SarifEmitter.java

package org.egothor.methodatlas.emit;

import java.io.IOException;

import java.io.PrintWriter;

import java.util.ArrayList;

import java.util.LinkedHashMap;

import java.util.List;

import java.util.Locale;

import java.util.Map;

import java.util.regex.Pattern;

import org.egothor.methodatlas.TagAiDrift;

import org.egothor.methodatlas.TestMethodSink;

import org.egothor.methodatlas.ai.AiMethodSuggestion;

import com.fasterxml.jackson.annotation.JsonInclude;

import com.fasterxml.jackson.annotation.JsonInclude.Include;

import com.fasterxml.jackson.annotation.JsonProperty;

import com.fasterxml.jackson.databind.SerializationFeature;

import com.fasterxml.jackson.databind.json.JsonMapper;

/**

 * Buffers test method records and serializes them as a single SARIF 2.1.0 JSON

 * document when {@link #flush(PrintWriter)} is called.

 *

 * <p>

 * SARIF (Static Analysis Results Interchange Format) is an OASIS standard for

 * representing the results of static analysis tools. MethodAtlas uses it to

 * emit a machine-readable inventory of discovered test methods, with

 * security-relevant methods distinguished from ordinary test methods via the

 * SARIF result level ({@code note} vs {@code none}).

 * </p>

 *

 * <p>

 * Each test method becomes one SARIF result. Security-relevant methods receive

 * level {@code note} and a rule derived from the first non-umbrella AI tag

 * (e.g. {@code security/auth}). All other methods receive level {@code none}

 * and rule {@code test-method}.

 * </p>

 *

 * <p>

 * AI enrichment fields (display name, tags, reason, confidence) are stored in

 * the SARIF result {@code properties} bag when an {@link AiMethodSuggestion}

 * is available.  The interaction score and, when confidence reporting is

 * enabled, the confidence percentage are also embedded directly in the

 * result message text so they remain visible in tooling (such as GitHub Code

 * Scanning) that does not render the {@code properties} bag.

 * </p>

 *

 * <p>

 * This class implements {@link TestMethodSink} so it can be passed directly to

 * the orchestration layer in {@code MethodAtlasApp}.

 * </p>

 *

 * @see TestMethodSink

 */

// SarifEmitter handles multiple SARIF rule types, severity tiers, and output variants;

// its aggregate class CC legitimately exceeds the 80 default.

@SuppressWarnings("PMD.CyclomaticComplexity")

public final class SarifEmitter implements TestMethodSink {

    private static final String SARIF_SCHEMA =

            "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json";

    private static final String SARIF_VERSION = "2.1.0";

    private static final int SINGLE_CHAR_LENGTH = 1;

    private static final int RULE_ID_PART_COUNT = 2;

    private static final String RULE_TEST_METHOD = "test-method";

    private static final String RULE_SECURITY_TEST = "security-test";

    private static final String RULE_EMPTY_DISPLAY_NAME = "annotation/empty-display-name";

    private static final String RULE_SECURITY_PLACEBO = "security-test/placebo";

    private static final String LEVEL_NOTE = "note";

    private static final String LEVEL_NONE = "none";

    private static final String LEVEL_WARNING = "warning";

    /** Interaction score at or above which a security test is flagged as a potential placebo. */

    private static final double PLACEBO_THRESHOLD = 0.8;

    private static final String SEVERITY_CRITICAL = "9.0";

    private static final String SEVERITY_DESERIALIZATION = "8.5";

    private static final String SEVERITY_HIGH = "7.5";

    private static final String SEVERITY_MEDIUM_HIGH = "6.5";

    private static final String SEVERITY_MEDIUM = "5.5";

    private static final String SEVERITY_PLACEBO = "6.0";

    private static final String SEVERITY_LOW = "4.0";

    private static final String SEVERITY_DEFAULT = "5.0";

    /**

     * Maps AI taxonomy tags to SARIF {@code security-severity} scores (0–10).

     * GitHub Code Scanning maps ≥9 → Critical, ≥7 → High, ≥4 → Medium, >0 → Low.

     */

    private final boolean aiEnabled;

    private final boolean confidenceEnabled;

    private final boolean scoresInMessage;

    private final String filePrefix;

    private final String toolVersion;

    /**

     * Creates a new SARIF emitter with scores embedded in result message text

     * (the default behaviour).

     *

     * @param aiEnabled         whether AI enrichment columns should be included

     * @param confidenceEnabled whether the {@code aiConfidence} property should

     *                          be included; only meaningful when {@code aiEnabled}

     *                          is {@code true}

     * @param filePrefix        forward-slash path prefix prepended to every

     *                          artifact URI to produce a repo-relative path (e.g.

