-
Notifications
You must be signed in to change notification settings - Fork 1.9k
-
I have read part of SARIF https://docs.oasis-open.org/sarif/sarif/v2.1.0/cs01/sarif-v2.1.0-cs01.html, particularly partialFingerprints property.
Also, SARIF results file from https://lgtm.com/help/lgtm/sarif-results-file.
This will contain, at a minimum, a value for the primaryLocationLineHash, which provides a fingerprint based on the context of the primary location.
Can anyone tell me how primaryLocationLineHash be generated. What algorithm ?
I have noticed the result contains codeflow property. Does codeflow affect generation of primaryLocationLineHash ?
Beta Was this translation helpful? Give feedback.
All reactions
Hi @ZH3FENG, can you please elaborate on why you want to know how primaryLocationLineHash is generated? As I see it, this is just some unique hash value produced by CodeQL to help determine whether two results are logically identical.
Replies: 2 comments 4 replies
-
Hi @ZH3FENG, can you please elaborate on why you want to know how primaryLocationLineHash is generated? As I see it, this is just some unique hash value produced by CodeQL to help determine whether two results are logically identical.
Beta Was this translation helpful? Give feedback.
All reactions
-
I knew it's purpose.
I'am thinking whether a customized sanitization would change it, especially when the sanitization is valid.
Will a new result reported?
Beta Was this translation helpful? Give feedback.
All reactions
-
I'm not too familiar with the specific logic. Can you please elaborate on why you want to know how primaryLocationLineHash is generated? (have you experienced any specific problems?)
Beta Was this translation helpful? Give feedback.
All reactions
-
Not yet.
I'm worrying about customized sanitization will change it, then another new vulnerability will be reported.
Maybe i should do some test.
Thanks.
Beta Was this translation helpful? Give feedback.
All reactions
-
👍 1
-
👌
Beta Was this translation helpful? Give feedback.
All reactions
-
An implementation of the algorithm used by CodeQL can be found at https://github.com/github/codeql-action/blob/216127f34aa309c5876c25b8ea6bda90f4f559fe/src/fingerprints.ts#L30-L41
Beta Was this translation helpful? Give feedback.