open/llm-security
1
0
Fork 0
Code Issues Releases 1 Activity

fix(llm-security): sarif-formatter splits comma-separated owasp string into multiple tags

Browse source 
buildRules() and toSARIF() wrapped a multi-mapping f.owasp string
(e.g. 'MCP03, MCP06', emitted by mcp-live-inspect.mjs and
ide-extension-scanner.mjs) as a single-element tags array instead of
splitting it, silently dropping the second OWASP mapping in SARIF
output. Added owaspTags() helper; test asserts a multi-entry tags
array for both rule and result properties.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WbQmoLxcAAsJAkFxBeCx6z
This commit is contained in:
Kjell Tore Guttormsen 2026-08-18 16:52:52 +02:00
commit e97c23246e
2 changed files with 44 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

13
scanners/lib/sarif-formatter.mjs
View file

@ -26,6 +26,15 @@ function toLevel(severity) {
}
}
/**
* Split a possibly comma-separated OWASP string (e.g. 'MCP03, MCP06') into tags.
* @param {string} [owasp]
* @returns {string[]}
*/
function owaspTags(owasp) {
return owasp ? owasp.split(',').map(s => s.trim()).filter(Boolean) : [];
}
/**
* Build SARIF rules array from unique finding scanner+title combos.
* @param {object[]} findings
@ -46,7 +55,7 @@ function buildRules(findings) {
fullDescription: { text: f.description || f.title },
defaultConfiguration: { level: toLevel(f.severity) },
properties: {
tags: f.owasp ? [f.owasp] : [],
tags: owaspTags(f.owasp),
},
});
}
@ -87,7 +96,7 @@ export function toSARIF(envelopeData, version = '6.0.0') {
// Add OWASP tags
if (f.owasp) {
result.properties.tags = [f.owasp];
result.properties.tags = owaspTags(f.owasp);
}
// Add recommendation