{

"$schema": "http://json-schema.org/draft-07/schema#",

"title": "Static Analysis Results Format (SARIF) Version 2.1.0 JSON Schema",

"$id": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",

"description": "Static Analysis Results Format (SARIF) Version 2.1.0 JSON Schema: a standard format for the output of static analysis tools.",

"additionalProperties": false,

"type": "object",

"properties": {

"$schema": {

"description": "The URI of the JSON schema corresponding to the version.",

"type": "string",

"format": "uri"

},

"version": {

"description": "The SARIF format version of this log file.",

"enum": [ "2.1.0" ]

},

"runs": {

"description": "The set of runs contained in this log file.",

"type": "array",

"minItems": 0,

"uniqueItems": false,

"items": {

"$ref": "#/definitions/run"

}

},

"inlineExternalProperties": {

"description": "References to external property files that share data between runs.",

"type": "array",

"minItems": 0,

"uniqueItems": true,

"items": {

"$ref": "#/definitions/externalProperties"

}

},

"properties": {

"description": "Key/value pairs that provide additional information about the log file.",

"$ref": "#/definitions/propertyBag"

}

},

"required": [ "version", "runs" ],

"definitions": {

"address": {

"description": "A physical or virtual address, or a range of addresses, in an 'addressable region' (memory or a binary file).",

"additionalProperties": false,

"type": "object",

"properties": {

"absoluteAddress": {

"description": "The address expressed as a byte offset from the start of the addressable region.",

"type": "integer",

"minimum": -1,

"default": -1

},

"relativeAddress": {

"description": "The address expressed as a byte offset from the absolute address of the top-most parent object.",

"type": "integer"

},

"length": {

"description": "The number of bytes in this range of addresses.",

"type": "integer"

},

"kind": {

"description": "An open-ended string that identifies the address kind. 'data', 'function', 'header','instruction', 'module', 'page', 'section', 'segment', 'stack', 'stackFrame', 'table' are well-known values.",

"type": "string"

},

"name": {

"description": "A name that is associated with the address, e.g., '.text'.",

"type": "string"

},

"fullyQualifiedName": {

"description": "A human-readable fully qualified name that is associated with the address.",

"type": "string"

},

"offsetFromParent": {

"description": "The byte offset of this address from the absolute or relative address of the parent object.",

"type": "integer"

},

"index": {

"description": "The index within run.addresses of the cached object for this address.",

"type": "integer",

"default": -1,

"minimum": -1

},

"parentIndex": {

"description": "The index within run.addresses of the parent object.",

"type": "integer",

"default": -1,

"minimum": -1

},

"properties": {

"description": "Key/value pairs that provide additional information about the address.",

"$ref": "#/definitions/propertyBag"

}

}

},

"artifact": {

"description": "A single artifact. In some cases, this artifact might be nested within another artifact.",

"additionalProperties": false,

"type": "object",

"properties": {

"description": {

"description": "A short description of the artifact.",

"$ref": "#/definitions/message"

},

"location": {

"description": "The location of the artifact.",

"$ref": "#/definitions/artifactLocation"

},

"parentIndex": {

"description": "Identifies the index of the immediate parent of the artifact, if this artifact is nested.",

"type": "integer",

"default": -1,

"minimum": -1

},

"offset": {

"description": "The offset in bytes of the artifact within its containing artifact.",

"type": "integer",

"minimum": 0

},

"length": {

"description": "The length of the artifact in bytes.",

"type": "integer",

"default": -1,

"minimum": -1

},

"roles": {

"description": "The role or roles played by the artifact in the analysis.",

"type": "array",

"minItems": 0,

"uniqueItems": true,

"default": [],

"items": {

"enum": [

"analysisTarget",

"attachment",

"responseFile",

"resultFile",

"standardStream",

"tracedFile",

"unmodified",

"modified",

"added",

"deleted",

"renamed",

"uncontrolled",

"driver",

"extension",

"translation",

"taxonomy",

"policy",

"referencedOnCommandLine",

"memoryContents",

"directory",

"userSpecifiedConfiguration",

"toolSpecifiedConfiguration",

"debugOutputFile"

]

}

},

"mimeType": {

"description": "The MIME type (RFC 2045) of the artifact.",

"type": "string",

"pattern": "[^/]+/.+"

},

"contents": {

"description": "The contents of the artifact.",

"$ref": "#/definitions/artifactContent"

},

"encoding": {

"description": "Specifies the encoding for an artifact object that refers to a text file.",

"type": "string"

},

"sourceLanguage": {

"description": "Specifies the source language for any artifact object that refers to a text file that contains source code.",

"type": "string"

