diff --git a/infrastructure/code/code_html.go b/infrastructure/code/code_html.go index a40aa5977..7c1eb6234 100644 --- a/infrastructure/code/code_html.go +++ b/infrastructure/code/code_html.go @@ -19,6 +19,7 @@ package code import ( _ "embed" "fmt" + "html" "path/filepath" "regexp" "strings" @@ -46,27 +47,29 @@ func getDataFlowHeadingHtml(issue snyk.CodeIssueData) string { } func getDataFlowHtml(issue snyk.CodeIssueData) string { - dataFlowHtml := "" + dataFlowHtml := `` + for i, flow := range issue.DataFlow { fileName := filepath.Base(flow.FilePath) dataFlowHtml += fmt.Sprintf(` -
- %d - - %s:%d - | - %s -
`, + + + + + + `, i+1, - flow.FilePath, + html.EscapeString(flow.FilePath), flow.FlowRange.Start.Line, flow.FlowRange.End.Line, flow.FlowRange.Start.Character, flow.FlowRange.End.Character, - fileName, + html.EscapeString(fileName), flow.FlowRange.Start.Line+1, - flow.Content) + html.EscapeString(flow.Content)) } + + dataFlowHtml += `
%d%s:%d|%s
` return dataFlowHtml } @@ -92,7 +95,7 @@ func getTabsHtml(fixes []snyk.ExampleCommitFix) string { tabsHtml += fmt.Sprintf(`%s`, isSelectedClass, i, getRepoName(fix.CommitURL)) } - tabsHtml += "" + tabsHtml += `
` // Generate the contents for each tab for i, fix := range fixes { @@ -106,6 +109,8 @@ func getTabsHtml(fixes []snyk.ExampleCommitFix) string { tabsHtml += fmt.Sprintf(`
%s
`, i, isSelectedClass, contentHtml) } + tabsHtml += `
` + return tabsHtml } @@ -136,6 +141,8 @@ func getDetailsHtml(issue snyk.Issue) string { html = replaceVariableInHtml(html, "exampleCount", fmt.Sprintf("%d", len(additionalData.ExampleCommitFixes))) html = replaceVariableInHtml(html, "tabsNav", getTabsHtml(additionalData.ExampleCommitFixes)) + log.Debug().Msgf("Details HTML: %s", html) + return html } diff --git a/infrastructure/code/code_html_test.go b/infrastructure/code/code_html_test.go index f5b03ce99..54666e37c 100644 --- a/infrastructure/code/code_html_test.go +++ b/infrastructure/code/code_html_test.go @@ -50,14 +50,12 @@ func Test_CodeDetailsPanel_html_getDetailsHtml(t *testing.T) { codePanelHtml := getDetailsHtml(issue) // assert Data Flow section - expectedDataFlowHeading := fmt.Sprintf("

Data Flow - %d steps

", len(dataFlow)) + expectedDataFlowHeading := fmt.Sprintf(`

Data Flow - %d steps

`, len(dataFlow)) assert.Contains(t, codePanelHtml, expectedDataFlowHeading) - assert.Contains(t, codePanelHtml, "

Data Flow - 4 steps

") - assert.Contains(t, codePanelHtml, "class=\"data-flow-section\"") - assert.Contains(t, codePanelHtml, "class=\"data-flow-row\"") - assert.Contains(t, codePanelHtml, "if (!vulnLines.every(e => selectedLines.includes(e))) return false") - assert.Contains(t, codePanelHtml, `vulnCodeSnippet.ts:68`) + assert.Contains(t, codePanelHtml, ``) + assert.Contains(t, codePanelHtml, ``) + assert.Contains(t, codePanelHtml, ``) assert.NotContains(t, codePanelHtml, "${dataFlow}") assert.NotContains(t, codePanelHtml, "${dataFlowCount}") diff --git a/infrastructure/code/convert_test.go b/infrastructure/code/convert_test.go index 1a4e06bb4..eb4b766a7 100644 --- a/infrastructure/code/convert_test.go +++ b/infrastructure/code/convert_test.go @@ -645,7 +645,10 @@ func TestSnykCodeBackendService_convert_shouldConvertIssues(t *testing.T) { assert.Equal(t, resp.Sarif.Runs[0].Tool.Driver.Rules[0].Properties.Cwe, issue.CWEs) assert.Nil(t, issues[0].IgnoreDetails) assert.False(t, issues[0].IsIgnored) - assert.Contains(t, (issues[0].AdditionalData).(snyk.CodeIssueData).Details, "

Data Flow - 4 steps

") + + codeIssueData, _ := issues[0].AdditionalData.(snyk.CodeIssueData) + dataFlowSteps := fmt.Sprintf(`

Data Flow - %d steps

`, len(codeIssueData.DataFlow)) + assert.Contains(t, codeIssueData.Details, dataFlowSteps) } func referencesForSampleSarifResponse() []snyk.Reference { diff --git a/infrastructure/code/template/details.html b/infrastructure/code/template/details.html index a19b21b2a..1f884b4d2 100644 --- a/infrastructure/code/template/details.html +++ b/infrastructure/code/template/details.html @@ -22,6 +22,273 @@ @@ -46,21 +313,39 @@
-

${dataFlowHeading}

+

${dataFlowHeading}

${dataFlow}
-
-

External example fixes

-

+

+

External example fixes

+
This issue was fixed by ${repoCount} projects. Here are ${exampleCount} example fixes: -

+
${tabsNav}
+
vulnCodeSnippet.ts:68if (!vulnLines.every(e => selectedLines.includes(e))) return false