Feat/9 add report command to scan generate json and html reports

[hasip-timurtas]

This pull request introduces several updates to the Solana Smart Contract Security Toolkit (solsec) to enhance functionality, simplify workflows, and improve user experience. The most significant changes include the removal of the solsec report command, updates to the solsec scan command to support multiple output formats, and corresponding adjustments to the CLI, documentation, and CI workflow.

CLI and Command Enhancements:

• Removed the solsec report command and integrated its functionality directly into the solsec scan command, which now supports generating multiple output formats (e.g., JSON, HTML, Markdown, CSV) simultaneously. Added new flags --json-only and --html-only for convenience. (src/cli.rs: [1] [2] [3] [4]

Documentation Updates:

• Updated the README.md to reflect the removal of the solsec report command and to document the new multi-format capabilities of solsec scan. Added examples for generating JSON and HTML outputs independently or together. (README.md: [1] [2] [3]

CI Workflow Changes:

• Simplified the CI workflow by replacing the solsec report step with the enhanced solsec scan command, which now directly generates all required output formats. (.github/workflows/ci.yml: .github/workflows/ci.ymlL88-R95)

Codebase Refactoring:

• Removed the generate_from_directory method and related logic from the ReportGenerator class, as it is no longer needed with the updated solsec scan command. (src/report.rs: [1] [2]

Version Bumps:

• Incremented the version of the solsec crate and the solsec-ui package to 0.1.6 to reflect these changes. (Cargo.toml: [1] ui/package.json: [2] ui/src/App.tsx: [3]

[github-actions]

🛡️ Security Scan Results

• Total Issues: 68
• Critical: 0
• High: 0

View full report

[github-actions]

🛡️ Security Scan Results

• Total Issues: 68
• Critical: 0
• High: 0

View full report

[github-actions]

🛡️ Security Scan Results

• Total Issues: 68
• Critical: 0
• High: 0

View full report

[cursor]

Bug: Output Filename Overwrite Bug

When multiple output formats are requested and a specific output filename with an extension is provided (e.g., --output report.json), all formats are incorrectly written to the same file. This occurs because the output.clone() logic is applied to every format in the loop when an extension is detected, rather than generating unique filenames for subsequent formats. Consequently, each subsequent report overwrites the previous one, leading to data loss where only the last generated report is preserved. For example, solsec scan --output results.json --format json,html will result in only the HTML report being saved to results.json.

src/cli.rs#L116-L128

solsec/src/cli.rs

Lines 116 to 128 in 9dd3ce1

	let output_file = if output.extension().is_some() {
	// If user provided a specific filename, respect it for the first format
	output.clone()
	} else {
	// Generate appropriate filename based on format
	output.join(format!("security-report.{}", extension))
	};
	report_gen
	.generate_report(&results, &output_file, format.clone())
	.await?;
	}

Fix in Cursor

---

Bug: Conflicting CLI Flags Lead to Unintuitive Behavior

The json_only and html_only CLI flags do not conflict with each other, allowing users to specify both simultaneously. When both are provided, the json_only flag takes precedence, resulting in only JSON output, which is unintuitive. These flags should be mutually exclusive.

src/cli.rs#L41-L47

solsec/src/cli.rs

Lines 41 to 47 in 9dd3ce1

	/// Only generate JSON output (for CI/CD integration)
	#[arg(long, conflicts_with = "format")]
	json_only: bool,
	/// Only generate HTML output (for human review)
	#[arg(long, conflicts_with = "format")]
	html_only: bool,

Fix in Cursor

---

Was this report helpful? Give feedback by reacting with 👍 or 👎

[github-actions]

🛡️ Security Scan Results

• Total Issues: 68
• Critical: 0
• High: 0

View full report