google-security-research/analysis/kernel/dashboard/Data/codeql/import_sarif_db.py

from sarif_om import SarifLog
from sarif.loader import load_sarif_file
import sqlite3


def create_sarif_database(sarif_file_path, db_name="codeql_data.db"):
    try:
        sarif_log: SarifLog = load_sarif_file(sarif_file_path)
    except Exception as e:
        print(f"Error loading SARIF file: {e}")
        return None

    conn = sqlite3.connect(db_name)
    cursor = conn.cursor()

    # Create tables for runs, results, codeFlows, threadFlows, and locations
    cursor.execute(
        """
      CREATE TABLE IF NOT EXISTS runs (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        tool TEXT NOT NULL,
        version TEXT
      )
    """
    )
    cursor.execute(
        """
      CREATE TABLE IF NOT EXISTS results (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        run_id INTEGER NOT NULL,
        ruleId TEXT NOT NULL,
        message TEXT NOT NULL,
        FOREIGN KEY (run_id) REFERENCES runs (id)
      )
    """
    )
    cursor.execute(
        """
      CREATE TABLE IF NOT EXISTS codeFlows (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        result_id INTEGER NOT NULL,
        FOREIGN KEY (result_id) REFERENCES results (id)
      )
    """
    )
    cursor.execute(
        """
      CREATE TABLE IF NOT EXISTS threadFlows (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        codeFlow_id INTEGER NOT NULL,
        FOREIGN KEY (codeFlow_id) REFERENCES codeFlows (id)
      )
    """
    )
    cursor.execute(
        """
      CREATE TABLE IF NOT EXISTS locations (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        threadFlow_id INTEGER NOT NULL,
        message TEXT NOT NULL,
        uri TEXT,
        startLine INTEGER,
        startColumn INTEGER,
        endLine INTEGER,
        endColumn INTEGER,
        FOREIGN KEY (threadFlow_id) REFERENCES threadFlows (id)
      )
    """
    )
    cursor.execute(
        """
      CREATE TABLE IF NOT EXISTS edges (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        source_location_id INTEGER NOT NULL,
        target_location_id INTEGER NOT NULL,
        rule_id TEXT NOT NULL,
        FOREIGN KEY (source_location_id) REFERENCES locations (id),
        FOREIGN KEY (target_location_id) REFERENCES locations (id)
      )
    """
    )

    for run in sarif_log.runs:
        cursor.execute(
            "INSERT INTO runs (tool, version) VALUES (?, ?)",
            ("dashboard", "1.0"),
        )
        run_id = cursor.lastrowid

        for result in run.get_results():
            cursor.execute(
                "INSERT INTO results (run_id, ruleId, message) VALUES (?, ?, ?)",
                (run_id, result["ruleId"], result["message"]["text"]),
            )
            result_id = cursor.lastrowid

            for code_flow in result.get("codeFlows", []):
                cursor.execute(
                    "INSERT INTO codeFlows (result_id) VALUES (?)", (result_id,)
                )
                code_flow_id = cursor.lastrowid

                for thread_flow in code_flow.get("threadFlows", []):
                    cursor.execute(
                        "INSERT INTO threadFlows (codeFlow_id) VALUES (?)",
                        (code_flow_id,),
                    )
                    thread_flow_id = cursor.lastrowid

                    # Store location data in a list of dictionaries
                    location_ids = []

                    for location in thread_flow.get("locations", []):
                        loc = location.get("location", {})
                        phys_loc = loc.get("physicalLocation", {})
                        art_loc = phys_loc.get("artifactLocation", {})
                        region = phys_loc.get("region", {})
                        cursor.execute(
                            """
                        INSERT INTO locations (
                          threadFlow_id, message, uri, startLine, startColumn, endLine, endColumn
                        ) VALUES (?, ?, ?, ?, ?, ?, ?)
                      """,
                            (
                                thread_flow_id,
                                loc["message"]["text"],
                                art_loc.get("uri", ""),
                                region.get("startLine"),
                                region.get("startColumn"),
                                region.get("endLine"),
                                region.get("endColumn"),
                            ),
                        )
                        location_ids.append(cursor.lastrowid)

                    for i in range(len(location_ids) - 1):
                        cursor.execute(
                            """
                            INSERT INTO edges (source_location_id, target_location_id, rule_id)
                            VALUES (?, ?, ?)
                            """,
                            (
                                location_ids[i],
                                location_ids[i + 1],
                                result["ruleId"],
                            ),
                        )
    conn.commit()
    conn.close()


create_sarif_database("callgraph.sarif")
# create_sarif_database("field-free.sarif")
# create_sarif_database("controlled-field-writes.sarif")