Location relationships

[ghost]

@kupsch wrote:

A related location should say what is related to with a relatedTo property that is a URI (a sarif scheme URI relative to theResult). This is necessary as a tool may produce a relatedLocation that has its own related location, for instance, an error in foo.h may have a related location to say it was included from bar.h which was included in baz.c. Also since there may also be multiple locations, they may each have unique related locations.

[michaelcfanning]

TC proposal: [Per Microsoft feedback: revised per the comment below]

Move location.physicalLocation.id to location.id
Add location.relatedTo an integer, >= 0 (the scope of which is constrained to a current result)
Add location.relationshipKinds, an array of string identifiers

Some well-known kinds. There are only two, due to lateness of arrival. Drive a SARIF list discussion to see whether we can build out the relevant topics of interest here (if not the exact set of terms).

includes, isIncludedBy

[ghost]

SARIF example (as presented at TC #35)

"results": [
  {
    "locations": [
      {
        "id": 0,
        "physicalLocation": {
          "artifactLocation": {
            "uri": "f.h"
          }
        }
      }
    ],

    "relatedLocations": [
      {
        "id": 1,
        "physicalLocation": {
          "artifactLocation": {
            "uri": "g.h"
          },
        },
        "relatedTo": 0,
        "relationshipKinds": [ "includes" ]
      },
      {
        "id": 2
        "physicalLocation": {
          "artifactLocation": {
            "uri": "g.c"
          },
        },
        "relatedTo": 1,
        "relationshipKinds": [ "includes" ]
      }
    ]
  }
]

[ghost]

REVISED PROPOSAL per Microsoft feedback.

This proposal is consistent with the original, but has the virtue of being consistent with the "reporting descriptor relationships" design.

• Define a locationRelationship object with the following properties:

  • target of type integer, required, minValue: 0.
  • kinds of type string[], optional, unique, with well-known values "includes", "isIncludedBy", and "relevant", default: [ "relevant" ].

• In the location object:

  • Add a property id of type integer, optional, minValue: -1, default: -1 (moved from physicalLocation).
  • Add a property relationships of type locationRelationship[], optional, unique, default: [].

• In the physicalLocation object:

  • Remove the id property (moved to location).

REVISED SARIF SAMPLE

"results": [
  {
    "locations": [
      {
        "id": 0,
        "physicalLocation": {
          "artifactLocation": {
            "uri": "f.h"
          }
        },
        "relationships": [
          {
            "target": 1,
            "kinds": [ "isIncludedBy" ]
          }
        ]
      }
    ],

    "relatedLocations": [
      {
        "id": 1,
        "physicalLocation": {
          "artifactLocation": {
            "uri": "g.h"
          },
        },
        "relationships": [
          {
            "target": 0,
            "kinds": [ "includes" ]
          },
          {
            "target": 2,
            "kinds": [ "isIncludedBy" ]
          }
        ]
      },
      {
        "id": 2
        "physicalLocation": {
          "artifactLocation": {
            "uri": "g.c"
          },
        },
        "relationships": [
          {
            "target": 1,
            "kinds": [ "includes" ]
          }
        ]
      }
    ]
  }
]