From d1b585e613e222775fd0283ceeaf3cb8d2c3f173 Mon Sep 17 00:00:00 2001 From: Larry Golding Date: Fri, 3 Jul 2020 14:23:15 -0700 Subject: [PATCH] Provide messages for SARIF2004.OptimizeFileSize. --- docs/Producing effective SARIF.md | 10 +++++ docs/Rule factoring.xlsx | Bin 13515 -> 13522 bytes .../Rules/RuleResources.Designer.cs | 8 ++-- src/Sarif.Multitool/Rules/RuleResources.resx | 10 +++-- .../Rules/SARIF2004.OptimizeFileSize.cs | 37 ++++++++++++++++-- .../SARIF2004.OptimizeFileSize_Invalid.sarif | 8 ++-- 6 files changed, 60 insertions(+), 13 deletions(-) diff --git a/docs/Producing effective SARIF.md b/docs/Producing effective SARIF.md index d87cf095a..7cc2662df 100644 --- a/docs/Producing effective SARIF.md +++ b/docs/Producing effective SARIF.md @@ -385,12 +385,22 @@ This run does not provide 'versionControlProvenance'. As a result, it is not pos #### Description +Emit arrays only if they provide additional information. + +In several parts of a SARIF log file, a subset of information about an object appears in one place, and the full information describing all such objects appears in an array elsewhere in the log file. For example, each 'result' object has a 'ruleId' property that identifies the rule that was violated. Elsewhere in the log file, the array 'run.tool.driver.rules' contains additional information about the rules. But if the elements of the 'rules' array contained no information about the rules beyond their ids, then there might be no reason to include the 'rules' array at all, and the log file could be made smaller simply by omitting it. In some scenarios (for example, when assessing compliance with policy), the 'rules' array might be used to record the full set of rules that were evaluated. In such a scenario, the 'rules' array should be retained even if it contains only id information. + +Similarly, most 'result' objects contain at least one 'artifactLocation' object. Elsewhere in the log file, the array 'run.artifacts' contains additional information about the artifacts that were analyzed. But if the elements of the 'artifacts' array contained not information about the artifacts beyond their locations, then there might be no reason to include the 'artifacts' array at all, and again the log file could be made smaller by omitting it. In some scenarios (for example, when assessing compliance with policy), the 'artifacts' array might be used to record the full set of artifacts that were analyzed. In such a scenario, the 'artifacts' array should be retained even if it contains only location information. + #### Messages ##### `EliminateLocationOnlyArtifacts`: warning +{0): The 'artifacts' array contains no information beyond the locations of the artifacts. Removing this array might reduce the log file size without losing information. In some scenarios (for example, when assessing compliance with policy), the 'artifacts' array might be used to record the full set of artifacts that were analyzed. In such a scenario, the 'artifacts' array should be retained even if it contains only location information. + ##### `EliminateIdOnlyRules`: