fix: broaden vulnerability scanner parsing

Author: Jennycruzy

README.md

@@ -479,7 +479,7 @@ import SecurityScannerResults from '@/components/security';
 <SecurityScannerResults results={scannerJson} />
 ```
 
-Supported scanner fields include `id`, `ruleId`, `cve`, `title`, `message`, `description`, `severity`, `level`, `package`, `dependency`, `file`, `path`, `line`, `recommendation`, `fix`, and safe `http`/`https` URLs. Arrays, common `{ findings: [...] }` style objects, SARIF `runs[].results`, and npm-audit-style `vulnerabilities` maps are normalized into one warning shape.
+Supported scanner fields include `id`, `ruleId`, `check_id`, `check`, `cve`, `swc-id`, `title`, `check_name`, `message`, `description`, `severity`, `level`, `impact`, `package`, `dependency`, `file`, `path`, `filename`, `line`, `lineno`, `recommendation`, `fix`, and safe `http`/`https` URLs. Arrays, common `{ findings: [...] }` style objects, nested Slither-style `results.detectors`, Semgrep `results`, SARIF `runs[].results` with rule metadata, and npm-audit-style `vulnerabilities` or `advisories` maps are normalized into one warning shape.
 
 Severity is normalized case-insensitively: `critical`, `high`, `medium`, `moderate`, `low`, `info`, `warning`, and `error` are supported. `error` maps to `high`; `warning` and `moderate` map to `medium`; unknown values remain `unknown`.
 

src/components/security/__tests__/vulnerabilityParser.test.ts

@@ -127,6 +127,119 @@ describe('vulnerabilityParser', () => {
     });
   });
 
+  it('uses SARIF rule metadata when individual results omit display fields', () => {
+    const result = parseVulnerabilityResults({
+      runs: [
+        {
+          tool: {
+            driver: {
+              name: 'CodeQL',
+              rules: [
+                {
+                  id: 'solidity/reentrancy',
+                  shortDescription: { text: 'Reentrancy risk' },
+                  fullDescription: { text: 'External calls can re-enter state-changing functions.' },
+                  defaultConfiguration: { level: 'error' },
+                  helpUri: 'https://example.com/rules/solidity-reentrancy',
+                },
+              ],
+            },
+          },
+          results: [
+            {
+              ruleId: 'solidity/reentrancy',
+              locations: [
+                {
+                  physicalLocation: {
+                    artifactLocation: { uri: 'contracts/Vault.sol' },
+                    region: { startLine: 88 },
+                  },
+                },
+              ],
+            },
+          ],
+        },
+      ],
+    });
+
+    expect(result.error).toBeNull();
+    expect(result.findings[0]).toMatchObject({
+      id: 'solidity/reentrancy',
+      severity: 'high',
+      title: 'Reentrancy risk',
+      message: 'External calls can re-enter state-changing functions.',
+      location: 'contracts/Vault.sol:88',
+      source: 'CodeQL',
+      url: 'https://example.com/rules/solidity-reentrancy',
+    });
+  });
+
+  it('parses nested Slither detector output from smart contract scans', () => {
+    const result = parseVulnerabilityResults({
+      success: true,
+      results: {
+        detectors: [
+          {
+            check: 'reentrancy-eth',
+            impact: 'High',
+            confidence: 'Medium',
+            description: 'Potential reentrancy in withdraw().',
+            elements: [
+              {
+                source_mapping: {
+                  filename_relative: 'contracts/Vault.sol',
+                  lines: [42],
+                },
+              },
+            ],
+            recommendation: 'Use checks-effects-interactions or a reentrancy guard.',
+          },
+        ],
+      },
+    });
+
+    expect(result.error).toBeNull();
+    expect(result.findings[0]).toMatchObject({
+      id: 'reentrancy-eth',
+      severity: 'high',
+      title: 'reentrancy-eth',
+      message: 'Potential reentrancy in withdraw().',
+      location: 'contracts/Vault.sol:42',
+      recommendation: 'Use checks-effects-interactions or a reentrancy guard.',
+    });
+  });
+
+  it('parses Semgrep JSON and nested metadata safely', () => {
+    const result = parseVulnerabilityResults({
+      results: [
+        {
+          check_id: 'solidity.lang.security.tx-origin',
+          path: 'contracts/Auth.sol',
+          start: { line: 12 },
+          extra: {
+            message: 'Avoid tx.origin for authorization.',
+            severity: 'ERROR',
+            fix: 'Use msg.sender instead.',
+            metadata: {
+              'source-rule-url': 'https://semgrep.dev/r/solidity.lang.security.tx-origin',
+            },
+          },
+        },
+      ],
+    });
+
+    expect(result.error).toBeNull();
+    expect(result.findings[0]).toMatchObject({
+      id: 'solidity.lang.security.tx-origin',
+      severity: 'high',
+      title: 'solidity.lang.security.tx-origin',
+      message: 'Avoid tx.origin for authorization.',
+      location: 'contracts/Auth.sol:12',
+      recommendation: 'Use msg.sender instead.',
+      url: 'https://semgrep.dev/r/solidity.lang.security.tx-origin',
+    });
+  });
+
   it('summarizes normalized findings', () => {
     const result = parseVulnerabilityResults([
       { id: '1', title: 'A', severity: 'critical' },
@@ -146,4 +259,3 @@ describe('vulnerabilityParser', () => {
     expect(sanitizeDisplayText('<b>Fix</b> PASSWORD=hunter2')).toBe('Fix PASSWORD=[redacted]');
   });
 });
-