[bharathvemula]

Fixes #1575

Issue

SARIF ruleId was the bare CWE class, so distinct findings sharing one CWE collapsed into a single rule — in the issue's measurement, 65 findings became 13 rules. Consumers keying on (ruleId, location) could not tell distinct bugs apart.

Behaviour change

_rule_id() now returns class-qualified ids, e.g. CWE-639/insecure-direct-object-reference instead of bare CWE-639. The qualifier comes only from the closed curated class-keyword catalogue, never from the raw LLM title. Findings with no curated keyword keep the bare CWE id. Tags keep the bare CWE-NNN tag and helpUri keeps pointing at the CWE definition page; fingerprints keep keying on the bare CWE, so refining a rule id does not churn existing alerts or break dismissal carryover.

Reproduction (before / after)

Reproduced before editing: 2 distinct CWE-639 classes produced 1 rule. After the fix: the same 2 classes produce 2 rules.

Test evidence

• pytest tests/test_sarif.py tests/test_sarif_stride.py — 39 passed, including 4 new regression tests (same-CWE-distinct-classes now yield distinct rules).
• ruff check and ruff format --check on both changed files — clean.
• mypy strix/report/sarif.py — "Success: no issues found".

Note on base

This branch is based on the fork's main rather than upstream main: the token used here has no workflow scope, and the single intervening upstream commit touches .github/workflows/ci-package.yml, which blocks pushing a branch based on upstream main. The diff here contains only the fix (2 files).

---

AI assistance disclosure: this change was implemented with AI assistance; the fix was reproduced before editing, and the new regression tests plus the existing SARIF suites were run against the change. DCO sign-off on the commit.

[greptile-apps]

Confidence Score: 4/5

[Medium impact] The change affects how SARIF consumers group findings into rules.

Fix rule identity across equivalent title rewordings before merging.

Findings

1.  Reworded findings become new alerts ▶

Fix with agent prompt

### Issue 1
strix/report/sarif.py:885-888
The existing title-rewording test uses `SQL Injection in get_user` and `SQLi via string-formatted query in get_user` for the same bug. These now produce `CWE-89/sql-injection` and `CWE-89`. If a consumer keys alerts on (`ruleId`, location), as described in this PR, it will treat the second scan as a different alert and lose dismissal carryover. Unchanged `partialFingerprints` cannot preserve that identity.

Use a stable class value, map equivalent class names to it, and test that these rewordings keep the same rule identity.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

The PR adds class suffixes to CWE rule IDs.

• SARIF findings with a CWE get class-specific rule IDs when their titles match known vulnerability classes.

_{Reviews (1) · Last reviewed commit: "fix(sarif): qualify CWE rule ids with th..." · Reviewed by Greptile}

[greptile-apps]

Reworded findings become new alerts

The existing title-rewording test uses SQL Injection in get_user and SQLi via string-formatted query in get_user for the same bug. These now produce CWE-89/sql-injection and CWE-89. If a consumer keys alerts on (ruleId, location), as described in this PR, it will treat the second scan as a different alert and lose dismissal carryover. Unchanged partialFingerprints cannot preserve that identity.

Use a stable class value, map equivalent class names to it, and test that these rewordings keep the same rule identity.

Prompt To Fix With AI

This is a comment left during a code review.
Path: strix/report/sarif.py
Line: 885-888

Comment:
**Reworded findings become new alerts**

The existing title-rewording test uses `SQL Injection in get_user` and `SQLi via string-formatted query in get_user` for the same bug. These now produce `CWE-89/sql-injection` and `CWE-89`. If a consumer keys alerts on (`ruleId`, location), as described in this PR, it will treat the second scan as a different alert and lose dismissal carryover. Unchanged `partialFingerprints` cannot preserve that identity.

Use a stable class value, map equivalent class names to it, and test that these rewordings keep the same rule identity.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.