Feature Request : Add `--sarif-ui` option to support SARIF-Formatted Output

[FlorianBarrau]

I suggest to add the support for Static Analysis Results Interchange Format (SARIF), by adding an option --sarif-ui to the command line. It would be an extension of the existing json-ui option,
It would be great if you can add this.

Thank you :)

[tautschnig]

Thank you very much for your suggestion. Patches are always welcome, so feel free to contribute. If you'd like to see this implemented and don't have the time to contribute a patch yourself, then could you please elaborate on your request by providing a detailed use case? In absence thereof it would be hard to come up with a test that confirms that the feature works in line with your expectations.

[martin-cs]

@FlorianBarrau SARIF would be great but as @tautschnig says, if there were one or more users or system integrators who would use this it would make it much easier to test and provide extra motivation to implement it.

[FlorianBarrau]

@tautschnig @martin-cs
Thank you for your feedback. I understand the point.
I had requested this feature because github claims to support SARIF through CodeQL as shown in this post.
Maybe i can add some suggestions

1. A first quick try would be to transform the json output of cbmc using --json-ui option to provide something that looks like SARIF. There is no big difference. At least we've been able to output something, but do not know whether it suits well with codeQL. We did an offline transformation, but i am not sure i am authorized to share the scripts here.
2. If it is hard to find users for this, maybe you could add it for yourself for your own dev as the repository is already in github, and github seem to support SARIF through codeQL. It would be a good starting point in my opinion. Up to you to evaluate.

HTH
Florian

[kdudka]

We have introduced support for the SARIF format in csdiff. So one can pipe the output of formatCBMCOutput.py from cbmc-utils into csgrep --mode=sarif and upload its output to a GitHub pull request. @jamacku was recently successful in using csgrep for producing SARIF in his differential-shellcheck GitHub action.