},

"hashes": {

"description": "A dictionary, each of whose keys is the name of a hash function and each of whose values is the hashed value of the artifact produced by the specified hash function.",

"type": "object",

"additionalProperties": {

"type": "string"

}

},

"lastModifiedTimeUtc": {

"description": "The Coordinated Universal Time (UTC) date and time at which the artifact was most recently modified. See \"Date/time properties\" in the SARIF spec for the required format.",

"type": "string",

"format": "date-time"

},

"properties": {

"description": "Key/value pairs that provide additional information about the artifact.",

"$ref": "#/definitions/propertyBag"

}

}

},

"artifactChange": {

"description": "A change to a single artifact.",

"additionalProperties": false,

"type": "object",

"properties": {

"artifactLocation": {

"description": "The location of the artifact to change.",

"$ref": "#/definitions/artifactLocation"

},

"replacements": {

"description": "An array of replacement objects, each of which represents the replacement of a single region in a single artifact specified by 'artifactLocation'.",

"type": "array",

"minItems": 1,

"uniqueItems": false,

"items": {

"$ref": "#/definitions/replacement"

}

},

"properties": {

"description": "Key/value pairs that provide additional information about the change.",

"$ref": "#/definitions/propertyBag"

}

},

"required": [ "artifactLocation", "replacements" ]

},

"artifactContent": {

"description": "Represents the contents of an artifact.",

"type": "object",

"additionalProperties": false,

"properties": {

"text": {

"description": "UTF-8-encoded content from a text artifact.",

"type": "string"

},

"binary": {

"description": "MIME Base64-encoded content from a binary artifact, or from a text artifact in its original encoding.",

"type": "string"

},

"rendered": {

"description": "An alternate rendered representation of the artifact (e.g., a decompiled representation of a binary region).",

"$ref": "#/definitions/multiformatMessageString"

},

"properties": {

"description": "Key/value pairs that provide additional information about the artifact content.",

"$ref": "#/definitions/propertyBag"

}

}

},

"artifactLocation": {

"description": "Specifies the location of an artifact.",

"additionalProperties": false,

"type": "object",

"properties": {

"uri": {

"description": "A string containing a valid relative or absolute URI.",

"type": "string",

"format": "uri-reference"

},

"uriBaseId": {

"description": "A string which indirectly specifies the absolute URI with respect to which a relative URI in the \"uri\" property is interpreted.",

"type": "string"

},

"index": {

"description": "The index within the run artifacts array of the artifact object associated with the artifact location.",

"type": "integer",

"default": -1,

"minimum": -1

},

"description": {

"description": "A short description of the artifact location.",

"$ref": "#/definitions/message"

},

"properties": {

"description": "Key/value pairs that provide additional information about the artifact location.",

"$ref": "#/definitions/propertyBag"

}

}

},

"attachment": {

"description": "An artifact relevant to a result.",

"type": "object",

"additionalProperties": false,

"properties": {

"description": {

"description": "A message describing the role played by the attachment.",

"$ref": "#/definitions/message"

},

"artifactLocation": {

"description": "The location of the attachment.",

"$ref": "#/definitions/artifactLocation"

},

"regions": {

"description": "An array of regions of interest within the attachment.",

"type": "array",

"minItems": 0,

"uniqueItems": true,

"default": [],

"items": {

"$ref": "#/definitions/region"

}

},

"rectangles": {

"description": "An array of rectangles specifying areas of interest within the image.",

"type": "array",

"minItems": 0,

"uniqueItems": true,

"default": [],

"items": {

"$ref": "#/definitions/rectangle"

}

},

"properties": {

"description": "Key/value pairs that provide additional information about the attachment.",

"$ref": "#/definitions/propertyBag"

}

},

"required": [ "artifactLocation" ]

},

"codeFlow": {

"description": "A set of threadFlows which together describe a pattern of code execution relevant to detecting a result.",

"additionalProperties": false,

"type": "object",

"properties": {

"message": {

"description": "A message relevant to the code flow.",

"$ref": "#/definitions/message"

},

"threadFlows": {

"description": "An array of one or more unique threadFlow objects, each of which describes the progress of a program through a thread of execution.",

"type": "array",

"minItems": 1,

"uniqueItems": false,

"items": {

"$ref": "#/definitions/threadFlow"

}

},

"properties": {

"description": "Key/value pairs that provide additional information about the code flow.",

"$ref": "#/definitions/propertyBag"

}

},

"required": [ "threadFlows" ]

},

"configurationOverride": {

"description": "Information about how a specific rule or notification was reconfigured at runtime.",