warning +{0}: The 'rules' array contains no information beyond the ids of the rules. Removing this array might reduce the log file size without losing information. In some scenarios (for example, when assessing compliance with policy), the 'rules' array might be used to record the full set of rules that were evaluated. In such a scenario, the 'rules' array should be retained even if it contains only id information. + --- ### Rule `SARIF2005.ProvideToolProperties` diff --git a/docs/Rule factoring.xlsx b/docs/Rule factoring.xlsx index 911cb5d13bc1a3d1fc7e233704f982aa5663180e..29711c7424c716ee0c21a7b07a247575c65d8d90 100644 GIT binary patch delta 4177 zcmV-X5U%gbY0_!1<^}~6Qi+#blj{Z?e{FB0I1v7R()|bI?-ZN204iN2A<O7U7d2>i-?Uq!^1N(&zRFs+pcvUnN(c#IU*+*Ijk>5 z#ruaG{e81^6XYmO`---rXE}Oe3Vk~J^N-VwkgIzkRt^C4Do2gh>&)|1*|3hPe-p80 zJy>cXJE~zRA3U{|j8>{)On0s4V;p-Oa1w~F*X6FyRko3NVu(u>~wi2!w{shC|k8c9gyH|C* zltPJGp8&MCBmFLZf;~dsq+t6#e+S1Qg`Q-O+|=;EO2!{#6(6wT7chc<8;yXptX48e z-Urd512-R?oz}c%w>#-NbiMvUJ5#9^IW1LsQE|>%e$=~S$yL#uB<$Rj*-MjWSpWIRC_(^fOtQ_be0*Pz3FT)(S1i#=}ye<<9!V*d$x)ERKDg}m{$l*00meS@ z%_eByFw4<%T%>-nNK@CxQQ?L-fCNNlmwK-7< z9MfjDNk)#$%sb?HMQjnr$4c6kpl~x;$CO|{H6CoMKPzo#5Eln}B*fDRPD2+j0w_|F z`fd^izB>;Ke-TX<#bOqj`k2!{`#;V=tMP37tQeLJmHI}~as?lwD^|~_0zvHp0=}=w z&Z1<71E3f#$(s_A%q~rX{#m$A)#xDc#Y=X^bW#NrwIs22* z1{Jey3Pb`4FQAVQunGVG*^{~qA%EL$+ei|9Uts@1;L{FvEs0l2hV6kYld%FM8N`|0 zXIiFhA(E)2=s20h{QLBc61%EgY-WMUP^OPhcis9_H^qxzzi&5#Z$))jm%B^PACA32 zv0If7>)q3(_xqRZZ0ZdTb-sJZH|4Il^nMfv@7Jrp|Lx+ntiB$ei=rL~hJW4R(tED! z{rPBgSUnfp{4gx{#ZLU@v8=XvEq<(?Mu&Y>J7H5^X1d7 ztn&Mfu=~3o<*UK>O8ggye}7>!jJl6T+OAhsc_<(2pxWD4e@Q%#XS2!T?0P<*oJEV-^z3>Z z`)Bhs@zc!DvSb?m>0MnstVM*SRfDQ{y!7V&`G<+`jjk?K0{wekynh~Ap9gh*e^+dZ zRb7Zdd~fhaS#IxExs2U3ZvFUCCgeunlsSA~mR}{=QvBIi40}){a@c%TufG+GVk6M+ zgPEv<|EihD&te**<2>4*n>l4F?|-WX55;5tvZ+6pueZhe>A4n@i-uxCDsj#qe%us? zmB?f<_%Mtm@2cDg5`Xdk!FDZ6QeApDB*;>+igVoES zF1Pv#8Jie3acyES9mY{GOQx;aiItKGz<Tm4V{Q(lIj<8LcS9^=%4aGDG1DxzO1uJ~SjJNAtFfbf&8^y2Y^%N2VxbJ z`MuAjrugS_1o1)Sg`S44D}|A@6pCN#UmUCJtGzLcmf1hD^Xy*(?|;jun@`>^gMSX}+sluG-#&kO z_c^`0^M1J)J<7B`P238Nm{pI^NVFZA7=#8R5>PD|;lt1n5Kwa|hQP>Z1REJc!bXOr zv0N#Ysl8CKS)NL??MhI}nL&uuIOfd^mb(Mymd98oi1odP2@-9a0Ma_s2sQ?WgpC19 zV;La#Cx6Z{m`k*609fO$F~SG>upl6yC~gP{%x3}u3MVrVHXj@?w>-vjr_x(@e;Rof z!f?!3A7tz`ftdizg5rT|1ciZ4r7%cSbxXnKXv4!MsR6w~WV;piH2hMbT6{ZCp3ZsGkrR7_lU4%V&J2b(!+%9kc_KR+Vn#hyJzv5_uh}*OBwl7P zycwFOBN`gy6pda|p2~5789rRT4Td+vMMQZbI~x6D)Ys}3s_m`p=--<=f!dX~yHLNE zy3G|FR2}SgC=ApG0)rYJ3WF9it%B{mL*1z1;REKPxIB>^FfrPxeB{}VJRC!38K%2W zeSZm;}*SATGD zvIZrS!k{%-OE|wKV@w1)8fq+%ikZRi@iAlZ@zEfs`1I;T(g1e{5t0^Gu+>rYyM~81 z!(I91X?PFCR&bCVu-_#x6HrkL0)rMIYAmq+rxXSrkr@n|9SslbR-VXOgu;G`t>D0| za4j_$-V7JT=80@GdMS1mY7y1XI)B@3d)Sst(LC~J`w9(?J>e2WV5V?WMPP7}X?1Qd zQwd1clo|^jBpVDL9Wxf6WE$kM1cmJeqRXq9LSK4BaN2^|9UOcnJq2t3wRkFx&P-t& zLSS%kh_RqPP&{K49aeYs%Gwa|(Qy~>ur1(SZcP;$95cf<#9;UwbJ@7_M1S@Q(3ZLG zG z_qQ>uO9JEjuyLb6(Dejn1~4gsL9RC#*7Xe!TbDeMmC;dK)4JViHjk}%#qi<3Vgye- zL2tL9FvzQTtO?*r2_EcKhks3R!^3;En`n8Q5ZvBIebi~L(7=aq ze#V#y+}#pmCFtR?=Hau~Wp`@^bJ6^$k65P)4O9glp%@Hrh0EsFfoN$k?d8vJJuI~g zwU>ZK_(5|59~?Cp_UWh#=(Yo7+tEuxBdk~nJQF1_GgJteCq{*UF@F>E9SUMTaQ|)Q z!