diff --git a/sarif/include/gap/sarif/sarif.hpp b/sarif/include/gap/sarif/sarif.hpp index 46bbb67..49aa3b9 100644 --- a/sarif/include/gap/sarif/sarif.hpp +++ b/sarif/include/gap/sarif/sarif.hpp @@ -13,10 +13,10 @@ // #include -#include #include #include #include +#include #include @@ -41,7 +41,7 @@ namespace gap::sarif // // A set of distinct strings that provide additional information. // - std::forward_list< std::string > tags = {}; + std::vector< std::string > tags = {}; json additional_properties; }; @@ -61,12 +61,12 @@ namespace gap::sarif // // The set of runs contained in this log file. // - std::forward_list< run > runs; + std::vector< run > runs; // // References to external property files that share data between runs. // - std::forward_list< external_properties > inlineExternalProperties = {}; + std::vector< external_properties > inlineExternalProperties = {}; // // Key/value pairs that provide additional information about the log file. @@ -157,7 +157,7 @@ namespace gap::sarif // // An array of strings to substitute into the message string. // - std::forward_list< std::string > arguments = {}; + std::vector< std::string > arguments = {}; // // Key/value pairs that provide additional information about the message. @@ -336,7 +336,7 @@ namespace gap::sarif // // The role or roles played by the artifact in the analysis. // - std::forward_list< ::gap::sarif::roles > roles = {}; + std::vector< ::gap::sarif::roles > roles = {}; // // The MIME type (RFC 2045) of the artifact. @@ -390,7 +390,7 @@ namespace gap::sarif // // An array of replacement objects, each of which represents the replacement of a single region in a single artifact specified by 'artifactLocation'. // - std::forward_list< replacement > replacements; + std::vector< replacement > replacements; // // Key/value pairs that provide additional information about the change. @@ -420,12 +420,12 @@ namespace gap::sarif // // An array of regions of interest within the attachment. // - std::forward_list< region > regions = {}; + std::vector< region > regions = {}; // // An array of rectangles specifying areas of interest within the image. // - std::forward_list< rectangle > rectangles = {}; + std::vector< rectangle > rectangles = {}; // // Key/value pairs that provide additional information about the attachment. @@ -449,7 +449,7 @@ namespace gap::sarif // // An array of one or more unique threadFlow objects, each of which describes the progress of a program through a thread of execution. // - std::forward_list< thread_flow > threadFlows; + std::vector< thread_flow > threadFlows; // // Key/value pairs that provide additional information about the code flow. @@ -590,7 +590,112 @@ namespace gap::sarif void to_json(json &, const configuration_override &); void from_json(const json &, configuration_override &); - struct reporting_descriptor; + + // + // Information about the relation of one reporting descriptor to another. + // + struct reporting_descriptor_relationship { + // + // A reference to the related reporting descriptor. + // + reporting_descriptor_reference target; + + // + // A set of distinct strings that categorize the relationship. Well-known kinds include 'canPrecede', 'canFollow', 'willPrecede', 'willFollow', 'superset', 'subset', 'equal', 'disjoint', 'relevant', and 'incomparable'. + // + std::vector< std::string > kinds = { "relevant" }; + + // + // A description of the reporting descriptor relationship. + // + std::optional< message > description = std::nullopt; + + // + // Key/value pairs that provide additional information about the reporting descriptor reference. + // + std::optional< property_bag > properties = std::nullopt; + }; + + void to_json(json &, const reporting_descriptor_relationship &); + void from_json(const json &, reporting_descriptor_relationship &); + + // + // Metadata that describes a specific report produced by the tool, as part of the analysis it provides or its runtime reporting. + // + struct reporting_descriptor { + // + // A stable, opaque identifier for the report. + // + std::string id; + + // + // An array of stable, opaque identifiers by which this report was known in some previous version of the analysis tool. + // + std::vector< std::string > deprecatedIds = {}; + + // + // A unique identifer for the reporting descriptor in the form of a GUID. + // + std::optional< std::string > guid = std::nullopt; + + // + // An array of unique identifies in the form of a GUID by which this report was known in some previous version of the analysis tool. + // + std::vector< std::string > deprecatedGuids = {}; + + // + // A report identifier that is understandable to an end user. + // + std::optional< std::string > name = std::nullopt; + + // + // An array of readable identifiers by which this report was known in some previous version of the analysis tool. + // + std::vector< std::string > deprecatedNames = {}; + + // + // A concise description of the report. Should be a single sentence that is understandable when visible space is limited to a single line of text. + // + std::optional< multiformat_message_string > shortDescription = std::nullopt; + + // + // A description of the report. Should, as far as possible, provide details sufficient to enable resolution of any problem indicated by the result. + // + std::optional< multiformat_message_string > fullDescription = std::nullopt; + + // + // A set of name/value pairs with arbitrary names. Each value is a multiformatMessageString object, which holds message strings in plain text and (optionally) Markdown format. The strings can include placeholders, which can be used to construct a message in combination with an arbitrary number of additional string arguments. + // + std::optional< std::unordered_map< std::string, multiformat_message_string > > messageStrings = std::nullopt; + + // + // Default reporting configuration information. + // + std::optional< reporting_configuration > defaultConfiguration = std::nullopt; + + // + // A URI where the primary documentation for the report can be found. + // + std::optional< std::string > helpUri = std::nullopt; + + // + // Provides the primary documentation for the report, useful when there is no online documentation. + // + std::optional< multiformat_message_string > help = std::nullopt; + + // + // An array of objects that describe relationships between this reporting descriptor and others. + // + std::vector< reporting_descriptor_relationship > relationships = {}; + + // + // Key/value pairs that provide additional information about the report. + // + std::optional< property_bag > properties = std::nullopt; + }; + + void to_json(json &, const reporting_descriptor &); + void from_json(const json &, reporting_descriptor &); enum class contents { kLocalizedData, @@ -727,22 +832,22 @@ namespace gap::sarif // // An array of reportingDescriptor objects relevant to the notifications related to the configuration and runtime execution of the tool component. // - std::forward_list< reporting_descriptor > notifications = {}; + std::vector< reporting_descriptor > notifications = {}; // // An array of reportingDescriptor objects relevant to the analysis performed by the tool component. // - std::forward_list< reporting_descriptor > rules = {}; + std::vector< reporting_descriptor > rules = {}; // // An array of reportingDescriptor objects relevant to the definitions of both standalone and tool-defined taxonomies. // - std::forward_list< reporting_descriptor > taxa = {}; + std::vector< reporting_descriptor > taxa = {}; // // An array of the artifactLocation objects associated with the tool component. // - std::forward_list< artifact_location > locations = {}; + std::vector< artifact_location > locations = {}; // // The language of the messages emitted into the log file during this run (expressed as an ISO 639-1 two-letter lowercase language code) and an optional region (expressed as an ISO 3166-1 two-letter uppercase subculture code associated with a country or region). The casing is recommended but not required (in order for this data to conform to RFC5646). @@ -752,7 +857,7 @@ namespace gap::sarif // // The kinds of data contained in this object. // - std::forward_list< ::gap::sarif::contents > contents = { ::gap::sarif::contents::kLocalizedData, ::gap::sarif::contents::kNonLocalizedData }; + std::vector< ::gap::sarif::contents > contents = { ::gap::sarif::contents::kLocalizedData, ::gap::sarif::contents::kNonLocalizedData }; // // Specifies whether this object contains a complete definition of the localizable and/or non-localizable data for this component, as opposed to including only data that is relevant to the results persisted to this log file. @@ -782,7 +887,7 @@ namespace gap::sarif // // An array of toolComponentReference objects to declare the taxonomies supported by the tool component. // - std::forward_list< tool_component_reference > supportedTaxonomies = {}; + std::vector< tool_component_reference > supportedTaxonomies = {}; // // Key/value pairs that provide additional information about the tool component. @@ -805,7 +910,7 @@ namespace gap::sarif // // Tool extensions that contributed to or reconfigured the analysis tool that was run. // - std::forward_list< tool_component > extensions = {}; + std::vector< tool_component > extensions = {}; // // Key/value pairs that provide additional information about the tool. @@ -815,240 +920,254 @@ namespace gap::sarif void