"open" is used by proof-based tools. The tool performs an analysis. Sometimes it can prove there’s a violation (kind = "fail"), sometimes can prove there is no violation (kind = "pass"), and sometimes does not detect a violation,
but it’s unable to prove that there was no violation (kind = "open").
"review" means something like "The tool isn’t sophisticated detect violations of this rule, so please look for yourself.” In the F2F, Michael gave the example of an accessibility checker that would raise issues like “Make sure that
you’re not using color alone to highlight important information.”
Larry
From: Yekaterina O'Neil <>
Sent: Tuesday, February 19, 2019 9:31 AM
To: Larry Golding (Myriad Consulting Inc) <>; OASIS SARIF TC Discussion List <>
Subject: RE: Change draft for #317: result.kind and result.level
I still have a hard time understanding the difference between “open” and “review”
k
From: [mailto:]
On Behalf Of Larry Golding (Myriad Consulting Inc)
Sent: Monday, February 18, 2019 2:55 PM
To: OASIS SARIF TC Discussion List <>
Subject: [sarif] Change draft for #317: result.kind and result.level
I pushed a change draft for Issue #317: “Consider splitting resultlevel into result.level and result.kind”:
Documents/ChangeDrafts/Active/sarif-v2.0-issue-317-result-level-and-kind.docx
We will move its adoption at TC Meeting #32 on Wednesday, February 20th.
Thanks,
Larry
