Fix false positives for 'SARIF1002.UrisMustBeValid' due to Uri.IsWellFormedUriString bug

src/ReleaseHistory.md

@@ -3,6 +3,7 @@
 ## Unreleased
 
 * FEATURE: Add `max-file-size-in-kb` argument that allows filtering scan targets by file size. [#2494](https://github.com/microsoft/sarif-sdk/pull/2494)
+* BUGFIX: Fix false positive for `SARIF1002.UrisMustBeValid` for file URIs that omit the `authority`. [#2501](https://github.com/microsoft/sarif-sdk/pull/2501)
 
 ## **v2.4.15** [Sdk](https://www.nuget.org/packages/Sarif.Sdk/2.4.15) | [Driver](https://www.nuget.org/packages/Sarif.Driver/2.4.15) | [Converters](https://www.nuget.org/packages/Sarif.Converters/2.4.15) | [Multitool](https://www.nuget.org/packages/Sarif.Multitool/2.4.15) | [Multitool Library](https://www.nuget.org/packages/Sarif.Multitool.Library/2.4.15)
 

src/Sarif.Multitool.Library/Rules/SARIF1002.UrisMustBeValid.cs

@@ -80,7 +80,7 @@ private void AnalyzeUri(Uri uri, string pointer)
             string uriString = uri?.OriginalString;
             if (uriString != null)
             {
-                if (!Uri.IsWellFormedUriString(uriString, UriKind.RelativeOrAbsolute))
+                if (!IsWellFormedUriString(uriString, UriKind.RelativeOrAbsolute))
                 {
                     // {0}: The string '{1}' is not a valid URI reference. URIs must conform to
                     // [RFC 3986](https://tools.ietf.org/html/rfc3986).

src/Sarif.Multitool.Library/Rules/SARIF1004.ExpressUriBaseIdsCorrectly.cs

@@ -100,7 +100,7 @@ private void AnalyzeOriginalUriBaseIdsEntry(string uriBaseId, ArtifactLocation a
             // avoid having to do a try/catch. Unfortunately Uri.TryCreate will return true
             // even for a malformed URI string.
             string uriString = artifactLocation.Uri.OriginalString;
-            if (uriString != null && Uri.IsWellFormedUriString(uriString, UriKind.RelativeOrAbsolute))
+            if (uriString != null && IsWellFormedUriString(uriString, UriKind.RelativeOrAbsolute))
             {
                 var uri = new Uri(uriString, UriKind.RelativeOrAbsolute);
 

src/Sarif.Multitool.Library/Rules/SARIF1005.UriMustBeAbsolute.cs

@@ -77,7 +77,7 @@ private void AnalyzeUri(string uriString, string pointer)
             // Check for well-formedness first, before attempting to create a Uri object, to
             // avoid having to do a try/catch. Unfortunately Uri.TryCreate will return true
             // even for a malformed URI string.
-            if (uriString != null && Uri.IsWellFormedUriString(uriString, UriKind.RelativeOrAbsolute))
+            if (uriString != null && IsWellFormedUriString(uriString, UriKind.RelativeOrAbsolute))
             {
                 // Ok, it's a well-formed URI of some kind. If it's not absolute, _now_ we
                 // can report it.

src/Sarif.Multitool.Library/Rules/SARIF2006.UrisShouldBeReachable.cs

@@ -87,7 +87,7 @@ private void AnalyzeUri(string uriString, string pointer)
             // Check for well-formedness first, before attempting to create a Uri object, to
             // avoid having to do a try/catch. Unfortunately Uri.TryCreate will return true
             // even for a malformed URI string.
-            if (uriString != null && Uri.IsWellFormedUriString(uriString, UriKind.Absolute))
+            if (uriString != null && IsWellFormedUriString(uriString, UriKind.Absolute))
             {
                 // Ok, it's a well-formed absolute URI. If it's not reachable, _now_ we can report it.
                 Uri uri = new Uri(uriString, UriKind.Absolute);

src/Sarif.Multitool.Library/Rules/SarifValidationSkimmerBase.cs

@@ -246,6 +246,22 @@ internal static string JsonPointerToJavaScript(string pointerString)
             return sb.ToString();
         }
 
