sarif — archive

[Laurence Golding]

Paul, Thank you again for your careful reading. I ve incorporated all necessary changes into the provisional draft. Here are my responses to your substantive concerns: In 3.4.4, artifactLocation.uriBaseId property, you commented: I seem to remember that if uri is relative and if uriBaseId is not present, then the uri should be resolved with respect to the directory in which the sarif file exists. Is that still the case? Some clarification of this would be useful here, or a reference to somewhere else where clarification is made. That interpretation applies in only one place: in 3.15.2, externalPropertyFileReference.location property, which says: If the externalized properties are persisted in a separate file, location SHALL be present. In that case, if the artifactLocation object s uri property ( 3.4.3 ) specifies a relative reference and its uriBaseId property ( 3.4.4 ) is absent, then uri SHALL be interpreted relative to the location of the root file. That seemed like a reasonable default in this particular case: it wouldn t be surprising if an external property sat alongside its parent log file. In all other cases (for example, when the artifact is a source file, or a configuration file, or a tool binary, etc.), it did not seem to me that there was any reasonable default. In 3.26.5, location.annotations property, you commented (with regard to a sample): Did you mean these columns to refer to a particular range within the example string? Yes, and I got them wrong. I meant them to refer to the subexpression "(y + z)", so I ve corrected them from (13, 19) to (9, 16). In 3.53.3, notification.message property, you commented (with regard to a note saying that notification.message would usually be plain text because it appears on the console): In CodeSonar, only the most basic notifications about command line errors go to the console. Many other notifications show up with formatting in the UI. Also, I ve seen plenty of command line tools that use ansi codes to color the text output to the console. I d just as soon delete this note. You are right. I removed the note. (With regard to ANSI color code on the console, you d have to drop down to HTML to represent that in Markdown, and the spec actually prohibits that see 3.11.4.2, Security implications .) Larry