to_json(json &, const tool &); void from_json(const json &, tool &); - struct notification; // - // The runtime environment of the analysis tool run. + // A region within an artifact where a result was detected. // - struct invocation { + struct region { // - // The command line used to invoke the tool. + // The line number of the first character in the region. // - std::optional< std::string > commandLine = std::nullopt; + std::optional< int64_t > startLine = std::nullopt; // - // An array of strings, containing in order the command line arguments passed to the tool from the operating system. + // The column number of the first character in the region. // - std::forward_list< std::string > arguments = {}; + std::optional< int64_t > startColumn = std::nullopt; // - // The locations of any response files specified on the tool's command line. + // The line number of the last character in the region. // - std::forward_list< artifact_location > responseFiles = {}; + std::optional< int64_t > endLine = std::nullopt; // - // The Coordinated Universal Time (UTC) date and time at which the run started. See "Date/time properties" in the SARIF spec for the required format. + // The column number of the character following the end of the region. // - std::optional< std::string > startTimeUtc = std::nullopt; + std::optional< int64_t > endColumn = std::nullopt; // - // The Coordinated Universal Time (UTC) date and time at which the run ended. See "Date/time properties" in the SARIF spec for the required format. + // The zero-based offset from the beginning of the artifact of the first character in the region. // - std::optional< std::string > endTimeUtc = std::nullopt; + int64_t charOffset = -1; // - // The process exit code. + // The length of the region in characters. // - std::optional< int64_t > exitCode = std::nullopt; + std::optional< int64_t > charLength = std::nullopt; // - // An array of configurationOverride objects that describe rules related runtime overrides. + // The zero-based offset from the beginning of the artifact of the first byte in the region. // - std::forward_list< configuration_override > ruleConfigurationOverrides = {}; + int64_t byteOffset = -1; // - // An array of configurationOverride objects that describe notifications related runtime overrides. + // The length of the region in bytes. // - std::forward_list< configuration_override > notificationConfigurationOverrides = {}; + std::optional< int64_t > byteLength = std::nullopt; // - // A list of runtime conditions detected by the tool during the analysis. + // The portion of the artifact contents within the specified region. // - std::forward_list< notification > toolExecutionNotifications = {}; + std::optional< artifact_content > snippet = std::nullopt; // - // A list of conditions detected by the tool that are relevant to the tool's configuration. + // A message relevant to the region. // - std::forward_list< notification > toolConfigurationNotifications = {}; + std::optional< ::gap::sarif::message > message = std::nullopt; // - // The reason for the process exit. + // Specifies the source language, if any, of the portion of the artifact specified by the region object. // - std::optional< std::string > exitCodeDescription = std::nullopt; + std::optional< std::string > sourceLanguage = std::nullopt; // - // The name of the signal that caused the process to exit. + // Key/value pairs that provide additional information about the region. // - std::optional< std::string > exitSignalName = std::nullopt; + std::optional< property_bag > properties = std::nullopt; + }; + void to_json(json &, const region &); + void from_json(const json &, region &); + + // + // A physical location relevant to a result. Specifies a reference to a programming artifact together with a range of bytes or characters within that artifact. + // + struct physical_location { // - // The numeric value of the signal that caused the process to exit. + // The address of the location. // - std::optional< int64_t > exitSignalNumber = std::nullopt; + std::optional< ::gap::sarif::address > address = std::nullopt; // - // The reason given by the operating system that the process failed to start. + // The location of the artifact. // - std::optional< std::string > processStartFailureMessage = std::nullopt; + std::optional< artifact_location > artifactLocation = std::nullopt; // - // Specifies whether the tool's execution completed successfully. + // Specifies a portion of the artifact. // - bool executionSuccessful; + std::optional< ::gap::sarif::region > region = std::nullopt; // - // The machine that hosted the analysis tool run. + // Specifies a portion of the artifact that encloses the region. Allows a viewer to display additional context around the region. // - std::optional< std::string > machine = std::nullopt; + std::optional< ::gap::sarif::region > contextRegion = std::nullopt; // - // The account that ran the analysis tool. + // Key/value pairs that provide additional information about the physical location. // - std::optional< std::string > account = std::nullopt; + std::optional< property_bag > properties = std::nullopt; + }; + void to_json(json &, const physical_location &); + void from_json(const json &, physical_location &); + + // + // Information about the relation of one location to another. + // + struct location_relationship { // - // The process id for the analysis tool run. + // A reference to the related location. // - std::optional< int64_t > processId = std::nullopt; + int64_t target; // - // An absolute URI specifying the location of the analysis tool's executable. + // A set of distinct strings that categorize the relationship. Well-known kinds include 'includes', 'isIncludedBy' and 'relevant'. // - std::optional< artifact_location > executableLocation = std::nullopt; + std::vector< std::string > kinds = { "relevant" }; // - // The working directory for the analysis tool run. + // A description of the location relationship. // - std::optional< artifact_location > workingDirectory = std::nullopt; + std::optional< message > description = std::nullopt; // - // The environment variables associated with the analysis tool process, expressed as key/value pairs. + // Key/value pairs that provide additional information about the location relationship. // - std::optional< std::unordered_map< std::string, std::string > > environmentVariables = std::nullopt; + std::optional< property_bag > properties = std::nullopt; + }; + + void to_json(json &, const location_relationship &); + void from_json(const json &, location_relationship &); + // + // A logical location of a construct that produced a result. + // + struct logical_location { // - // A file containing the standard input stream to the process that was invoked. + // Identifies the construct in which the result occurred. For example, this property might contain the name of a class or a method. // - std::optional< artifact_location > stdin = std::nullopt; + std::optional< std::string > name = std::nullopt; // - // A file containing the standard output stream from the process that was invoked. + // The index within the logical locations array. // - std::optional< artifact_location > stdout = std::nullopt; + int64_t index = -1; // - // A file containing the standard error stream from the process that was invoked. + // The human-readable fully qualified name of the logical location. // - std::optional< artifact_location > stderr = std::nullopt; + std::optional< std::string > fullyQualifiedName = std::nullopt; // - // A file containing the interleaved standard output and standard error stream from the process that was invoked. + // The machine-readable name for the logical location, such as a mangled function name provided by a C++ compiler that encodes calling convention, return type and other details along with the function name. // - std::optional< artifact_location > stdoutStderr = std::nullopt; + std::optional< std::string > decoratedName = std::nullopt; // - // Key/value pairs that provide additional information about the invocation. + // Identifies the index of the immediate parent of the construct in which the result was detected. For example, this property might point to a logical location that represents the namespace that holds a type. + // + int64_t parentIndex = -1; + + // + // The type of construct this logical location component refers to. Should be one of 'function', 'member', 'module', 'namespace', 'parameter', 'resource', 'returnType', 'type', 'variable', 'object', 'array', 'property', 'value', 'element', 'text', 'attribute', 'comment', 'declaration', 'dtd' or 'processingInstruction', if any of those accurately describe the construct. + // + std::optional< std::string > kind = std::nullopt; + + // + // Key/value pairs that provide additional information about the logical location. // std::optional< property_bag > properties = std::nullopt; }; - void to_json(json &, const invocation &); - void from_json(const json &, invocation &); + void to_json(json &, const logical_location &); + void from_json(const json &, logical_location &); // - // Describes how a converter transformed the output of a static analysis tool from the analysis tool's native output format into the SARIF format. + // A location within a programming artifact. // - struct conversion { + struct location { // - // A tool object that describes the converter. + // Value that distinguishes