>5pog7QSRSKCL{UCa0)(kIr|X#^51j7i`Y-SF_18XkUW)gYIWkNfli3x&2z-iMYF zm;@dW8w_h{!^2wYK(sU%t1CJsq80bJmwYQU*h<3l3IdbBew4sKuij7?SWN^5$+yAq zo;R&R`;6a*k7jS1(SKOf(xB`$`7Q7F67?7hZ32(13Csj}zgyH(g2(rv))^4*S~FOO zYdcVO&h`@R81H(0_zjuNfOty`QHLcRDBBV-;PJSyvw4ms+OEC?oC91FmE1CBY${chmcZZp`v1?OdqZ^ zJiN!ciIxqKdac89V$w$@GliC^DPNzEUkQ2F+|h4T$XmD8Eqk!``EF+&B<5JQy(t;P zrj7u`a3Q2Hu&E<3XctLfP$3u$TL=vgzrr}7mIh_Z(8)O4{e7B%ENS-DaEqGsI+j*w z&{>V)SpWfw;eR(5DGZ7tK9|N(#26e!_Bh#OzTxSJVh73&P_HxPgiyRO{60Scis7L$ zg+ZRhgJI7S2hVW#Z^q*5!%2agS-<6f+q1nCIKisukD*wQAgI9v2<;~c40bJ^5l&hM z4Q|HjNLn+Rn`?W?a6)V;$FRF4LGWQH0m81uqoKoYf`13Q)cpVSrB+I>g$5p;B zd0*DzH9Xbkr)Tj_cp(}z@&2nfcr44h`9TQ0E%Vts)$Ji&q`LHOb!}ZlF$*W61+2}iU`qc2PM_6bqFhN zq<<=@u}8Hf6=k1v3ncKo2`Rx)P7Nh3(5VI@J|a0Akkwul9e^_e1(YC+Ccf*FAFlyb z>OTiMW#lY#(^Ph+W85*DvtAtB2b~Ybx~||)sbK6ziSUb$bxFKww-Ts;9>WT^()n!%;;*}sGM@NkV5YZW9QM6VAnDE zJ!miOcIP&Y%g;L_e=|@4CX>)JQ~@`WB{U-&85f(zX8`~Jh5`Tp5dZ)H00000 b00000008@wV>CVinUkV4BL-M800000p6cCs delta 4169 zcmV-P5Vr5qY0GJ_<^}~FKYspNlj{Z?e^GCnIuw4NbpHeLI|UOUfJ&z(5UtWWRc+V3 zRGM5c#R_1qZJJco{`-ziNZWOqa=RN58~YqSzH`oZ%<;!<+gJ}&NXEMq;UgDWv@3YY zy89G;yaL#HLILnA^W4#D76#R{77VrXfnMi4<8qJX}vSuZEF zwm1Z?C1O4FcEQ^oAnsVh)T04KR$C-z_Z=7Hu7R+(IIy+?t`Pp%g~6NN1g1ByYFQz; z^hwIPOnF|Y=#o)>v@56#2n#Oy^`fS+JW7tbC^N`jWK>>rK(dji$V`v#=TFJ-Pgd_!=By* z?Q3Q!dJ41HgV1B!bA!zG-5ItQfgYB#d>P?5Ud=tj$az7@oSs0cX0GBb#a0X^)yr*k* z6AVO?#5u>n%%1kYZ@)QlR~6;QYf;0Ct8e?~qNoRge_^{n_nzx| zcRCvFm(Rr}-w(@Ou@%30EUQgkiyy0}(SBDI`GfkS&3Y7!$H{1uueP3MIIUbb%E!mm zvbZjnFPmapYm%y1=e3ys{&}_AH*A}w3*9EKzP;>DmgQzADDGG5RsBPedV|gKbn&z; ztNeZ~?EdaY`Eu~R68{C_e_z-Pqwb@THmhY-?#st|D40ij&e;6fXg1212PSO46OA8@ zs^WDe9eAV)er`&BeBcU>WZ_SeB?mIOT-E8z>fzk`UlL!&v)N>Ra&>t*If>@8>B-eN z_D?R;#7{Fn%aUpMr+0Douo51YRt>7+@!Y%gPd`q4Z**~{0_fkXf8uT5`aG!f`@3RY zEbBrH;(LQX%5rnJ%%$(9aqGuVG9cIbri|hHviv5=7UIvwV%WVRk;CT8di7e&i?u-C zMq)ko|5Y=QpT#srhk3L=H*?BV-2YY$9*W2OWnF(M-)@W5({n8*7Y)UPRN$OG{J1Xm zOA*Op@L?EB-etKKeLJ7(KrdjY83s zz00Mh_@{CN@j=9eo`&963M2PYD1NPfaoAn&Z7s2AOeSA^ov_hQ4pUW8|(SFwke z262TEfsL4Be}q4_A=d=Nw;?Gp&di2n7&4vMkQ-_sKyyoA0x;o)#)u7bSeGfF`G9F= zN1H~%dj}WFY}s}po$VTzNVIb4Vdx0B1S7y=&Itq{xyFzfEJBJQQvk^{L~P^3WCJkJ zjbRZ%dtA$@ZP9Hv&4)ll=i|lv^Y5R&F0y}Qr`f*-f8N*6*Pp##2LBw`w-=uVzkT_9 z^Ci8z^L{xSJ<6~?PTX>hm{kwgNVM&m7`O%_60ln^!iTOQAYjj>7y><`5v*qn3F{e_ z##&0LOwLiBO0>O{U@K<^AwuI2H#4~19Wb{%#xgr5k99~ctW2P}=l8T0L+}?fjNT0z(u7nNK&#$y zGqhs+ycrtgWJWJtPkk+N;*4H~p61rLQm$xN$YJMK_5YIt~uxhO7AWIIfZcHBO)wJt2tbD++@Sa$26Pk^-INFeU`MFg0Vf-4gs!Qpya5e>cOW6yS+$Gptge+YDR^gmAM2E=Oypvo%X( zn_-m#-DWhU0L*29rN!Nw1)pX^ST`$5aA1VFjKH8=Mquz}!L>mMYXif>N101)z!TZ- zv1)^E_cXP^vEU40`L8;_=N@l{IYIM#UV~gxa$prAU1oe#aN+qelFXo&^j<1Bf9R}1 z$)qqSCu<4kb27$6u%e;H0(m<#7~Vf-EZ#pFL5bW!V0!(Mc*_$yczDw zFT3GA6kEYTbijI-z)Zl7niCk5gs8DV{!b|kY>^oZ8yyV~yR1Bsm4w26iml*aSz#_U z7~TvQ#pa1@GkPg@7HSclp&S&pe%MgR%W6b5?&J)=gpe=LVf5Abh9PE~d zL>GGupZ`!G*f1wBF^Ud680v=@9)4L}4%`kz3xg3}IzF#?@2Oi`nmd<1!spu=4MKyc{^%nV>s0)v*`VA!Q^c-Vc(6Il_hzLwMUD7u#wKi-Yu!+*sHo_K=VZcbs) zs^YOGfF~t*@Txi-iW?q&e^tAQ7KaJJ<89POoh}s`tRc)C1ZIlX8K07Uw9Xhafvq57 ztOPwg);xUlnz7o=7$5e~Z=2EHL)ih`N3YX}&|=s{F&N$u!_#4i3u0tre}zHWIr+WS?