"type": "object",

"additionalProperties": false,

"properties": {

"configuration": {

"description": "Specifies how the rule or notification was configured during the scan.",

"$ref": "#/definitions/reportingConfiguration"

},

"descriptor": {

"description": "A reference used to locate the descriptor whose configuration was overridden.",

"$ref": "#/definitions/reportingDescriptorReference"

},

"properties": {

"description": "Key/value pairs that provide additional information about the configuration override.",

"$ref": "#/definitions/propertyBag"

}

},

"required": [ "configuration", "descriptor" ]

},

"conversion": {

"description": "Describes how a converter transformed the output of a static analysis tool from the analysis tool's native output format into the SARIF format.",

"additionalProperties": false,

"type": "object",

"properties": {

"tool": {

"description": "A tool object that describes the converter.",

"$ref": "#/definitions/tool"

},

"invocation": {

"description": "An invocation object that describes the invocation of the converter.",

"$ref": "#/definitions/invocation"

},

"analysisToolLogFiles": {

"description": "The locations of the analysis tool's per-run log files.",

"type": "array",

"minItems": 0,

"uniqueItems": true,

"default": [],

"items": {

"$ref": "#/definitions/artifactLocation"

}

},

"properties": {

"description": "Key/value pairs that provide additional information about the conversion.",

"$ref": "#/definitions/propertyBag"

}

},

"required": [ "tool" ]

},

"edge": {

"description": "Represents a directed edge in a graph.",

"type": "object",

"additionalProperties": false,

"properties": {

"id": {

"description": "A string that uniquely identifies the edge within its graph.",

"type": "string"

},

"label": {

"description": "A short description of the edge.",

"$ref": "#/definitions/message"

},

"sourceNodeId": {

"description": "Identifies the source node (the node at which the edge starts).",

"type": "string"

},

"targetNodeId": {

"description": "Identifies the target node (the node at which the edge ends).",

"type": "string"

},

"properties": {

"description": "Key/value pairs that provide additional information about the edge.",

"$ref": "#/definitions/propertyBag"

}

},

"required": [ "id", "sourceNodeId", "targetNodeId" ]

},

"edgeTraversal": {

"description": "Represents the traversal of a single edge during a graph traversal.",

"type": "object",

"additionalProperties": false,

"properties": {

"edgeId": {

"description": "Identifies the edge being traversed.",

"type": "string"

},

"message": {

"description": "A message to display to the user as the edge is traversed.",

"$ref": "#/definitions/message"

},

"finalState": {

"description": "The values of relevant expressions after the edge has been traversed.",

"type": "object",

"additionalProperties": {

"$ref": "#/definitions/multiformatMessageString"

}

},

"stepOverEdgeCount": {

"description": "The number of edge traversals necessary to return from a nested graph.",

"type": "integer",

"minimum": 0

},

"properties": {

"description": "Key/value pairs that provide additional information about the edge traversal.",

"$ref": "#/definitions/propertyBag"

}

},

"required": [ "edgeId" ]

},

"exception": {

"description": "Describes a runtime exception encountered during the execution of an analysis tool.",

"type": "object",

"additionalProperties": false,

"properties": {

"kind": {

"type": "string",

"description": "A string that identifies the kind of exception, for example, the fully qualified type name of an object that was thrown, or the symbolic name of a signal."

},

"message": {

"description": "A message that describes the exception.",

"type": "string"

},

"stack": {

"description": "The sequence of function calls leading to the exception.",

"$ref": "#/definitions/stack"

},

"innerExceptions": {

"description": "An array of exception objects each of which is considered a cause of this exception.",

"type": "array",

"minItems": 0,

"uniqueItems": false,

"default": [],

"items": {

"$ref": "#/definitions/exception"

}

},

"properties": {

"description": "Key/value pairs that provide additional information about the exception.",

"$ref": "#/definitions/propertyBag"

}

}

},

"externalProperties": {

"description": "The top-level element of an external property file.",

"type": "object",

"additionalProperties": false,

"properties": {

"schema": {

"description": "The URI of the JSON schema corresponding to the version of the external property file format.",

"type": "string",

"format": "uri"

},

"version": {

"description": "The SARIF format version of this external properties object.",

"enum": [ "2.1.0" ]

},

"guid": {

"description": "A stable, unique identifer for this external properties object, in the form of a GUID.",

"type": "string",

"pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"

},

"runGuid": {

"description": "A stable, unique identifer for the run associated with this external properties object, in the form of a GUID.",

"type": "string",

"pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"

},

"conversion": {

"description": "A conversion object that will be merged with a separate run.",

"$ref": "#/definitions/conversion"