this location from all other locations within a single result object. // - ::gap::sarif::tool tool; + int64_t id = -1; // - // An invocation object that describes the invocation of the converter. + // Identifies the artifact and region. // - std::optional< ::gap::sarif::invocation > invocation = std::nullopt; + std::optional< physical_location > physicalLocation = std::nullopt; // - // The locations of the analysis tool's per-run log files. + // The logical locations associated with the result. // - std::forward_list< artifact_location > analysisToolLogFiles = {}; + std::vector< logical_location > logicalLocations = {}; // - // Key/value pairs that provide additional information about the conversion. + // A message relevant to the location. // - std::optional< property_bag > properties = std::nullopt; - }; - - void to_json(json &, const conversion &); - void from_json(const json &, conversion &); - - // - // Represents a directed edge in a graph. - // - struct edge { - // - // A string that uniquely identifies the edge within its graph. - // - std::string id; - - // - // A short description of the edge. - // - std::optional< message > label = std::nullopt; + std::optional< ::gap::sarif::message > message = std::nullopt; // - // Identifies the source node (the node at which the edge starts). + // A set of regions relevant to the location. // - std::string sourceNodeId; + std::vector< region > annotations = {}; // - // Identifies the target node (the node at which the edge ends). + // An array of objects that describe relationships between this location and others. // - std::string targetNodeId; + std::vector< location_relationship > relationships = {}; // - // Key/value pairs that provide additional information about the edge. + // Key/value pairs that provide additional information about the location. // std::optional< property_bag > properties = std::nullopt; }; - void to_json(json &, const edge &); - void from_json(const json &, edge &); + void to_json(json &, const location &); + void from_json(const json &, location &); // - // Represents the traversal of a single edge during a graph traversal. + // A function call within a stack trace. // - struct edge_traversal { + struct stack_frame { // - // Identifies the edge being traversed. + // The location to which this stack frame refers. // - std::string edgeId; + std::optional< ::gap::sarif::location > location = std::nullopt; // - // A message to display to the user as the edge is traversed. + // The name of the module that contains the code of this stack frame. // - std::optional< ::gap::sarif::message > message = std::nullopt; + std::optional< std::string > module = std::nullopt; // - // The values of relevant expressions after the edge has been traversed. + // The thread identifier of the stack frame. // - std::optional< std::unordered_map< std::string, multiformat_message_string > > finalState = std::nullopt; + std::optional< int64_t > threadId = std::nullopt; // - // The number of edge traversals necessary to return from a nested graph. + // The parameters of the call that is executing. // - std::optional< int64_t > stepOverEdgeCount = std::nullopt; + std::vector< std::string > parameters = {}; // - // Key/value pairs that provide additional information about the edge traversal. + // Key/value pairs that provide additional information about the stack frame. // std::optional< property_bag > properties = std::nullopt; }; - void to_json(json &, const edge_traversal &); - void from_json(const json &, edge_traversal &); - struct stack_frame; + void to_json(json &, const stack_frame &); + void from_json(const json &, stack_frame &); // // A call stack that is relevant to a result. @@ -1062,7 +1181,7 @@ namespace gap::sarif // // An array of stack frames that represents a sequence of calls, rendered in reverse chronological order, that comprise the call stack. // - std::forward_list< stack_frame > frames; + std::vector< stack_frame > frames; // // Key/value pairs that provide additional information about the stack. @@ -1072,7 +1191,6 @@ namespace gap::sarif void to_json(json &, const stack &); void from_json(const json &, stack &); - struct exception; // // Describes a runtime exception encountered during the execution of an analysis tool. @@ -1096,7 +1214,7 @@ namespace gap::sarif // // An array of exception objects each of which is considered a cause of this exception. // - std::forward_list< exception > innerExceptions = {}; + std::vector< exception > innerExceptions = {}; // // Key/value pairs that provide additional information about the exception. @@ -1106,557 +1224,627 @@ namespace gap::sarif void to_json(json &, const exception &); void from_json(const json &, exception &); - struct graph; - struct logical_location; - struct thread_flow_location; - struct result; - struct web_request; - struct web_response; // - // The top-level element of an external property file. + // Describes a condition relevant to the tool itself, as opposed to being relevant to a target being analyzed by the tool. // - struct external_properties { + struct notification { // - // The URI of the JSON schema corresponding to the version of the external property file format. + // The locations relevant to this notification. // - std::optional< std::string > schema = std::nullopt; + std::vector< location > locations = {}; // - // The SARIF format version of this external properties object. + // A message that describes the condition that was encountered. // - std::optional< ::gap::sarif::version > version = std::nullopt; + ::gap::sarif::message message; // - // A stable, unique identifer for this external properties object, in the form of a GUID. + // A value specifying the severity level of the notification. // - std::optional< std::string > guid = std::nullopt; + ::gap::sarif::level level = ::gap::sarif::level::kWarning; // - // A stable, unique identifer for the run associated with this external properties object, in the form of a GUID. + // The thread identifier of the code that generated the notification. // - std::optional< std::string > runGuid = std::nullopt; + std::optional< int64_t > threadId = std::nullopt; // - // A conversion object that will be merged with a separate run. + // The Coordinated Universal Time (UTC) date and time at which the analysis tool generated the notification. // - std::optional< ::gap::sarif::conversion > conversion = std::nullopt; + std::optional< std::string > timeUtc = std::nullopt; // - // An array of graph objects that will be merged with a separate run. + // The runtime exception, if any, relevant to this notification. // - std::forward_list< graph > graphs = {}; + std::optional< ::gap::sarif::exception > exception = std::nullopt; // - // Key/value pairs that provide additional information that will be merged with a separate run. + // A reference used to locate the descriptor relevant to this notification. // - std::optional< property_bag > externalizedProperties = std::nullopt; + std::optional< reporting_descriptor_reference > descriptor = std::nullopt; // - // An array of artifact objects that will be merged with a separate run. + // A reference used to locate the rule descriptor associated with this notification. // - std::forward_list< artifact > artifacts = {}; + std::optional< reporting_descriptor_reference > associatedRule = std::nullopt; // - // Describes the invocation of the analysis tool that will be merged with a separate run. + // Key/value pairs that provide additional information about the notification. // - std::forward_list< invocation > invocations = {}; + std::optional< property_bag > properties = std::nullopt; + }; + void to_json(json &, const notification &); + void from_json(const json &, notification &); + + // + // The runtime environment of the analysis tool run. + // + struct invocation { // - // An array of logical locations such as namespaces, types or functions that will be merged with a separate run. + // The command line used to invoke the tool. // - std::forward_list< logical_location > logicalLocations = {}; + std::optional< std::string > commandLine = std::nullopt; // - // An array of threadFlowLocation objects that will be merged with a separate run. + // An array of strings, containing in order the command line arguments passed to the tool from the operating system. // - std::forward_list< thread_flow_location > threadFlowLocations = {}; + std::vector< std::string > arguments = {}; // - // An array of result objects that will be merged with a separate run. + // The locations of any response files specified on the tool's command line. // - std::forward_list< result > results = {}; + std::vector< artifact_location > responseFiles = {}; // - // Tool taxonomies that will be merged with a separate run. + // The Coordinated Universal Time (UTC) date and time at which the run started. See "Date/time properties" in the SARIF spec for the required format. // - std::forward_list< tool_component > taxonomies = {}; + std::optional< std::string > startTimeUtc = std::nullopt; // - // The analysis tool object that will be merged with a separate run. + // The Coordinated Universal Time (UTC) date and time at which the run ended. See "Date/time properties" in the SARIF spec for the required format. // - std::optional< tool_component > driver = std::nullopt; + std::optional< std::string > endTimeUtc = std::nullopt; // - // Tool extensions that will be merged