+        /// <summary>
+        /// Validate URIs conform to [RFC 3986](https://tools.ietf.org/html/rfc3986).
+        /// </summary>
+        /// <param name="uriString">The string used to attempt to construct a `Uri`.</param>
+        /// <param name="uriKind">The type of the `Uri` in `uriString`.</param>
+        /// <returns></returns>
+        internal static bool IsWellFormedUriString(string uriString, UriKind uriKind)
+        {
+            bool isWellFormed = Uri.IsWellFormedUriString(uriString, uriKind);
+
+            // `System.Uri.IsWellFormedUriString` incorrectly returns false if the `authority` is missing from the Uri string.
+            bool subjectToWellKnownClrBug = (uriString.StartsWith("file:/", StringComparison.OrdinalIgnoreCase) && Uri.TryCreate(uriString, uriKind, out Uri result));
+
+            return isWellFormed || subjectToWellKnownClrBug;
+        }
+
         private static readonly string s_javaScriptIdentifierPattern = @"^[$_\p{L}][$_\p{L}0-9]*$";
         private static readonly Regex s_javaScriptIdentifierRegex = new Regex(s_javaScriptIdentifierPattern, RegexOptions.Compiled);
 

src/Test.FunctionalTests.Sarif/TestData/Multitool/ValidateCommand/Inputs/SARIF1002.UrisMustBeValid_Valid.sarif

@@ -40,6 +40,12 @@
             "uriBaseId": "SRCROOT",
             "index": 1
           }
+        },
+        {
+          "location": {
+            "uri": "file:/c:/src/file.c",
+            "index": 2
+          }
         }
       ],
       "results": [

src/Test.UnitTests.Sarif.Multitool.Library/Rules/SARIF1002.UrisMustBeValidTests.cs

@@ -0,0 +1,23 @@
+// Copyright (c) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+using System.Text;
+
+using FluentAssertions;
+
+using Microsoft.CodeAnalysis.Sarif.Multitool.Rules;
+
+using Xunit;
+
+namespace Microsoft.CodeAnalysis.Sarif.Multitool
+{
+    public class UrisMustBeValidTests
+    {
+        [Fact]
+        public void UrisMustBeValid_ShouldProduceExpectedResults()
+        {
+            var testSkimmer = new UrisMustBeValid();
+
+        }
+    }
+}

src/Test.UnitTests.Sarif.Multitool.Library/Rules/SarifValidationSkimmerBaseTests.cs

@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft. All rights reserved.
 // Licensed under the MIT license. See LICENSE file in the project root for full license information.
 
+using System;
 using System.Text;
 
 using FluentAssertions;
@@ -76,5 +77,86 @@ public void SarifValidationSkimmerBase_JsonPointerToJavaScript_ProducesExpectedR
             string errorMessage = sb.ToString();
             errorMessage.Should().BeEmpty();
         }
+
+        [Fact]
+        public void SarifValidationSkimmerBase_UriIsWellFormedUriString_ShouldReturnTrueIfWellFormedUri()
+        {
+            var testCases = new[]
+            {
+                new
+                {
+                    uriKind = UriKind.Absolute,
+                    uriString = "file:///c:/Code/sarif-sdk/src/"
+                },
+                new
+                {
+                    uriKind = UriKind.Absolute,
+                    uriString = "https://example.com/my-project"
+                },
+                new
+                {
+                    uriKind = UriKind.Absolute,
+                    uriString = "file:/c:/src/file.c"
+                },
+                new
+                {
+                    uriKind = UriKind.Absolute,
+                    uriString = "file:/C:/src/file.c"
+                },
+                new
+                {
+                    uriKind = UriKind.Absolute,
+                    uriString = "FILE:/C:/SRC/FILE.c"
+                },
+                new
+                {
+                    uriKind = UriKind.RelativeOrAbsolute,
+                    uriString = "file:///c:/Code/sarif-sdk/src/"
+                },
+                new
+                {
+                    uriKind = UriKind.RelativeOrAbsolute,
+                    uriString = "https://example.com/my-project"
+                },
+                new
+                {
+                    uriKind = UriKind.RelativeOrAbsolute,
+                    uriString = "file:/c:/src/file.c"
+                },
+                new
+                {
+                    uriKind = UriKind.RelativeOrAbsolute,
+                    uriString = "file://networkLocation/folder/someDoc.txt"
+                },
+            };
+
+            foreach (var testCase in testCases)
+            {
+                SarifValidationSkimmerBase.IsWellFormedUriString(testCase.uriString, testCase.uriKind).Should().BeTrue();
+            }
+        }
+
+        [Fact]
+        public void SarifValidationSkimmerBase_UriIsWellFormedUriString_ShouldReturnFalseIfNotWellFormedUri()
+        {
+            var testCases = new[]
+            {
+                new
+                {
+                    uriKind = UriKind.Absolute,
+                    uriString = "ht%tp://www.example.com/rules/tst0001.html"
+                },
+                new
+                {
+                    uriKind = UriKind.RelativeOrAbsolute,
+                    uriString = "ht%tp://www.example.com/rules/tst0001.html"
+                },
+            };
+
+            foreach (var testCase in testCases)
+            {
+                SarifValidationSkimmerBase.IsWellFormedUriString(testCase.uriString, testCase.uriKind).Should().BeFalse();
+            }
+        }
     }
 }