-;gLfY>7HsDb zJb3qM9)4lXSbW}NiR_%#N6W+u5%`OBD5qh}3^vIK9#|oyf7DoLQ?XK}TPzI^zhd1) zi-t(O++i(Z(nlsUg_fZyU!ss-47q9U==Un*ty}AsJy^TT+qn-C)0}O8@ofx?Isz2K zL`Y#^QAc3VS(3n@jbJeBMre3=8FE4`49b?FqjC1~_bCFhq&Z!~gKE;NIjztjFOOkI zfB?nt`->C?e|Zsir?D3?278fhDx1hRJRM%_K-muJ)mcvPN!1_2Z}k(P7`B!v3|d({ z7+zVT{S12mW-NYxI4N*5YbOOxdMU6%!NeD@bq+7SGbli&&IQXai41mtb557I~7gOq2=UIae}5tk^-p?Z7*f7dP4z zf86<_*^-ir555HwQ933CI4-&4qyYwHN5m(j6dkhMo4f@`K_G_$l(Qrpgyh@nz!dh+ zfmZ1`i_F!f?{tdWXG?JuJNLn6ow2H_K{ae+`1~PxTP>g4szIijT?xQxECmw=xYH(G z^1bm(1@xfvX0b8piOnK&Zr#f7e3OB^V5_~~nEGr+SF74&T%x&FcAq;xj~+#q z|7hFs_%cZ3Q?p~ov+_Ee->(-qjc7yzIu63oI-IbZDGR6XO|BpFO^f42aZ2|uaT3ts zI-+beVl?Uz&w#Ye{qyIfUz0E^6|<)uT2GAaRtlgKha0Rxi>GdckelSDH? z0v#!nKq)1YtTQSBACuQJQ~@xPEHon - /// Looks up a localized string similar to Placeholder_SARIF2004_OptimizeFileSize_FullDescription_Text. + /// Looks up a localized string similar to Emit arrays only if they provide additional information. + /// + ///In several parts of a SARIF log file, a subset of information about an object appears in one place, and the full information describing all such objects appears in an array elsewhere in the log file. For example, each 'result' object has a 'ruleId' property that identifies the rule that was violated. Elsewhere in the log file, the array 'run.tool.driver.rules' contains additional information about the rules. But if the elements of the 'rules' array [rest of string was truncated]";. /// internal static string SARIF2004_OptimizeFileSize_FullDescription_Text { get { @@ -452,7 +454,7 @@ internal static string SARIF2004_OptimizeFileSize_FullDescription_Text { } /// - /// Looks up a localized string similar to Placeholder_SARIF2004_OptimizeFileSize_Warning_EliminateIdOnlyRules_Text. + /// Looks up a localized string similar to {0}: The 'rules' array contains no information beyond the ids of the rules. Removing this array might reduce the log file size without losing information. In some scenarios (for example, when assessing compliance with policy), the 'rules' array might be used to record the full set of rules that were evaluated. In such a scenario, the 'rules' array should be retained even if it contains only id information.. /// internal static string SARIF2004_OptimizeFileSize_Warning_EliminateIdOnlyRules_Text { get { @@ -461,7 +463,7 @@ internal static string SARIF2004_OptimizeFileSize_Warning_EliminateIdOnlyRules_T } /// - /// Looks up a localized string similar to {0}: Placeholder_SARIF2004_OptimizeFileSize_Warning_EliminateLocationOnlyArtifacts_Text. + /// Looks up a localized string similar to {0): The 'artifacts' array contains no information beyond the locations of the artifacts. Removing this array might reduce the log file size without losing information. In some scenarios (for example, when assessing compliance with policy), the 'artifacts' array might be used to record the full set of artifacts that were analyzed. In such a scenario, the 'artifacts' array should be retained even if it contains only location information.. /// internal static string SARIF2004_OptimizeFileSize_Warning_EliminateLocationOnlyArtifacts_Text { get { diff --git