with a separate run. + // The process exit code. // - std::forward_list< tool_component > extensions = {}; + std::optional< int64_t > exitCode = std::nullopt; // - // Tool policies that will be merged with a separate run. + // An array of configurationOverride objects that describe rules related runtime overrides. // - std::forward_list< tool_component > policies = {}; + std::vector< configuration_override > ruleConfigurationOverrides = {}; // - // Tool translations that will be merged with a separate run. + // An array of configurationOverride objects that describe notifications related runtime overrides. // - std::forward_list< tool_component > translations = {}; + std::vector< configuration_override > notificationConfigurationOverrides = {}; // - // Addresses that will be merged with a separate run. + // A list of runtime conditions detected by the tool during the analysis. // - std::forward_list< address > addresses = {}; + std::vector< notification > toolExecutionNotifications = {}; // - // Requests that will be merged with a separate run. + // A list of conditions detected by the tool that are relevant to the tool's configuration. // - std::forward_list< web_request > webRequests = {}; + std::vector< notification > toolConfigurationNotifications = {}; // - // Responses that will be merged with a separate run. + // The reason for the process exit. // - std::forward_list< web_response > webResponses = {}; + std::optional< std::string > exitCodeDescription = std::nullopt; // - // Key/value pairs that provide additional information about the external properties. + // The name of the signal that caused the process to exit. // - std::optional< property_bag > properties = std::nullopt; - }; + std::optional< std::string > exitSignalName = std::nullopt; - void to_json(json &, const external_properties &); - void from_json(const json &, external_properties &); + // + // The numeric value of the signal that caused the process to exit. + // + std::optional< int64_t > exitSignalNumber = std::nullopt; - // - // Contains information that enables a SARIF consumer to locate the external property file that contains the value of an externalized property associated with the run. - // - struct external_property_file_reference { // - // The location of the external property file. + // The reason given by the operating system that the process failed to start. // - std::optional< artifact_location > location = std::nullopt; + std::optional< std::string > processStartFailureMessage = std::nullopt; // - // A stable, unique identifer for the external property file in the form of a GUID. + // Specifies whether the tool's execution completed successfully. // - std::optional< std::string > guid = std::nullopt; + bool executionSuccessful; // - // A non-negative integer specifying the number of items contained in the external property file. + // The machine that hosted the analysis tool run. // - int64_t itemCount = -1; + std::optional< std::string > machine = std::nullopt; // - // Key/value pairs that provide additional information about the external property file. + // The account that ran the analysis tool. // - std::optional< property_bag > properties = std::nullopt; - }; + std::optional< std::string > account = std::nullopt; - void to_json(json &, const external_property_file_reference &); - void from_json(const json &, external_property_file_reference &); + // + // The process id for the analysis tool run. + // + std::optional< int64_t > processId = std::nullopt; - // - // References to external property files that should be inlined with the content of a root log file. - // - struct external_property_file_references { // - // An external property file containing a run.conversion object to be merged with the root log file. + // An absolute URI specifying the location of the analysis tool's executable. // - std::optional< external_property_file_reference > conversion = std::nullopt; + std::optional< artifact_location > executableLocation = std::nullopt; // - // An array of external property files containing a run.graphs object to be merged with the root log file. + // The working directory for the analysis tool run. // - std::forward_list< external_property_file_reference > graphs = {}; + std::optional< artifact_location > workingDirectory = std::nullopt; // - // An external property file containing a run.properties object to be merged with the root log file. + // The environment variables associated with the analysis tool process, expressed as key/value pairs. // - std::optional< external_property_file_reference > externalizedProperties = std::nullopt; + std::optional< std::unordered_map< std::string, std::string > > environmentVariables = std::nullopt; // - // An array of external property files containing run.artifacts arrays to be merged with the root log file. + // A file containing the standard input stream to the process that was invoked. // - std::forward_list< external_property_file_reference > artifacts = {}; + std::optional< artifact_location > stdin = std::nullopt; // - // An array of external property files containing run.invocations arrays to be merged with the root log file. + // A file containing the standard output stream from the process that was invoked. // - std::forward_list< external_property_file_reference > invocations = {}; + std::optional< artifact_location > stdout = std::nullopt; // - // An array of external property files containing run.logicalLocations arrays to be merged with the root log file. + // A file containing the standard error stream from the process that was invoked. // - std::forward_list< external_property_file_reference > logicalLocations = {}; + std::optional< artifact_location > stderr = std::nullopt; // - // An array of external property files containing run.threadFlowLocations arrays to be merged with the root log file. + // A file containing the interleaved standard output and standard error stream from the process that was invoked. // - std::forward_list< external_property_file_reference > threadFlowLocations = {}; + std::optional< artifact_location > stdoutStderr = std::nullopt; // - // An array of external property files containing run.results arrays to be merged with the root log file. + // Key/value pairs that provide additional information about the invocation. // - std::forward_list< external_property_file_reference > results = {}; + std::optional< property_bag > properties = std::nullopt; + }; + + void to_json(json &, const invocation &); + void from_json(const json &, invocation &); + // + // Describes how a converter transformed the output of a static analysis tool from the analysis tool's native output format into the SARIF format. + // + struct conversion { // - // An array of external property files containing run.taxonomies arrays to be merged with the root log file. + // A tool object that describes the converter. // - std::forward_list< external_property_file_reference > taxonomies = {}; + ::gap::sarif::tool tool; // - // An array of external property files containing run.addresses arrays to be merged with the root log file. + // An invocation object that describes the invocation of the converter. // - std::forward_list< external_property_file_reference > addresses = {}; + std::optional< ::gap::sarif::invocation > invocation = std::nullopt; // - // An external property file containing a run.driver object to be merged with the root log file. + // The locations of the analysis tool's per-run log files. // - std::optional< external_property_file_reference > driver = std::nullopt; + std::vector< artifact_location > analysisToolLogFiles = {}; // - // An array of external property files containing run.extensions arrays to be merged with the root log file. + // Key/value pairs that provide additional information about the conversion. // - std::forward_list< external_property_file_reference > extensions = {}; + std::optional< property_bag > properties = std::nullopt; + }; + void to_json(json &, const conversion &); + void from_json(const json &, conversion &); + + // + // Represents a directed edge in a graph. + // + struct edge { // - // An array of external property files containing run.policies arrays to be merged with the root log file. + // A string that uniquely identifies the edge within its graph. // - std::forward_list< external_property_file_reference > policies = {}; + std::string id; // - // An array of external property files containing run.translations arrays to be merged with the root log file. + // A short description of the edge. // - std::forward_list< external_property_file_reference > translations = {}; + std::optional< message > label = std::nullopt; // - // An array of external property files containing run.requests arrays to be merged with the root log file. + // Identifies the source node (the node at which the edge starts). // - std::forward_list< external_property_file_reference > webRequests = {}; + std::string sourceNodeId; // - // An array of external property files containing run.responses arrays to be merged with the root log file. + // Identifies the target node (the node at which the edge ends). // - std::forward_list< external_property_file_reference > webResponses = {}; + std::string targetNodeId; // - // Key/value pairs that provide additional information about the external property files. + // Key/value pairs that provide additional information about the