     *                          {@code "src/test/java/"}); use empty string when

     *                          the scan root is already the repository root

     */

    public SarifEmitter(boolean aiEnabled, boolean confidenceEnabled, String filePrefix) {

    /**

     * Creates a new SARIF emitter.

     *

     * @param aiEnabled         whether AI enrichment columns should be included

     * @param confidenceEnabled whether the {@code aiConfidence} property should

     *                          be included; only meaningful when {@code aiEnabled}

     *                          is {@code true}

     * @param filePrefix        forward-slash path prefix prepended to every

     *                          artifact URI to produce a repo-relative path (e.g.

     *                          {@code "src/test/java/"}); use empty string when

     *                          the scan root is already the repository root

     * @param scoresInMessage   when {@code true} (the default), the interaction

     *                          score and confidence percentage are embedded in the

     *                          result message text so they are visible in tooling

     *                          (such as GitHub Code Scanning) that does not render

     *                          the {@code properties} bag; set to {@code false}

     *                          when the consuming system already displays

     *                          {@code properties} and the extra text is unwanted

     */

    public SarifEmitter(boolean aiEnabled, boolean confidenceEnabled, String filePrefix,

    /**

     * Buffers a single test method record.

     */

    @Override

    @SuppressWarnings("PMD.UseObjectForClearerAPI")

    public void record(String fqcn, String method, int beginLine, int loc, String contentHash,

            List<String> tags, String displayName, AiMethodSuggestion suggestion) {

    /**

     * Serializes all buffered records as a SARIF 2.1.0 JSON document and writes

     * it to the supplied writer.

     *

     * @param out destination writer

     * @throws IllegalStateException if JSON serialization fails

     */

    public void flush(PrintWriter out) {

            }

            }

        try {

    // -------------------------------------------------------------------------

    // Private helpers

    // -------------------------------------------------------------------------

    private String resolveRuleId(AiMethodSuggestion suggestion) {

        }

        }

            }

    }

    private static SarifRule buildRule(String ruleId) {

    }

    private static List<String> toRuleTags(String ruleId) {

        }

        }

        }

        }

        }

    }

    private static String toRuleName(String ruleId) {

                }

            }

        }

    }

    private static String toRuleDescription(String ruleId) {

            case RULE_SECURITY_PLACEBO ->

        };

    }

    private static String toRuleHelp(String ruleId) {

            case RULE_TEST_METHOD ->

                + "This result represents a test method that was not classified as security-relevant "

                + "by the AI, or that was scanned without AI enrichment enabled. No action is required.";

            case RULE_EMPTY_DISPLAY_NAME ->

                + "CI dashboards, and audit evidence packages. Tests without names are difficult to "

                + "trace in security audit logs. Replace @DisplayName(\"\") with a meaningful "

                + "description of what the test verifies.";

            case RULE_SECURITY_PLACEBO ->

                + PLACEBO_THRESHOLD + " (the actual score is shown in the finding message). "

                + "The score measures what fraction of the test's assertions only verify "

                + "that methods were called (e.g. Mockito verify(), spy call counts) "

                + "rather than asserting on return values, thrown exceptions, or observable state. "

                + "Such tests may give false confidence: the code under test could return wrong data "

                + "or corrupt state and the test would still pass. "

                + "Add assertions on security-critical outputs, e.g. "

                + "assertThat(response.getStatus()).isEqualTo(403), "

                + "assertThrows(SecurityException.class, ...), "

                + "or assertThat(audit.getEvents()).contains(expectedEvent).";

            default ->

                + "Review the suggested @DisplayName and @Tag values in the result message. "

                + "If correct, apply them by running: ./methodatlas -ai -apply-tags SOURCE_ROOT. "

                + "The finding message also includes the interaction score and, when enabled, "

                + "the AI confidence score. An interaction score ≥ 0.8 means the test verifies "

                + "only method calls, not actual outcomes — in that case a separate "

                + "security-test/placebo finding is also raised.";

        };

    }

    private SarifResult buildResult(ResultRecord rec, String ruleId) {

    }

    private String resolveMessageText(ResultRecord rec) {

        }

        } else {

        }

        }

            }

        }

    }

    /**

     * Returns an optional score/confidence suffix to append to a security-method

     * message, or an empty string when {@code scoresInMessage} is {@code false}.