a/src/Sarif.Multitool/Rules/RuleResources.resx b/src/Sarif.Multitool/Rules/RuleResources.resx index 5b7e7fad1..c364484ad 100644 --- a/src/Sarif.Multitool/Rules/RuleResources.resx +++ b/src/Sarif.Multitool/Rules/RuleResources.resx @@ -268,10 +268,14 @@ Many tools follow a conventional format for the 'reportingDescriptor.id' propert {0}: This 'region' object does not specify 'startLine', 'charOffset', or 'byteOffset'. As a result, it is impossible to determine whether this 'region' object describes a line/column text region, a character offset/length text region, or a binary region. - Placeholder_SARIF2004_OptimizeFileSize_FullDescription_Text + Emit arrays only if they provide additional information. + +In several parts of a SARIF log file, a subset of information about an object appears in one place, and the full information describing all such objects appears in an array elsewhere in the log file. For example, each 'result' object has a 'ruleId' property that identifies the rule that was violated. Elsewhere in the log file, the array 'run.tool.driver.rules' contains additional information about the rules. But if the elements of the 'rules' array contained no information about the rules beyond their ids, then there might be no reason to include the 'rules' array at all, and the log file could be made smaller simply by omitting it. In some scenarios (for example, when assessing compliance with policy), the 'rules' array might be used to record the full set of rules that were evaluated. In such a scenario, the 'rules' array should be retained even if it contains only id information. + +Similarly, most 'result' objects contain at least one 'artifactLocation' object. Elsewhere in the log file, the array 'run.artifacts' contains additional information about the artifacts that were analyzed. But if the elements of the 'artifacts' array contained not information about the artifacts beyond their locations, then there might be no reason to include the 'artifacts' array at all, and again the log file could be made smaller by omitting it. In some scenarios (for example, when assessing compliance with policy), the 'artifacts' array might be used to record the full set of artifacts that were analyzed. In such a scenario, the 'artifacts' array should be retained even if it contains only location information. - {0}: Placeholder_SARIF2004_OptimizeFileSize_Warning_EliminateLocationOnlyArtifacts_Text + {0): The 'artifacts' array contains no information beyond the locations of the artifacts. Removing this array might reduce the log file size without losing information. In some scenarios (for example, when assessing compliance with policy), the 'artifacts' array might be used to record the full set of artifacts that were analyzed. In such a scenario, the 'artifacts' array should be retained even if it contains only location information. In result messages, use the 'message.id' and 'message.arguments' properties rather than 'message.text'. This has several advantages. If 'text' is lengthy, using 'id' and 'arguments' makes the SARIF file smaller. If