`fcli fod aviator apply-remediations` fails with "Source code file not present..."

[kadraman]

Current Behavior

The command fcli fod aviator apply-remediations "--rel=fortify-presales/IWA-NodeJS:demo/fortify-remediate" "--source-dir=C:\Users\klee2\repos\IWA-NodeJS" fails with:

com.fortify.cli.aviator._common.exception.AviatorTechnicalException: Source code file not present at: C:\Users\klee2\repos\IWA-NodeJS\Src\packages\api\src\remediationDemo\SqlInjectionTarget.ts

This is because when using default scancentral packaging initiated via fortify/github-action the files are packages up in "Src" directory added by scancentral. This is reflected in Aviator's remediation results, e.g. from remediations.xml:

To remediate this vulnerability, use parameterized queries (also known as prepared statements) with Sequelize:

In file Src/packages/api/src/remediationDemo/SqlInjectionTarget.ts, replace lines 12-15 by the following lines:

The Src directory does not exist in the GitHub repo and there is no way of mapping it.

For GitHub/GitLab report publishing, I remember Ruud having to write a custom issue resolver that took care of this: fb89526 I'm not sure if/how we can do something similar here?

Expected Behavior

Aviator remediations are applied to current file-system.

Steps To Reproduce

As above.

Environment

- fortify/github-action@v3
- latest fcli

Anything else?

No response