     *

     * <p>

     * Extracted from {@link #resolveMessageText(ResultRecord)} to keep its

     * NPath and cyclomatic complexity within PMD thresholds.

     * </p>

     *

     * @param s the AI suggestion for the method

     * @return formatted score text, possibly empty; never {@code null}

     */

    private String resolveScoreText(AiMethodSuggestion s) {

        }

        // Embed numeric scores so the operator can see them in tooling

        // (such as GitHub Code Scanning) that does not render the properties bag.

        }

                    + " See the security-test/placebo finding for remediation guidance.");

        }

    }

    private SarifProperties buildProperties(ResultRecord rec, String ruleId) {

                    null, null, null, null, null, null, null, securitySeverity);

        }

                tagAiDrift, securitySeverity);

    }

    private SarifResult buildEmptyDisplayNameResult(ResultRecord rec) {

                + " is explicitly empty — the test will appear unnamed in CI reports and audit "

                + "evidence packages. Replace with a meaningful description, e.g. "

                + "@DisplayName(\"Verifies that ...\").";

                null, null, null, null, null, null, null, null);

    }

    private SarifResult buildPlaceboResult(ResultRecord rec) {

                "Interaction score: %.2f (threshold: %.1f). "

                + "This security test only verifies that methods were called, "

                + "not what values they returned or what state they produced. "

                + "Tests that do not assert outcomes cannot catch regressions in security-critical logic. "

                + "Add assertions on return values, thrown exceptions, or observable state changes.",

        }

    }

    private static String resolveSecuritySeverity(String ruleId, AiMethodSuggestion suggestion) {

        }

                }

        }

    }

    // -------------------------------------------------------------------------

    // Internal buffer record

    // -------------------------------------------------------------------------

            String contentHash, List<String> tags, String displayName, AiMethodSuggestion suggestion) {

    }

    // -------------------------------------------------------------------------

    // SARIF 2.1.0 POJO records

    // -------------------------------------------------------------------------

            @JsonProperty("$schema") String schema,

            String version,

            List<SarifRun> runs) {

    }

    }

    }

    }

            SarifRuleProperties properties, SarifHelp help) {

    }

    }

    }

            String ruleId,

            String level,

            SarifMessage message,

            List<SarifLocation> locations,

            SarifProperties properties) {

    }

            SarifPhysicalLocation physicalLocation,

            List<SarifLogicalLocation> logicalLocations) {

    }

            SarifArtifactLocation artifactLocation,

            @JsonInclude(Include.NON_NULL) SarifRegion region) {

    }

    }

    }

    }

    }

            int loc,

            String contentHash,

            String sourceTags,

            Boolean aiSecurityRelevant,

            String aiDisplayName,

            String aiTags,

            String aiReason,

            Double aiInteractionScore,

            Double aiConfidence,

            String tagAiDrift,

            @JsonProperty("security-severity") String securitySeverity) {

    }

}

Mutations

1.1
Location : <init>
Killed by : none removed conditional - replaced equality check with true → SURVIVED Covering tests

2.2
Location : <init>
Killed by : none removed conditional - replaced equality check with false → SURVIVED Covering tests

4.4
Location : flush
Killed by : none removed conditional - replaced equality check with true → SURVIVED Covering tests

3.3
Location : flush
Killed by : none changed conditional boundary → SURVIVED Covering tests

4.4
Location : flush
Killed by : org.egothor.methodatlas.SarifEmitterTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.SarifEmitterTest]/[method:flush_securityMethodWithLowInteractionScore_noPlaceboResult()] removed conditional - replaced comparison check with true → KILLED

5.5
Location : flush
Killed by : org.egothor.methodatlas.SarifEmitterTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.SarifEmitterTest]/[method:flush_placeboMessage_scoreAlwaysPresent_evenWhenScoresInMessageFalse()] removed conditional - replaced equality check with false → KILLED

6.6
Location : flush
Killed by : org.egothor.methodatlas.SarifEmitterTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.SarifEmitterTest]/[method:flush_placeboResult_hasLevelWarning()] removed conditional - replaced comparison check with false → KILLED

7.7
Location : flush
Killed by : org.egothor.methodatlas.SarifEmitterTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.SarifEmitterTest]/[method:flush_securitySeverityPresentWithoutAi_whenRuleIsSecurityTest()] removed conditional - replaced equality check with true → KILLED

2.2
Location : resolveRuleId
Killed by : none removed conditional - replaced equality check with false → SURVIVED Covering tests