the rule metadata is stored externally to the SARIF log file, the message text can be improved (for example, by adding more text, clarifying the phrasing, or fixing typos), and the result messages will pick up the improvements the next time it is displayed. Finally, SARIF supports localizing messages into different languages, which is possible if the SARIF file contains 'message.id' and 'message.arguments', but not if it contains 'message.text' directly. @@ -286,7 +290,7 @@ Many tools follow a conventional format for the 'reportingDescriptor.id' propert {0}: This run does not provide 'versionControlProvenance'. As a result, it is not possible to determine which version of code was analyzed, nor to map relative paths to their locations within the repository. - Placeholder_SARIF2004_OptimizeFileSize_Warning_EliminateIdOnlyRules_Text + {0}: The 'rules' array contains no information beyond the ids of the rules. Removing this array might reduce the log file size without losing information. In some scenarios (for example, when assessing compliance with policy), the 'rules' array might be used to record the full set of rules that were evaluated. In such a scenario, the 'rules' array should be retained even if it contains only id information. Placeholder_SARIF2006_UrisShouldBeReachable_FullDescription_Text diff --git a/src/Sarif.Multitool/Rules/SARIF2004.OptimizeFileSize.cs b/src/Sarif.Multitool/Rules/SARIF2004.OptimizeFileSize.cs index 779eafa0d..9ad457d32 100644 --- a/src/Sarif.Multitool/Rules/SARIF2004.OptimizeFileSize.cs +++ b/src/Sarif.Multitool/Rules/SARIF2004.OptimizeFileSize.cs @@ -19,7 +19,28 @@ public class OptimizeFileSize : SarifValidationSkimmerBase public override string Id => RuleId.OptimizeFileSize; /// - /// Placeholder_SARIF2004_OptimizeFileSize_FullDescription_Text + /// Emit arrays only if they provide additional information. + /// + /// In several parts of a SARIF log file, a subset of information about an object appears + /// in one place, and the full information describing all such objects appears in an array + /// elsewhere in the log file. For example, each 'result' object has a 'ruleId' property + /// that identifies the rule that was violated. Elsewhere in the log file, the array + /// 'run.tool.driver.rules' contains additional information about the rules. But if the + /// elements of the 'rules' array contained no information about the rules beyond their ids, + /// then there might be no reason to include the 'rules' array at all, and the log file + /// could be made smaller simply by omitting it. In some scenarios (for example, when + /// assessing compliance with policy), the 'rules' array might be used to record the full + /// set of rules that were evaluated. In such a scenario, the 'rules' array should be retained + /// even if it contains only id information. + /// + /// Similarly, most 'result' objects contain at least one 'artifactLocation' object. Elsewhere + /// in the log file, the array 'run.artifacts' contains additional information about the artifacts + /// that were analyzed. But if the elements