OASIS Static Analysis Results Interchange Format (SARIF) TC

 View Only

  • 1.  Public repository of SARIF examples

    Posted 03-01-2025 10:17
    I think it would be helpful for interoperability of SARIF producers and
    consumers to have a public, redistributable repository of example sarif
    files.

    I've had a go at creating one here:
    https://github.com/davidmalcolm/sarif-examples

    It has examples of
    * malformed JSON
    * invalid SARIF 2.1
    * valid SARIF 2.1
    * valid SARIF 2.2-experimental (aka prerelease)
    from various producers/organizations, organized in a subdirectory
    structure.

    There are some notes and TODOs in the README.rst there. In particular:

    * what licensing should be allowed? (I'd like to ensure that the entire
    repo is redistributable)

    * it would be good to add examples of valid/invalid sarif to the repo
    whenever we resolve an issue in the spec

    * should we allow some form of inline comments in the .sarif files?
    (which could be stripped out by a preprocessor) Right now I'm putting
    commentary about the examples (re licensing, provenance, intent/aspects
    of interest) in README.rst files in the same directory. But the spec
    has #-to-end-of-line comments in examples, and in GCC's test suite I'm
    using C and C++ style comments (for directives to the test suite).

    I've filed https://github.com/oasis-tcs/sarif-spec/issues/677 to track
    the overall idea; maybe we could discuss it at next week's TC meeting?

    Thoughts?
    Dave


  • 2.  RE: Public repository of SARIF examples

    Posted 03-02-2025 15:45
    As you work on pulling together SARIF examples, be sure to keep in mind Microsoft's OSS library for SARIF, which has lots of things that could be useful to use directly or serve as a starting place.

    In particular, the SARIF v1 (an entirely MS construction) to SARIF v2 conversion tended to isolate individual aspects of SARIF highlighting various features.

    At one point, we were trying to keep examples in sync with the spec, see these files, including an attempt to express nearly everything in the standard. 


    Also: 
    In particular, look here:

    sarif-sdk\src\Test.UnitTests.Sarif\TestData\PrereleaseCompatibilityTransformer\Inputs
    sarif-sdk\src\Test.UnitTests.Sarif\TestData\SarifCurrentToVersionOneVisitor\ExpectedOutputs



    Original Message


Related Content