github / github/codeql

Code Scanning support for SARIF message string lookup in uploaded logs

Open
#11,512 7 comments 0 reactions 0 assignees View on GitHub
question
Dominant language
CodeQL
Stars
10.1k
Forks
2.1k
Avg merge
2d 15h
Merged PRs (30d)
141

Description

The SARIF format supports the notion of indirect string lookups in its `message` object. Rather than directly providing a string in the `message.text` property, the indirect approach allows a specific set of other objects within the SARIF log to refer to the `message` object using its `id` property.

Currently, the CodeQL web service returns an error response when a log is uploaded which contains any `message` objects that don't provide a value in the `text` property:
`Error: Code Scanning could not process the submitted SARIF file: expected a result message`

The formal description of this feature and the decision tree for resolving the message string can be found here: [https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317468](https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317468)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.