Static analysis findings

Name: Static analysis findings
Creator: TestPattern Community
License: https://opensource.org/licenses/MIT

Identifies static application security testing (SAST) findings and exports - Semgrep, CodeQL, Checkmarx, Fortify, Veracode, SonarQube, Coverity, Bandit - with source file/line locations, rule or CWE IDs and severities.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: report/tool wording is discovery-only; enforcement requires file/line, rule/CWE or severity structure, and 85 adds a second structure and a weakness class.
Detection quality: Topic false positive
Jurisdictions: global
Regulations: Criminal Code Act 1995 (Cth)
Frameworks: ISO 27001, NIST CSF, CIS Controls
Data categories: security, technology
Scope: wide
Risk rating: 7
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:static\s+(?:application\s+security\s+testing|analysis|code\s+analysis|scan)\s+(?:findings?|report|results|issues)|SAST\s+(?:findings?|report|results|scan)|(?:Checkmarx|Fortify|Veracode|Semgrep|CodeQL|SonarQube|Coverity|Bandit|Snyk\s+Code)\s+(?:findings?|report|results|scan|alerts?|issues))\b

Corroborative evidence keywords

SQL injection, cross-site scripting, path traversal, tainted, data flow

Proximity: 300 characters

Should match

Semgrep findings - claims-portal (commit 4f2a9c1) src/main/java/au/gov/claims/SearchDao.java:118 Rule: java.lang.security.audit.sqli.jdbc-sqli CWE-89 Severity: high Tainted request parameter 'surname' reaches Statement.executeQuery (SQL injection). web/static/js/profile.js:42 Rule: javascript.browser.security.insecure-innerhtml Severity: medium — High tier (85) - file/line locations, rule and CWE IDs and severities with a weakness class
SAST report for the rates app: src/billing/InvoiceService.cs line 204 flagged by the scanner. — Medium tier (75) - file/line location only
CodeQL alerts on the grants portal: query ID: js/reflected-xss raised against the search page. — Medium tier (75) - rule/query ID only
The static analysis findings will be reviewed at Thursday's security stand-up. — Discovery tier (65) - report wording only

Should not match

unrelated generic text without domain phrases — No relevant topic phrases present
The code quality meeting ran over time. — Generic code quality wording is no longer a primary
Secure coding guidance note: organisations should triage SAST findings by severity before release. — Guidance text
SAST findings template File: ______ Line: ____ Rule: ______ Severity: ______ — Blank template
Training course slide: CodeQL alerts for a demo app show CWE-79 in src/app.js:12. — Training/demo framing must not enforce

Known false positives

SAST vendor documentation, rule catalogues and secure coding training quote rule IDs, CWE numbers and sample file paths. Mitigation: Tool wording is discovery-only; enforcement needs finding structure, and guidance/training/demo/template framing is excluded.