   r]   ri   rr   indexs         r:   rl   rl   V  s    #G~|444!!$##G, #J{$;$?$?$E#FG $$67==?
	D JE'N!;rV   c                     [         R                  " U 5      nUR                  5       (       a  UR                  5       $ UR	                  5       n[
        R                  " U5      $ )N)pathlibPurePathis_absoluteas_urias_posixurlparsequote)	file_path	pure_path
posix_paths      r:   rP   rP   n  sO      +I!! '')
~~j))rV   ))__doc__r!   loggingr   r-   urllib.parseparser   sarif_omr   jschema_to_python.to_jsonr   r   bandit.corer   	getLogger__name__r/   r   r   r&   r;   r)   r+   rY   rp   rm   r   rl   rP   ry   rV   r:   <module>r      sy   wp    
   -  "!<

 	4CnI65@
4,>0*rV   