edge. // std::optional< property_bag > properties = std::nullopt; }; - void to_json(json &, const external_property_file_references &); - void from_json(const json &, external_property_file_references &); + void to_json(json &, const edge &); + void from_json(const json &, edge &); // - // A proposed fix for the problem represented by a result object. A fix specifies a set of artifacts to modify. For each artifact, it specifies a set of bytes to remove, and provides a set of new bytes to replace them. + // Represents the traversal of a single edge during a graph traversal. // - struct fix { + struct edge_traversal { // - // A message that describes the proposed fix, enabling viewers to present the proposed change to an end user. + // Identifies the edge being traversed. // - std::optional< message > description = std::nullopt; + std::string edgeId; // - // One or more artifact changes that comprise a fix for a result. + // A message to display to the user as the edge is traversed. // - std::forward_list< artifact_change > artifactChanges; + std::optional< ::gap::sarif::message > message = std::nullopt; // - // Key/value pairs that provide additional information about the fix. + // The values of relevant expressions after the edge has been traversed. + // + std::optional< std::unordered_map< std::string, multiformat_message_string > > finalState = std::nullopt; + + // + // The number of edge traversals necessary to return from a nested graph. + // + std::optional< int64_t > stepOverEdgeCount = std::nullopt; + + // + // Key/value pairs that provide additional information about the edge traversal. // std::optional< property_bag > properties = std::nullopt; }; - void to_json(json &, const fix &); - void from_json(const json &, fix &); - struct node; + void to_json(json &, const edge_traversal &); + void from_json(const json &, edge_traversal &); + + struct graph; + struct logical_location; + struct thread_flow_location; + struct result; + struct web_request; + struct web_response; // - // A network of nodes and directed edges that describes some aspect of the structure of the code (for example, a call graph). + // The top-level element of an external property file. // - struct graph { + struct external_properties { // - // A description of the graph. + // The URI of the JSON schema corresponding to the version of the external property file format. // - std::optional< message > description = std::nullopt; + std::optional< std::string > schema = std::nullopt; // - // An array of node objects representing the nodes of the graph. + // The SARIF format version of this external properties object. // - std::forward_list< node > nodes = {}; + std::optional< ::gap::sarif::version > version = std::nullopt; // - // An array of edge objects representing the edges of the graph. + // A stable, unique identifer for this external properties object, in the form of a GUID. // - std::forward_list< edge > edges = {}; + std::optional< std::string > guid = std::nullopt; // - // Key/value pairs that provide additional information about the graph. + // A stable, unique identifer for the run associated with this external properties object, in the form of a GUID. // - std::optional< property_bag > properties = std::nullopt; - }; + std::optional< std::string > runGuid = std::nullopt; - void to_json(json &, const graph &); - void from_json(const json &, graph &); + // + // A conversion object that will be merged with a separate run. + // + std::optional< ::gap::sarif::conversion > conversion = std::nullopt; - // - // Represents a path through a graph. - // - struct graph_traversal { // - // The index within the run.graphs to be associated with the result. + // An array of graph objects that will be merged with a separate run. // - int64_t runGraphIndex = -1; + std::vector< graph > graphs = {}; // - // The index within the result.graphs to be associated with the result. + // Key/value pairs that provide additional information that will be merged with a separate run. // - int64_t resultGraphIndex = -1; + std::optional< property_bag > externalizedProperties = std::nullopt; // - // A description of this graph traversal. + // An array of artifact objects that will be merged with a separate run. // - std::optional< message > description = std::nullopt; + std::vector< artifact > artifacts = {}; // - // Values of relevant expressions at the start of the graph traversal that may change during graph traversal. + // Describes the invocation of the analysis tool that will be merged with a separate run. // - std::optional< std::unordered_map< std::string, multiformat_message_string > > initialState = std::nullopt; + std::vector< invocation > invocations = {}; // - // Values of relevant expressions at the start of the graph traversal that remain constant for the graph traversal. + // An array of logical locations such as namespaces, types or functions that will be merged with a separate run. // - std::optional< std::unordered_map< std::string, multiformat_message_string > > immutableState = std::nullopt; + std::vector< logical_location > logicalLocations = {}; // - // The sequences of edges traversed by this graph traversal. + // An array of threadFlowLocation objects that will be merged with a separate run. // - std::forward_list< edge_traversal > edgeTraversals = {}; + std::vector< thread_flow_location > threadFlowLocations = {}; // - // Key/value pairs that provide additional information about the graph traversal. + // An array of result objects that will be merged with a separate run. // - std::optional< property_bag > properties = std::nullopt; - }; + std::vector< result > results = {}; - void to_json(json &, const graph_traversal &); - void from_json(const json &, graph_traversal &); + // + // Tool taxonomies that will be merged with a separate run. + // + std::vector< tool_component > taxonomies = {}; - // - // A region within an artifact where a result was detected. - // - struct region { // - // The line number of the first character in the region. + // The analysis tool object that will be merged with a separate run. // - std::optional< int64_t > startLine = std::nullopt; + std::optional< tool_component > driver = std::nullopt; // - // The column number of the first character in the region. + // Tool extensions that will be merged with a separate run. // - std::optional< int64_t > startColumn = std::nullopt; + std::vector< tool_component > extensions = {}; // - // The line number of the last character in the region. + // Tool policies that will be merged with a separate run. // - std::optional< int64_t > endLine = std::nullopt; + std::vector< tool_component > policies = {}; // - // The column number of the character following the end of the region. + // Tool translations that will be merged with a separate run. // - std::optional< int64_t > endColumn = std::nullopt; + std::vector< tool_component > translations = {}; // - // The zero-based offset from the beginning of the artifact of the first character in the region. + // Addresses that will be merged with a separate run. // - int64_t charOffset = -1; + std::vector< address > addresses = {}; // - // The length of the region in characters. + // Requests that will be merged with a separate run. // - std::optional< int64_t > charLength = std::nullopt; + std::vector< web_request > webRequests = {}; // - // The zero-based offset from the beginning of the artifact of the first byte in the region. + // Responses that will be merged with a separate run. // - int64_t byteOffset = -1; + std::vector< web_response > webResponses = {}; // - // The length of the region in bytes. + // Key/value pairs that provide additional information about the external properties. // - std::optional< int64_t > byteLength = std::nullopt; + std::optional< property_bag > properties = std::nullopt; + }; + void to_json(json &, const external_properties &); + void from_json(const json &, external_properties &); + + // + // Contains information that enables a SARIF consumer to locate the external property file that contains the value of an externalized property associated with the run. + // + struct external_property_file_reference { // - // The portion of the artifact contents within the specified region. + // The location of the external property file. // - std::optional< artifact_content > snippet = std::nullopt; + std::optional< artifact_location > location = std::nullopt; // - // A message relevant to the region. + // A stable, unique identifer for the external property file in the form of a GUID. // - std::optional< ::gap::sarif::message > message = std::nullopt; + std::optional< std::string > guid = std::nullopt; // - // Specifies the source language, if any, of the portion of the artifact specified by the region object. + // A non-negative integer specifying the number of items contained in the external property file. // - std::optional< std::string > sourceLanguage = std::nullopt; + int64_t itemCount = -1; // - // Key/value pairs that provide additional information about the region. + // Key/value pairs that provide additional information about the external property file. // std::optional< property_bag > properties = std::nullopt; }; - void to_json(json &, const region &); - void from_json(const json &, region &); + void to_json(json &, const external_property_file_reference &); + void from_json(const json &, external_property_file_reference &); // - // A physical location