Specify URI normalization algorithm

[michaelcfanning]

TC recommendation for direct producers:
for files, you SHALL normalize to the file system's absolute path then create URIs from this
(for converters, we recommend creating a uriBaseId comprising everything to the left of the rightmost .. segment)
for other uris, follow the normalization semantics defined by 3986 (transforms double slashes to one, slash dot becomes nothing, etc).

[ghost]

Re #2, we need to do the remainder of the 3986 normalization for file URIs as well. For example, normalize the case of the "scheme" URI component, and of the hex representations of any percent-encoded characters.

[ghost]

E-BALLOT #3 PROPOSAL

• All URIs SHALL be fully normalized according to the requirements of RFC3986. (The spec actually already said that, but I'll make it clearer).
• For file scheme URIs, direct producers SHALL preserve the file system's case. Converters SHOULD preserve the case from the analysis tool's native output format, since they don't know the file system's casing.
• Direct producers SHALL resolve file scheme URIs to an absolute path, and optionally split a portion of the path into a uriBaseId.
• Converters SHOULD split everything to the left of the rightmost .. into a uriBaseId.

SCHEMA CHANGES

None

[kupsch]

Producers SHOULD not include .. or . path segments in a URI after forming the full URI. Before converting to a URI, paths that contain a .. or . should be normalized to a canonical absolute path using an appropriate algorithm for the operating system on which the tool ran. This is necessary as the path /d1/../f naively converted to a URI is file:///d1/../f which resolves to file:///f using RFC 3986. If /d1 is a symbolic link to the directory d2/d3 then the correct URI is file:///d2/f.

If a SARIF producer cannot determine the correct canonical representation of the path for some reason such as the original file system not being available, then the producer MAY generate URIs with .. segments.

For file sheme URIs, consumer must not normalize .. segments out of the path. Any paths that contain a .. segment should treat the directory formed by the segments prior to and including the .. segnent as if it were a unique directory in the file system, even if RFC 3986 normalization produces identical.

[ghost]

Approved in e-ballot-3. Incorporated @kupsch's ".." improvement.