Hi Larry,
1.
Ok, understood, but it does feel like a re-phrase of some sort would be helpful.
2.
Yeah, we indeed don’t mean the same thing by the term “rule”. Not all of our rules result in a specific finding on their own. In fact, majority of our dataflow rules, for example, are helper rules that
don’t result in any finding on their own – they just help the analyzer do its job. So, the dataflow finding is generated by a set of rules, and only the sink rule corresponds to a “specific criterion of correctness verified by a static analysis tool”.
k
From: Larry Golding (Comcast) [mailto:
larrygolding@comcast.net]
Sent: Thursday, June 07, 2018 11:20 AM
To: 'O'Neil, Yekaterina Tsipenyuk' <
katrina@microfocus.com>;
sarif@lists.oasis-open.org; 'Michael Fanning' <
Michael.Fanning@microsoft.com>
Subject: RE: [sarif] Change bars for Issue #158 (result.correlationId)
Importance: High
Michael – please read this carefully to see if I’ve correctly conveyed your philosophy for analysis tool design.
Hi Katrina,
1. First of all, don’t worry, you can indeed populate
result.fingerprints . “SHOULD NOT” means “don’t do it unless you have a good reason,” and I guess your tool has a good reason