relevant to a result. Specifies a reference to a programming artifact together with a range of bytes or characters within that artifact. + // References to external property files that should be inlined with the content of a root log file. // - struct physical_location { + struct external_property_file_references { // - // The address of the location. + // An external property file containing a run.conversion object to be merged with the root log file. // - std::optional< ::gap::sarif::address > address = std::nullopt; + std::optional< external_property_file_reference > conversion = std::nullopt; // - // The location of the artifact. + // An array of external property files containing a run.graphs object to be merged with the root log file. // - std::optional< artifact_location > artifactLocation = std::nullopt; + std::vector< external_property_file_reference > graphs = {}; // - // Specifies a portion of the artifact. + // An external property file containing a run.properties object to be merged with the root log file. // - std::optional< ::gap::sarif::region > region = std::nullopt; + std::optional< external_property_file_reference > externalizedProperties = std::nullopt; // - // Specifies a portion of the artifact that encloses the region. Allows a viewer to display additional context around the region. + // An array of external property files containing run.artifacts arrays to be merged with the root log file. // - std::optional< ::gap::sarif::region > contextRegion = std::nullopt; + std::vector< external_property_file_reference > artifacts = {}; // - // Key/value pairs that provide additional information about the physical location. + // An array of external property files containing run.invocations arrays to be merged with the root log file. // - std::optional< property_bag > properties = std::nullopt; - }; + std::vector< external_property_file_reference > invocations = {}; - void to_json(json &, const physical_location &); - void from_json(const json &, physical_location &); - struct location_relationship; + // + // An array of external property files containing run.logicalLocations arrays to be merged with the root log file. + // + std::vector< external_property_file_reference > logicalLocations = {}; - // - // A location within a programming artifact. - // - struct location { // - // Value that distinguishes this location from all other locations within a single result object. + // An array of external property files containing run.threadFlowLocations arrays to be merged with the root log file. // - int64_t id = -1; + std::vector< external_property_file_reference > threadFlowLocations = {}; // - // Identifies the artifact and region. + // An array of external property files containing run.results arrays to be merged with the root log file. // - std::optional< physical_location > physicalLocation = std::nullopt; + std::vector< external_property_file_reference > results = {}; // - // The logical locations associated with the result. + // An array of external property files containing run.taxonomies arrays to be merged with the root log file. // - std::forward_list< logical_location > logicalLocations = {}; + std::vector< external_property_file_reference > taxonomies = {}; // - // A message relevant to the location. + // An array of external property files containing run.addresses arrays to be merged with the root log file. // - std::optional< ::gap::sarif::message > message = std::nullopt; + std::vector< external_property_file_reference > addresses = {}; + + // + // An external property file containing a run.driver object to be merged with the root log file. + // + std::optional< external_property_file_reference > driver = std::nullopt; + + // + // An array of external property files containing run.extensions arrays to be merged with the root log file. + // + std::vector< external_property_file_reference > extensions = {}; + + // + // An array of external property files containing run.policies arrays to be merged with the root log file. + // + std::vector< external_property_file_reference > policies = {}; + + // + // An array of external property files containing run.translations arrays to be merged with the root log file. + // + std::vector< external_property_file_reference > translations = {}; + + // + // An array of external property files containing run.requests arrays to be merged with the root log file. + // + std::vector< external_property_file_reference > webRequests = {}; + + // + // An array of external property files containing run.responses arrays to be merged with the root log file. + // + std::vector< external_property_file_reference > webResponses = {}; + + // + // Key/value pairs that provide additional information about the external property files. + // + std::optional< property_bag > properties = std::nullopt; + }; + void to_json(json &, const external_property_file_references &); + void from_json(const json &, external_property_file_references &); + + // + // A proposed fix for the problem represented by a result object. A fix specifies a set of artifacts to modify. For each artifact, it specifies a set of bytes to remove, and provides a set of new bytes to replace them. + // + struct fix { // - // A set of regions relevant to the location. + // A message that describes the proposed fix, enabling viewers to present the proposed change to an end user. // - std::forward_list< region > annotations = {}; + std::optional< message > description = std::nullopt; // - // An array of objects that describe relationships between this location and others. + // One or more artifact changes that comprise a fix for a result. // - std::forward_list< location_relationship > relationships = {}; + std::vector< artifact_change > artifactChanges; // - // Key/value pairs that provide additional information about the location. + // Key/value pairs that provide additional information about the fix. // std::optional< property_bag > properties = std::nullopt; }; - void to_json(json &, const location &); - void from_json(const json &, location &); + void to_json(json &, const fix &); + void from_json(const json &, fix &); + struct node; // - // Information about the relation of one location to another. + // A network of nodes and directed edges that describes some aspect of the structure of the code (for example, a call graph). // - struct location_relationship { + struct graph { // - // A reference to the related location. + // A description of the graph. // - int64_t target; + std::optional< message > description = std::nullopt; // - // A set of distinct strings that categorize the relationship. Well-known kinds include 'includes', 'isIncludedBy' and 'relevant'. + // An array of node objects representing the nodes of the graph. // - std::forward_list< std::string > kinds = { "relevant" }; + std::vector< node > nodes = {}; // - // A description of the location relationship. + // An array of edge objects representing the edges of the graph. // - std::optional< message > description = std::nullopt; + std::vector< edge > edges = {}; // - // Key/value pairs that provide additional information about the location relationship. + // Key/value pairs that provide additional information about the graph. // std::optional< property_bag > properties = std::nullopt; }; - void to_json(json &, const location_relationship &); - void from_json(const json &, location_relationship &); + void to_json(json &, const graph &); + void from_json(const json &, graph &); // - // A logical location of a construct that produced a result. + // Represents a path through a graph. // - struct logical_location { + struct graph_traversal { // - // Identifies the construct in which the result occurred. For example, this property might contain the name of a class or a method. + // The index within the run.graphs to be associated with the result. // - std::optional< std::string > name = std::nullopt; + int64_t runGraphIndex = -1; // - // The index within the logical locations array. + // The index within the result.graphs to be associated with the result. // - int64_t index = -1; + int64_t resultGraphIndex = -1; // - // The human-readable fully qualified name of the logical location. + // A description of this graph traversal. // - std::optional< std::string > fullyQualifiedName = std::nullopt; + std::optional< message > description = std::nullopt; // - // The machine-readable name for the logical location, such as a mangled function name provided by a C++ compiler that encodes calling convention, return type and other details along with the function name. + // Values of relevant expressions at the start of the graph traversal that may change during graph traversal. // - std::optional< std::string > decoratedName = std::nullopt; + std::optional< std::unordered_map< std::string, multiformat_message_string > > initialState = std::nullopt; // - // Identifies the index of the immediate parent of the construct in which the result was detected. For example, this property might point to a logical location that represents the namespace that holds a type. + // Values of relevant expressions at the start of the graph traversal that remain constant for the graph traversal. // - int64_t parentIndex = -1; + std::optional< std::unordered_map< std::string, multiformat_message_string > > immutableState = std::nullopt; // - // The type of construct this logical location component refers to. Should be one