SARIF.nvim

A Neovim plugin for viewing SARIF formatted static analysis results.

SARIF (Static Analysis Results Interchange Format) is an open standard for making results coming from static analysis tools to be interoperable. A few static analysis tools support SARIF output, while there exists many converters that convert other static analysis tool outputs into SARIF format (eg: SARIF Multitool, ESLint, axe).

There are extensions for VSCode for loading and viewing SARIF logs : SARIF Viewer & SARIF Explorer. This plugin tries to do what these extensions do, but inside Neovim.

Features

1. Open SARIF files and list the results in a viewer
2. Classify results as True positive or False positive report, and also add comments to help during review.
3. Comments are stored in SARIF Explorer's .sarifexplorer format (specifications), and so the plugin is interoperable with SARIF explorer.

Installation

Using vim-plug

Plug 'nifey/sarif.nvim'

Using dein

call dein#add('nifey/sarif.nvim')

Using packer.nvim

use {
  'nifey/sarif.nvim'
}

Using lazy.nvim

-- init.lua:
    {
    'nifey/sarif.nvim'
    }

Usage

The plugin provides two user commands SarifLoad to load a SARIF file, and SarifView to view the loaded results.

:SarifLoad <file.sarif>
:SarifView

For ease of viewing the results, you may want to add a keybinding for the SarifView command, like below:

vim.keymap.set("n", "fs", "<cmd>SarifView<CR>")

When the SarifView window is open, the top window shows a table of results, where each row displays the file name and a short message about the error. The window on the bottom shows more information about the currently selected result including the rule, the SARIF log from which it was read, and the static analysis tool that created that report. When inside the SarifView window the following key bindings can be used:

• j and k to move between the results in the results table
• <enter> to go to the location of the currently selected bug report
• h and l to scroll the detail view pane
• m to mark the status of the result (Cycles between True positive, False positive and None)
• i to update or insert a comment about a result

Todo

• UI improvements
  • Dynamic table resize
  • Use colors and icons
• Ability to sort, filter results based on file, category, bug status, etc
• Ability to traverse codeflows given in the SARIF logs
• Allow writing long-form comments rather than just a single line comment
• Handling more generic cases from SARIF Specifications
• Integrate with Nvim diagnostics to show the reports for the current file while editing