of the 'artifacts' array contained not information + /// about the artifacts beyond their locations, then there might be no reason to include the + /// 'artifacts' array at all, and again the log file could be made smaller by omitting it. In + /// some scenarios (for example, when assessing compliance with policy), the 'artifacts' array + /// might be used to record the full set of artifacts that were analyzed. In such a scenario, + /// the 'artifacts' array should be retained even if it contains only location information. /// public override MultiformatMessageString FullDescription => new MultiformatMessageString { Text = RuleResources.SARIF2004_OptimizeFileSize_FullDescription_Text }; @@ -60,7 +81,12 @@ private void AnalyzeLocationOnlyArtifacts(Run run, string runPointer) if (HasResultLocationsWithUriAndIndex(firstResultLocationPointer) && HasLocationOnlyArtifacts(firstArtifactPointer)) { - // {0}: Placeholder_SARIF2004_OptimizeFileSize_Warning_EliminateLocationOnlyArtifacts_Text + // {0): The 'artifacts' array contains no information beyond the locations of the + // artifacts. Removing this array might reduce the log file size without losing + // information. In some scenarios (for example, when assessing compliance with policy), + // the 'artifacts' array might be used to record the full set of artifacts that were + // analyzed. In such a scenario, the 'artifacts' array should be retained even if it + // contains only location information. LogResult( firstArtifactPointer, nameof(RuleResources.SARIF2004_OptimizeFileSize_Warning_EliminateLocationOnlyArtifacts_Text)); @@ -105,7 +131,12 @@ private void AnalyzeIdOnlyRules(Run run, string runPointer) if (HasIdOnlyRules(firstRulePointer)) { - // {0}: SARIF2004_OptimizeFileSize_Warning_EliminateIdOnlyRules_Text + // {0}: The 'rules' array contains no information beyond the ids of the rules. + // Removing this array might reduce the log file size without losing information. + // In some scenarios (for example, when assessing compliance with policy), the + // 'rules' array might be used to record the full set of rules that were evaluated. + // In such a scenario, the 'rules' array should be retained even if it contains + // only id information. LogResult( firstRulePointer, nameof(RuleResources.SARIF2004_OptimizeFileSize_Warning_EliminateIdOnlyRules_Text)); diff --git a/src/Test.FunctionalTests.Sarif/TestData/Multitool/ValidateCommand/ExpectedOutputs/SARIF2004.OptimizeFileSize_Invalid.sarif b/src/Test.FunctionalTests.Sarif/TestData/Multitool/ValidateCommand/ExpectedOutputs/SARIF2004.OptimizeFileSize_Invalid.sarif index 8876da0b1..572416b81 100644 --- a/src/Test.FunctionalTests.Sarif/TestData/Multitool/ValidateCommand/ExpectedOutputs/SARIF2004.OptimizeFileSize_Invalid.sarif +++ b/src/Test.FunctionalTests.Sarif/TestData/Multitool/ValidateCommand/ExpectedOutputs/SARIF2004.OptimizeFileSize_Invalid.sarif @@ -11,17 +11,17 @@ "id": "SARIF2004", "name": "OptimizeFileSize", "shortDescription": { - "text": "Placeholder_SARIF2004_OptimizeFileSize_FullDescription_Text." + "text": "Emit arrays only if they provide additional information." }, "fullDescription": { - "text": "Placeholder_SARIF2004_OptimizeFileSize_FullDescription_Text" + "text": "Emit arrays only if they provide additional information.