fix: multi-folder --report writes report.json and OA/DM panels - #901
Conversation
|
cc: @sonukapoor |
sonukapoor
left a comment
sonukapoor
left a comment
There was a problem hiding this comment.
This closes the multi-folder gap cleanly - report.json written with findings tagged by subfolder, and the override/maintenance panels render per folder like single-folder mode. I ran it on a real two-folder layout and the outputs look right.
One thing before merge, left inline: findings get serialized twice, once for the HTML and once for report.json - worth folding into one pass. Two optional test adds would be nice too (a second-folder subfolder-tag assertion, and a mixed case where only one folder has override findings), not blocking. Thanks for this.
| }): MultiFolderReportData { | ||
| const findings = params.results.flatMap(r => | ||
| r.sorted.map(f => ({ | ||
| ...serializeHtmlFinding(f, r.suggestedFixCommands), |
There was a problem hiding this comment.
This serializes every finding twice - allSerialized further down builds the HTML rows, and this call re-runs serializeHtmlFinding over the same findings for report.json. Single-folder mode serializes once and reuses it for both. Could you thread allSerialized (with the subfolder tag folded in) into buildMultiFolderReportData instead of re-deriving it here? Keeps it to one pass and stops the two outputs drifting if serialization ever changes.
bd0ad42 to
8c0f507
Compare
|
@sonukapoor rebased onto latest |
f86f591 to
b9e8b14
Compare
|
Thanks for adding the report.json + OA/DM panels, this looks solid on its own. But I don't think this addresses the serialization point from my last review - |
Multi-folder HTML reports previously only emitted index.html and never rendered override/maintenance sections even when those checks ran. Parity with single-folder: both artifacts plus per-folder OA/DM panels. Serialize findings once and reuse for HTML and report.json. Fixes OWASP#878
22c9782 to
05cebda
Compare
|
@sonukapoor addressed the serialization feedback — |
sonukapoor
left a comment
sonukapoor
left a comment
There was a problem hiding this comment.
Confirmed - findings are serialized once now and reused for both the HTML and report.json, exactly what I was after. Nice work on the OA/DM panel parity too, this closes a real gap between single-folder and multi-folder reports.
|
Merged - thank you @Ayush7614! |
Reverts commit 0c3d129 (#961). The feature and its Cloudflare Worker backend are being reconsidered - the public ingest endpoint is unauthenticated by design (anyone can post fake data to skew the aggregate numbers this feature exists to eventually cite), and the deployed Worker's *.workers.dev URL currently bakes in a personal Cloudflare account name. Shipping the prompt/commands/docs while this is unresolved would create a false impression the feature is settled. The code isn't lost - it's being consolidated, alongside the Worker backend, on a separate branch to revisit once the open questions are resolved. verified to cleanly preserve both (multi-folder-scan.ts keeps #901's report.json/OA/DM panel work, README.md keeps #956's unrelated intro line unchanged) - confirmed by inspecting every auto-merged file directly, not just trusting a clean git revert.
#965) Reverts commit 0c3d129 (#961). The feature and its Cloudflare Worker backend are being reconsidered - the public ingest endpoint is unauthenticated by design (anyone can post fake data to skew the aggregate numbers this feature exists to eventually cite), and the deployed Worker's *.workers.dev URL currently bakes in a personal Cloudflare account name. Shipping the prompt/commands/docs while this is unresolved would create a false impression the feature is settled. The code isn't lost - it's being consolidated, alongside the Worker backend, on a separate branch to revisit once the open questions are resolved. verified to cleanly preserve both (multi-folder-scan.ts keeps #901's report.json/OA/DM panel work, README.md keeps #956's unrelated intro line unchanged) - confirmed by inspecting every auto-merged file directly, not just trusting a clean git revert.
2 participants
Summary
--reportnow writesreport.jsonalongsideindex.html, matching single-folder artifact shape.--check-overrides/--check-maintenanceare set (including empty-state reassurance).report.jsontags OA/DM findings withsubfolder; docs note the multi-folder parity.Fixes #878
Test plan
npm test -- tests/multi-folder-html-reporter.test.ts(8 tests)npm run buildcve-lite . --check-overrides --check-maintenance --report ./cve-report --no-open→index.html+report.json, HTML includes Override hygiene / Maintenance risk when findings exist