},

"graphs": {

"description": "An array of graph objects that will be merged with a separate run.",

"type": "array",

"minItems": 0,

"default": [],

"uniqueItems": true,

"items": {

"$ref": "#/definitions/graph"

}

},

"externalizedProperties": {

"description": "Key/value pairs that provide additional information that will be merged with a separate run.",

"$ref": "#/definitions/propertyBag"

},

"artifacts": {

"description": "An array of artifact objects that will be merged with a separate run.",

"type": "array",

"minItems": 0,

"uniqueItems": true,

"items": {

"$ref": "#/definitions/artifact"

}

},

"invocations": {

"description": "Describes the invocation of the analysis tool that will be merged with a separate run.",

"type": "array",

"minItems": 0,

"uniqueItems": false,

"default": [],

"items": {

"$ref": "#/definitions/invocation"

}

},

"logicalLocations": {

"description": "An array of logical locations such as namespaces, types or functions that will be merged with a separate run.",

"type": "array",

"minItems": 0,

"uniqueItems": true,

"default": [],

"items": {

"$ref": "#/definitions/logicalLocation"

}

},

"threadFlowLocations": {

"description": "An array of threadFlowLocation objects that will be merged with a separate run.",

"type": "array",

"minItems": 0,

"uniqueItems": true,

"default": [],

"items": {

"$ref": "#/definitions/threadFlowLocation"

}

},

"results": {

"description": "An array of result objects that will be merged with a separate run.",

"type": "array",

"minItems": 0,

"uniqueItems": false,

"default": [],

"items": {

"$ref": "#/definitions/result"

}

},

"taxonomies": {

"description": "Tool taxonomies that will be merged with a separate run.",

"type": "array",

"minItems": 0,

"uniqueItems": true,

"default": [],

"items": {

"$ref": "#/definitions/toolComponent"

}

},

"driver": {

"description": "The analysis tool object that will be merged with a separate run.",

"$ref": "#/definitions/toolComponent"

},

"extensions": {

"description": "Tool extensions that will be merged with a separate run.",

"type": "array",

"minItems": 0,

"uniqueItems": true,

"default": [],

"items": {

"$ref": "#/definitions/toolComponent"

}

},

"policies": {

"description": "Tool policies that will be merged with a separate run.",

"type": "array",

"minItems": 0,

"uniqueItems": true,

"default": [],

"items": {

"$ref": "#/definitions/toolComponent"

}

},

"translations": {

"description": "Tool translations that will be merged with a separate run.",

"type": "array",

"minItems": 0,

"uniqueItems": true,

"default": [],

"items": {

"$ref": "#/definitions/toolComponent"

}

},

"addresses": {

"description": "Addresses that will be merged with a separate run.",

"type": "array",

"minItems": 0,

"uniqueItems": false,

"default": [],

"items": {

"$ref": "#/definitions/address"

}

},

"webRequests": {

"description": "Requests that will be merged with a separate run.",

"type": "array",

"minItems": 0,

"uniqueItems": true,

"default": [],

"items": {

"$ref": "#/definitions/webRequest"

}

},

"webResponses": {

"description": "Responses that will be merged with a separate run.",

"type": "array",

"minItems": 0,

"uniqueItems": true,

"default": [],

"items": {

"$ref": "#/definitions/webResponse"

}

},

"properties": {

"description": "Key/value pairs that provide additional information about the external properties.",

"$ref": "#/definitions/propertyBag"

}

}

},

"externalPropertyFileReference": {

"description": "Contains information that enables a SARIF consumer to locate the external property file that contains the value of an externalized property associated with the run.",

"type": "object",

"additionalProperties": false,

"properties": {

"location": {

"description": "The location of the external property file.",

"$ref": "#/definitions/artifactLocation"

},

"guid": {

"description": "A stable, unique identifer for the external property file in the form of a GUID.",

"type": "string",

"pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"

},

"itemCount": {

"description": "A non-negative integer specifying the number of items contained in the external property file.",

"type": "integer",

"default": -1,

"minimum": -1

},

"properties": {

"description": "Key/value pairs that provide additional information about the external property file.",

"$ref": "#/definitions/propertyBag"

}

},

"anyOf": [

{ "required": [ "location" ] },

{ "required": [ "guid" ] }

]

},

"externalPropertyFileReferences": {

"description": "References to external property files that should be inlined with the content of a root log file.",

"additionalProperties": false,

"type": "object",

"properties": {

"conversion": {

"description": "An external property file containing a run.conversion object to be merged with the root log file.",

"$ref": "#/definitions/externalPropertyFileReference"

},

"graphs": {

"description": "An array of external property files containing a run.graphs object to be merged with the root log file.",