\r\n\r\nIn several parts of a SARIF log file, a subset of information about an object appears in one place, and the full information describing all such objects appears in an array elsewhere in the log file. For example, each 'result' object has a 'ruleId' property that identifies the rule that was violated. Elsewhere in the log file, the array 'run.tool.driver.rules' contains additional information about the rules. But if the elements of the 'rules' array contained no information about the rules beyond their ids, then there might be no reason to include the 'rules' array at all, and the log file could be made smaller simply by omitting it. In some scenarios (for example, when assessing compliance with policy), the 'rules' array might be used to record the full set of rules that were evaluated. In such a scenario, the 'rules' array should be retained even if it contains only id information.\r\n\r\nSimilarly, most 'result' objects contain at least one 'artifactLocation' object. Elsewhere in the log file, the array 'run.artifacts' contains additional information about the artifacts that were analyzed. But if the elements of the 'artifacts' array contained not information about the artifacts beyond their locations, then there might be no reason to include the 'artifacts' array at all, and again the log file could be made smaller by omitting it. In some scenarios (for example, when assessing compliance with policy), the 'artifacts' array might be used to record the full set of artifacts that were analyzed. In such a scenario, the 'artifacts' array should be retained even if it contains only location information." }, "messageStrings": { "Warning_EliminateLocationOnlyArtifacts": { - "text": "{0}: Placeholder_SARIF2004_OptimizeFileSize_Warning_EliminateLocationOnlyArtifacts_Text" + "text": "{0): The 'artifacts' array contains no information beyond the locations of the artifacts. Removing this array might reduce the log file size without losing information. In some scenarios (for example, when assessing compliance with policy), the 'artifacts' array might be used to record the full set of artifacts that were analyzed. In such a scenario, the 'artifacts' array should be retained even if it contains only location information." }, "Warning_EliminateIdOnlyRules": { - "text": "Placeholder_SARIF2004_OptimizeFileSize_Warning_EliminateIdOnlyRules_Text" + "text": "{0}: The 'rules' array contains no information beyond the ids of the rules. Removing this array might reduce the log file size without losing information. In some scenarios (for example, when assessing compliance with policy), the 'rules' array might be used to record the full set of rules that were evaluated. In such a scenario, the 'rules' array should be retained even if it contains only id information." } }, "helpUri": "http://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html"