Define protocol to allow embedded messages links to refer to other results

[michaelcfanning]

Producers could use this mechanism to share complex supporting information such as code flows.

The 'root' result could contain this data and have an array of related results for all its 'children'. Each child result could have a related results array that points to the parent. This is just one idea for a convention for code sharing.

The broader issue: a tool might generate a lengthy and complex code flow which raises many results, each of which requires, by spec, a different result (because they are disposed as individual items). In a different design, we could have oriented around the code flow, hanging lists of results off it.

Final note: it would be helpful for users to be able to click a link to an arbitrary result, as you can with a related location. To enable this requires that SARIF log file producers ensure that all ids across the format's various constructs are unique.

[michaelcfanning]

TC disposition:

We will support in-lined linkage to arbitrary other content in the SARIF file. We will define a new URI schema for this, sarif://runs/0/results/12. or you can provide a relative reference to the current result, e.g., relatedLocations/0.

[ghost]

E-BALLOT #3 PROPOSAL

Allow an embedded message link to use the sarif: URI scheme to refer to arbitrary content in the SARIF log file. One important use case is to allow a reference to a related result. On the click of such a link, the viewer could highlight the selected result in the Error List window and navigate to the result's location in the source code.

Allow these links in both plain text and formatted (Markdown) messages. Plain text messages up until now have only allowed "physical location links"(e.g., "Taint was introduced [here](0).") Since we're allowing sarif scheme links now, we may as well allow all URIs in plain text message links.

EXAMPLES:

• "There was [another result](sarif:/runs/0/results/42) found by this code flow."
• "Find out more at the [SARIF](http://sarifweb.azurewebsites.net/) home page."

SCHEMA CHANGES

None

[ghost]

Approved in e-ballot-3.