"type": "array",

"minItems": 0,

"uniqueItems": true,

"default": [],

"items": {

"$ref": "#/definitions/externalPropertyFileReference"

}

},

"externalizedProperties": {

"description": "An external property file containing a run.properties object to be merged with the root log file.",

"$ref": "#/definitions/externalPropertyFileReference"

},

"artifacts": {

"description": "An array of external property files containing run.artifacts arrays to be merged with the root log file.",

"type": "array",

"minItems": 0,

"uniqueItems": true,

"default": [],

"items": {

"$ref": "#/definitions/externalPropertyFileReference"

}

},

"invocations": {

"description": "An array of external property files containing run.invocations arrays to be merged with the root log file.",

"type": "array",

"minItems": 0,

"uniqueItems": true,

"default": [],

"items": {

"$ref": "#/definitions/externalPropertyFileReference"

}

},

"logicalLocations": {

"description": "An array of external property files containing run.logicalLocations arrays to be merged with the root log file.",

"type": "array",

"minItems": 0,

"uniqueItems": true,

"default": [],

"items": {

"$ref": "#/definitions/externalPropertyFileReference"

}

},

"threadFlowLocations": {

"description": "An array of external property files containing run.threadFlowLocations arrays to be merged with the root log file.",

"type": "array",

"minItems": 0,

"uniqueItems": true,

"default": [],

"items": {

"$ref": "#/definitions/externalPropertyFileReference"

}

},

"results": {

"description": "An array of external property files containing run.results arrays to be merged with the root log file.",

"type": "array",

"minItems": 0,

"uniqueItems": true,

"default": [],

"items": {

"$ref": "#/definitions/externalPropertyFileReference"

}

},

"taxonomies": {

"description": "An array of external property files containing run.taxonomies arrays to be merged with the root log file.",

"type": "array",

"minItems": 0,

"uniqueItems": true,

"default": [],

"items": {

"$ref": "#/definitions/externalPropertyFileReference"

}

},

"addresses": {

"description": "An array of external property files containing run.addresses arrays to be merged with the root log file.",

"type": "array",

"minItems": 0,

"uniqueItems": true,

"default": [],

"items": {

"$ref": "#/definitions/externalPropertyFileReference"

}

},

"driver": {

"description": "An external property file containing a run.driver object to be merged with the root log file.",

"$ref": "#/definitions/externalPropertyFileReference"

},

"extensions": {

"description": "An array of external property files containing run.extensions arrays to be merged with the root log file.",

"type": "array",

"minItems": 0,

"uniqueItems": true,

"default": [],

"items": {

"$ref": "#/definitions/externalPropertyFileReference"

}

},

"policies": {

"description": "An array of external property files containing run.policies arrays to be merged with the root log file.",

"type": "array",

"minItems": 0,

"uniqueItems": true,

"default": [],

"items": {

"$ref": "#/definitions/externalPropertyFileReference"

}

},

"translations": {

"description": "An array of external property files containing run.translations arrays to be merged with the root log file.",

"type": "array",

"minItems": 0,

"uniqueItems": true,

"default": [],

"items": {

"$ref": "#/definitions/externalPropertyFileReference"

}

},

"webRequests": {

"description": "An array of external property files containing run.requests arrays to be merged with the root log file.",

"type": "array",

"minItems": 0,

"uniqueItems": true,

"default": [],

"items": {

"$ref": "#/definitions/externalPropertyFileReference"

}

},

"webResponses": {

"description": "An array of external property files containing run.responses arrays to be merged with the root log file.",

"type": "array",

"minItems": 0,

"uniqueItems": true,

"default": [],

"items": {

"$ref": "#/definitions/externalPropertyFileReference"

}

},

"properties": {

"description": "Key/value pairs that provide additional information about the external property files.",

"$ref": "#/definitions/propertyBag"

}

}

},

"fix": {

"description": "A proposed fix for the problem represented by a result object. A fix specifies a set of artifacts to modify. For each artifact, it specifies a set of bytes to remove, and provides a set of new bytes to replace them.",

"additionalProperties": false,

"type": "object",

"properties": {

"description": {

"description": "A message that describes the proposed fix, enabling viewers to present the proposed change to an end user.",

"$ref": "#/definitions/message"

},

"artifactChanges": {

"description": "One or more artifact changes that comprise a fix for a result.",

"type": "array",

"minItems": 1,

"uniqueItems": true,

"items": {

"$ref": "#/definitions/artifactChange"

}

},

"properties": {

"description": "Key/value pairs that provide additional information about the fix.",

"$ref": "#/definitions/propertyBag"

}

},