3.3
Location : resolveRuleId
Killed by : org.egothor.methodatlas.SarifEmitterTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.SarifEmitterTest]/[method:flush_nullTagsInSuggestion_resolveRuleIdReturnsSecurityTest()] removed conditional - replaced equality check with true → KILLED

4.4
Location : resolveRuleId
Killed by : org.egothor.methodatlas.SarifEmitterTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.SarifEmitterTest]/[method:flush_securityAuthRuleHasTags()] removed conditional - replaced equality check with false → KILLED

1.1
Location : buildRule
Killed by : none removed conditional - replaced equality check with false → SURVIVED Covering tests

2.2
Location : buildRule
Killed by : org.egothor.methodatlas.SarifEmitterTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.SarifEmitterTest]/[method:flush_testMethodRuleHasTestTag()] removed conditional - replaced equality check with true → KILLED

2.2
Location : toRuleTags
Killed by : none removed conditional - replaced equality check with false → SURVIVED Covering tests

1.1
Location : toRuleTags
Killed by : none replaced return value with Collections.emptyList for org/egothor/methodatlas/emit/SarifEmitter::toRuleTags → SURVIVED Covering tests

1.1
Location : toRuleTags
Killed by : none removed conditional - replaced equality check with false → SURVIVED Covering tests

2.2
Location : toRuleTags
Killed by : org.egothor.methodatlas.SarifEmitterTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.SarifEmitterTest]/[method:flush_securityAuthRuleHasTags()] removed conditional - replaced equality check with true → KILLED

1.1
Location : toRuleTags
Killed by : none removed conditional - replaced equality check with true → SURVIVED Covering tests

2.2
Location : toRuleTags
Killed by : org.egothor.methodatlas.SarifEmitterTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.SarifEmitterTest]/[method:flush_securityAuthRuleHasTags()] removed conditional - replaced equality check with false → KILLED

1.1
Location : toRuleName
Killed by : none removed conditional - replaced equality check with true → SURVIVED Covering tests

2.2
Location : toRuleName
Killed by : org.egothor.methodatlas.SarifEmitterTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.SarifEmitterTest]/[method:flush_placeboResult_ruleIsRegistered()] removed conditional - replaced equality check with false → KILLED

1.1
Location : toRuleName
Killed by : none removed conditional - replaced comparison check with true → SURVIVED Covering tests

2.2
Location : toRuleName
Killed by : org.egothor.methodatlas.SarifEmitterTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.SarifEmitterTest]/[method:flush_placeboResult_ruleIsRegistered()] removed conditional - replaced comparison check with false → KILLED

3.3
Location : toRuleName
Killed by : none changed conditional boundary → SURVIVED Covering tests

1.1
Location : toRuleDescription
Killed by : none Changed switch default to be first case → SURVIVED Covering tests

2.2
Location : toRuleDescription
Killed by : none replaced return value with "" for org/egothor/methodatlas/emit/SarifEmitter::toRuleDescription → SURVIVED Covering tests

1.1
Location : toRuleDescription
Killed by : none removed conditional - replaced equality check with false → SURVIVED Covering tests

2.2
Location : toRuleDescription
Killed by : none removed conditional - replaced equality check with true → SURVIVED Covering tests

4.4
Location : resolveMessageText
Killed by : none removed conditional - replaced equality check with false → SURVIVED Covering tests

1.1
Location : resolveMessageText
Killed by : none removed conditional - replaced equality check with true → SURVIVED Covering tests

2.2
Location : resolveMessageText
Killed by : org.egothor.methodatlas.SarifEmitterTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.SarifEmitterTest]/[method:flush_securityMethodMessage_scoresOmitted_whenScoresInMessageFalse()] removed conditional - replaced equality check with false → KILLED

3.3
Location : resolveMessageText
Killed by : org.egothor.methodatlas.SarifEmitterTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.SarifEmitterTest]/[method:flush_securityMethodMessage_noDisplayName_usesGenericLine()] removed conditional - replaced equality check with true → KILLED

4.4
Location : resolveMessageText
Killed by : org.egothor.methodatlas.SarifEmitterTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.SarifEmitterTest]/[method:flush_securityMethodMessage_scoresOmitted_whenScoresInMessageFalse()] removed conditional - replaced equality check with false → KILLED

4.4
Location : resolveMessageText
Killed by : none removed conditional - replaced equality check with true → SURVIVED Covering tests

1.1
Location : resolveMessageText
Killed by : none removed conditional - replaced equality check with false → SURVIVED Covering tests

2.2
Location : resolveMessageText
Killed by : none removed conditional - replaced equality check with true → SURVIVED Covering tests