of 'function', 'member', 'module', 'namespace', 'parameter', 'resource', 'returnType', 'type', 'variable', 'object', 'array', 'property', 'value', 'element', 'text', 'attribute', 'comment', 'declaration', 'dtd' or 'processingInstruction', if any of those accurately describe the construct. + // The sequences of edges traversed by this graph traversal. // - std::optional< std::string > kind = std::nullopt; + std::vector< edge_traversal > edgeTraversals = {}; // - // Key/value pairs that provide additional information about the logical location. + // Key/value pairs that provide additional information about the graph traversal. // std::optional< property_bag > properties = std::nullopt; }; - void to_json(json &, const logical_location &); - void from_json(const json &, logical_location &); + void to_json(json &, const graph_traversal &); + void from_json(const json &, graph_traversal &); // // Represents a node in a graph. @@ -1680,7 +1868,7 @@ namespace gap::sarif // // Array of child nodes. // - std::forward_list< node > children = {}; + std::vector< node > children = {}; // // Key/value pairs that provide additional information about the node. @@ -1691,59 +1879,6 @@ namespace gap::sarif void to_json(json &, const node &); void from_json(const json &, node &); - // - // Describes a condition relevant to the tool itself, as opposed to being relevant to a target being analyzed by the tool. - // - struct notification { - // - // The locations relevant to this notification. - // - std::forward_list< location > locations = {}; - - // - // A message that describes the condition that was encountered. - // - ::gap::sarif::message message; - - // - // A value specifying the severity level of the notification. - // - ::gap::sarif::level level = ::gap::sarif::level::kWarning; - - // - // The thread identifier of the code that generated the notification. - // - std::optional< int64_t > threadId = std::nullopt; - - // - // The Coordinated Universal Time (UTC) date and time at which the analysis tool generated the notification. - // - std::optional< std::string > timeUtc = std::nullopt; - - // - // The runtime exception, if any, relevant to this notification. - // - std::optional< ::gap::sarif::exception > exception = std::nullopt; - - // - // A reference used to locate the descriptor relevant to this notification. - // - std::optional< reporting_descriptor_reference > descriptor = std::nullopt; - - // - // A reference used to locate the rule descriptor associated with this notification. - // - std::optional< reporting_descriptor_reference > associatedRule = std::nullopt; - - // - // Key/value pairs that provide additional information about the notification. - // - std::optional< property_bag > properties = std::nullopt; - }; - - void to_json(json &, const notification &); - void from_json(const json &, notification &); - // // An area within an image. // @@ -1804,113 +1939,6 @@ namespace gap::sarif void to_json(json &, const replacement &); void from_json(const json &, replacement &); - struct reporting_descriptor_relationship; - - // - // Metadata that describes a specific report produced by the tool, as part of the analysis it provides or its runtime reporting. - // - struct reporting_descriptor { - // - // A stable, opaque identifier for the report. - // - std::string id; - - // - // An array of stable, opaque identifiers by which this report was known in some previous version of the analysis tool. - // - std::forward_list< std::string > deprecatedIds = {}; - - // - // A unique identifer for the reporting descriptor in the form of a GUID. - // - std::optional< std::string > guid = std::nullopt; - - // - // An array of unique identifies in the form of a GUID by which this report was known in some previous version of the analysis tool. - // - std::forward_list< std::string > deprecatedGuids = {}; - - // - // A report identifier that is understandable to an end user. - // - std::optional< std::string > name = std::nullopt; - - // - // An array of readable identifiers by which this report was known in some previous version of the analysis tool. - // - std::forward_list< std::string > deprecatedNames = {}; - - // - // A concise description of the report. Should be a single sentence that is understandable when visible space is limited to a single line of text. - // - std::optional< multiformat_message_string > shortDescription = std::nullopt; - - // - // A description of the report. Should, as far as possible, provide details sufficient to enable resolution of any problem indicated by the result. - // - std::optional< multiformat_message_string > fullDescription = std::nullopt; - - // - // A set of name/value pairs with arbitrary names. Each value is a multiformatMessageString object, which holds message strings in plain text and (optionally) Markdown format. The strings can include placeholders, which can be used to construct a message in combination with an arbitrary number of additional string arguments. - // - std::optional< std::unordered_map< std::string, multiformat_message_string > > messageStrings = std::nullopt; - - // - // Default reporting configuration information. - // - std::optional< reporting_configuration > defaultConfiguration = std::nullopt; - - // - // A URI where the primary documentation for the report can be found. - // - std::optional< std::string > helpUri = std::nullopt; - - // - // Provides the primary documentation for the report, useful when there is no online documentation. - // - std::optional< multiformat_message_string > help = std::nullopt; - - // - // An array of objects that describe relationships between this reporting descriptor and others. - // - std::forward_list< reporting_descriptor_relationship > relationships = {}; - - // - // Key/value pairs that provide additional information about the report. - // - std::optional< property_bag > properties = std::nullopt; - }; - - void to_json(json &, const reporting_descriptor &); - void from_json(const json &, reporting_descriptor &); - - // - // Information about the relation of one reporting descriptor to another. - // - struct reporting_descriptor_relationship { - // - // A reference to the related reporting descriptor. - // - reporting_descriptor_reference target; - - // - // A set of distinct strings that categorize the relationship. Well-known kinds include 'canPrecede', 'canFollow', 'willPrecede', 'willFollow', 'superset', 'subset', 'equal', 'disjoint', 'relevant', and 'incomparable'. - // - std::forward_list< std::string > kinds = { "relevant" }; - - // - // A description of the reporting descriptor relationship. - // - std::optional< message > description = std::nullopt; - - // - // Key/value pairs that provide additional information about the reporting descriptor reference. - // - std::optional< property_bag > properties = std::nullopt; - }; - - void to_json(json &, const reporting_descriptor_relationship &); - void from_json(const json &, reporting_descriptor_relationship &); enum class kind { kNotApplicable, @@ -1977,7 +2005,7 @@ namespace gap::sarif // // An array of physicalLocation objects which specify the portions of an analysis tool's output that a converter transformed into the result. // - std::forward_list< physical_location > conversionSources = {}; + std::vector< physical_location > conversionSources = {}; // // Key/value pairs that provide additional information about the result. @@ -2136,7 +2164,7 @@ namespace gap::sarif // // The set of locations where the result was detected. Specify only one location unless the problem indicated by the result can only be corrected by making a change at every specified location. // - std::forward_list< location > locations = {}; + std::vector< location > locations = {}; // // A stable, unique identifer for the result in the form of a GUID. @@ -2166,32 +2194,32 @@ namespace gap::sarif // // An array of 'stack' objects relevant to the result. // - std::forward_list< stack > stacks = {}; + std::vector< stack > stacks = {}; // // An array of 'codeFlow' objects relevant to the result. // - std::forward_list< code_flow > codeFlows = {}; + std::vector< code_flow > codeFlows = {}; // // An array of zero or more unique graph objects associated with the result. // - std::forward_list< graph > graphs = {}; + std::vector< graph > graphs = {}; // // An array of one or more unique 'graphTraversal' objects. // - std::forward_list< graph_traversal > graphTraversals = {}; + std::vector< graph_traversal > graphTraversals = {}; // // A set of locations relevant to this result. // - std::forward_list< location > relatedLocations = {}; + std::vector< location > relatedLocations = {}; // // A set of suppressions relevant to this result. // - std::forward_list< suppression > suppressions = {}; + std::vector< suppression > suppressions = {}; // // The state of a result relative to a baseline of a previous run. @@ -2206,7 +2234,7 @@ namespace gap::sarif // // A set of artifacts relevant to the result. // - std::forward_list< attachment > attachments = {}; + std::vector< attachment > attachments = {}; // // An absolute URI at which the result can be viewed. @@ -2216,7 +2244,7 @@ namespace gap::sarif // // The URIs of the work items associated with this result. // - std::forward_list< std::string > workItemUris = {}; + std::vector< std::string > workItemUris = {}; // // Information about how and when the result was detected. @@ -2226,12 +2254,12 @@ namespace gap::sarif // // An array of 'fix' objects, each of which represents a proposed fix to the problem indicated by the result. // - std::forward_list< fix > fixes = {}; + std::vector< fix > fixes = {}; // // An array of references to taxonomy reporting descriptors that are applicable to the result. // - std::forward_list< reporting_descriptor_reference > taxa = {}; + std::vector< reporting_descriptor_reference > taxa = {}; // // A web request associated with this result. @@ -2326,7 +2354,7 @@ namespace gap::sarif // // Describes the invocation of the analysis tool. // - std::forward_list< invocation > invocations = {}; + std::vector< invocation > invocations = {}; // // A conversion object that describes how a converter transformed an analysis tool's native reporting format into the SARIF format. @@ -2341,7 +2369,7 @@ namespace gap::sarif // // Specifies the revision in version control of the artifacts that were scanned. // - std::forward_list< version_control_details > versionControlProvenance = {}; + std::vector< version_control_details > versionControlProvenance = {}; // // The artifact location specified by each uriBaseId symbol on the machine where the tool originally ran. @@ -2351,22 +2379,22 @@ namespace gap::sarif // // An array of artifact objects relevant to the run. // - std::forward_list< artifact > artifacts = {}; + std::vector< artifact > artifacts = {}; // // An array of logical locations such as namespaces, types or functions. // - std::forward_list< logical_location > logicalLocations = {}; + std::vector< logical_location > logicalLocations = {}; // // An array of zero or more unique graph objects associated with the run. // - std::forward_list< graph > graphs = {}; + std::vector< graph > graphs = {}; // // The set of results contained in an SARIF log. The results array can be omitted when a run is solely exporting rules metadata. It must be present (but may be empty) if a log file represents an actual scan. // - std::forward_list< result > results = {}; + std::vector< result > results = {}; // // Automation details that describe this run. @@ -2376,7 +2404,7 @@ namespace gap::sarif // // Automation details that describe the aggregate of runs to which this run belongs. // - std::forward_list< run_automation_details > runAggregates = {}; + std::vector< run_automation_details > runAggregates = {}; // // The 'guid' property of a previous SARIF 'run' that comprises the baseline that was used to compute result 'baselineState' properties for the run. @@ -2386,7 +2414,7 @@ namespace gap::sarif // // An array of strings used to replace sensitive information in a redaction-aware property. // - std::forward_list< std::string > redactionTokens = {}; + std::vector< std::string > redactionTokens = {}; // // Specifies the default encoding for any artifact object that refers to a text file. @@ -2401,7 +2429,7 @@ namespace gap::sarif // // An ordered list of character sequences that were treated as line breaks when computing region information for the run. // - std::forward_list< std::string > newlineSequences = { "\r\n", "\n" }; + std::vector< std::string > newlineSequences = { "\r\n", "\n" }; // // Specifies the unit in which the tool measures columns. @@ -2416,37 +2444,37 @@ namespace gap::sarif // // An array of threadFlowLocation objects cached at run level. // - std::forward_list< thread_flow_location > threadFlowLocations = {}; + std::vector< thread_flow_location > threadFlowLocations = {}; // // An array of toolComponent objects relevant to a taxonomy in which results are categorized. // - std::forward_list< tool_component > taxonomies = {}; + std::vector< tool_component > taxonomies = {}; // // Addresses associated with this run instance, if any. // - std::forward_list< address > addresses = {}; + std::vector< address > addresses = {}; // // The set of available translations of the localized data provided by the tool. // - std::forward_list< tool_component > translations = {}; + std::vector< tool_component > translations = {}; // // Contains configurations that may potentially override both reportingDescriptor.defaultConfiguration (the tool's default severities) and invocation.configurationOverrides (severities established at run-time from the command line). // - std::forward_list< tool_component > policies = {}; + std::vector< tool_component > policies = {}; // // An array of request objects cached at run level. // - std::forward_list< web_request > webRequests = {}; + std::vector< web_request > webRequests = {}; // // An array of response objects cached at run level. // - std::forward_list< web_response > webResponses = {}; + std::vector< web_response > webResponses = {}; // // A specialLocations object that defines locations of special significance to SARIF consumers. @@ -2462,39 +2490,6 @@ namespace gap::sarif void to_json(json &, const run &); void from_json(const json &, run &); - // - // A function call within a stack trace. - // - struct stack_frame { - // - // The location to which this stack frame refers. - // - std::optional< ::gap::sarif::location > location = std::nullopt; - - // - // The name of the module that contains the code of this stack frame. - // - std::optional< std::string > module = std::nullopt; - - // - // The thread identifier of the stack frame. - // - std::optional< int64_t > threadId = std::nullopt; - - // - // The parameters of the call that is executing. - // - std::forward_list< std::string > parameters = {}; - - // - // Key/value pairs that provide additional information about the stack frame. - // - std::optional< property_bag > properties = std::nullopt; - }; - - void to_json(json &, const stack_frame &); - void from_json(const json &, stack_frame &); - enum class state { kAccepted, kUnderReview, @@ -2572,7 +2567,7 @@ namespace gap::sarif // // A temporally ordered array of 'threadFlowLocation' objects, each of which describes a location visited by the tool while producing the result. // - std::forward_list< thread_flow_location > locations; + std::vector< thread_flow_location > locations; // // Key/value pairs that provide additional information about the thread flow. @@ -2617,12 +2612,12 @@ namespace gap::sarif // // A set of distinct strings that categorize the thread flow location. Well-known kinds include 'acquire', 'release', 'enter', 'exit', 'call', 'return', 'branch', 'implicit', 'false', 'true', 'caution', 'danger', 'unknown', 'unreachable', 'taint', 'function', 'handler', 'lock', 'memory', 'resource', 'scope' and 'value'. // - std::forward_list< std::string > kinds = {}; + std::vector< std::string > kinds = {}; // // An array of references to rule or taxonomy reporting descriptors that are applicable to the thread flow location. // - std::forward_list< reporting_descriptor_reference > taxa = {}; + std::vector< reporting_descriptor_reference > taxa = {}; // // The name of the module that contains the code that is executing. diff --git a/sarif/src/sarif.cpp b/sarif/src/sarif.cpp index fed5e82..b88d183 100644 --- a/sarif/src/sarif.cpp +++ b/sarif/src/sarif.cpp @@ -31,7 +31,7 @@ namespace gap::sarif { continue; } if ( key == "inlineExternalProperties" ) { - std::forward_list< external_properties > field; + std::vector< external_properties > field; val.get_to(field); o.inlineExternalProperties = field; continue; @@ -1025,13 +1025,13 @@ namespace gap::sarif { continue; } if ( key == "arguments" ) { - std::forward_list< std::string > field; + std::vector< std::string > field; val.get_to(field); o.arguments = field; continue; } if ( key == "responseFiles" ) { - std::forward_list< artifact_location > field; + std::vector< artifact_location > field; val.get_to(field); o.responseFiles = field; continue; @@ -1487,7 +1487,7 @@ namespace gap::sarif { continue; } if ( key == "artifacts" ) { - std::forward_list< artifact > field; + std::vector< artifact > field; val.get_to(field); o.artifacts = field; continue; @@ -2461,7 +2461,7 @@ namespace gap::sarif { continue; } if ( key == "deprecatedIds" ) { - std::forward_list< std::string > field; + std::vector< std::string > field; val.get_to(field); o.deprecatedIds = field; continue; @@ -2473,7 +2473,7 @@ namespace gap::sarif { continue; } if ( key == "deprecatedGuids" ) { - std::forward_list< std::string > field; + std::vector< std::string > field; val.get_to(field); o.deprecatedGuids = field; continue; @@ -2485,7 +2485,7 @@ namespace gap::sarif { continue; } if ( key == "deprecatedNames" ) { - std::forward_list< std::string > field; + std::vector< std::string > field; val.get_to(field); o.deprecatedNames = field; continue; @@ -2940,7 +2940,7 @@ namespace gap::sarif { continue; } if ( key == "suppressions" ) { - std::forward_list< suppression > field; + std::vector< suppression > field; val.get_to(field); o.suppressions = field; continue; @@ -2966,7 +2966,7 @@ namespace gap::sarif { continue; } if ( key == "workItemUris" ) { - std::forward_list< std::string > field; + std::vector< std::string > field; val.get_to(field); o.workItemUris = field; continue; @@ -3201,7 +3201,7 @@ namespace gap::sarif { continue; } if ( key == "artifacts" ) { - std::forward_list< artifact > field; + std::vector< artifact > field; val.get_to(field); o.artifacts = field; continue; @@ -3215,7 +3215,7 @@ namespace gap::sarif { continue; } if ( key == "results" ) { - std::forward_list< result > field; + std::vector< result > field; val.get_to(field); o.results = field; continue;