Giters

spotbugs / spotbugs

SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code.

Home Page:https://spotbugs.github.io/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Add CWE Taxonomy to SARIF Report

Jeeppler opened this issue · comments

commented

Description

The SARIF reports generated by FindSecurityBugs do not contain the Common Weakness Enumeration (CWE) taxonomy from MITRE.

Adding the CWE Taxonomies into SARIF reports would make the SARIF report easier to understand for security practitioners already familiar with CWE.

SARIF does support taxonomies in reports.
For example, SARIF reports from the GoSec tool contain the MITRE CWE taxonomy.

commented

Thanks for opening your first issue here! 😃
Please check our contributing guideline. Especially when you report a problem, make sure you share a Minimal, Complete, and Verifiable example to reproduce it in this issue.

commented

I already opened the same issue in FindSecurityBugs: find-sec-bugs/find-sec-bugs/issues/688. However, the maintainers of FindSecurityBugs told me, SpotBugs is responsible for generating the SARIF report.