ZupIT
Add "short name" support to tools
What would you like to be added: Currently, when the tools return suggestions, they are frequently "long-form". For example:
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. - Specify at least 1 USER command in Dockerfile with non-root user as argument - Add 'USER ' line to the Dockerfile - [https://docs.docker.com/develop/develop-images/dockerfile_best-practices/ https://avd.aquasec.com/appshield/ds002]
I would like for us to add support for a more brief version of this for categorization.
Why is this needed:
Especially for standard formats like SARIF, there is an expectation of "short" vs "long" in terms of descriptions of issues. It means that we end up with messy-looking aggregates, for example:
Note the top entry, which is succinct and easy to read, as opposed to the others, which are tough to read at a glance.
I would propose we break items -- at least in the SARIF format -- into "short" and "long" descriptions to facilitate this. I know some tools don't report in this way; perhaps we can do something as a best-effort on those by, for example, taking everything up to the first newline as the "short" and the whole body of text as the "long".
This seems interesting, some time ago I was thinking about this. For our regex based rules I think that this would be a simple task (even though we have to many rules). I think that the suggested approach could be good, but I would like to think in other possibilities to try to get a "short" description from these other tools.
cc @iancardosozup @wiliansilvazup @nathanmartinszup @lucasbrunozup
