@microsoft/sarif-multitool-darwin 4.5.3 → 4.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/DotnetToolSettings.xml +6 -0
- package/Sarif.Converters.pdb +0 -0
- package/Sarif.Converters.xml +1576 -0
- package/Sarif.Driver.pdb +0 -0
- package/Sarif.Driver.xml +1196 -0
- package/Sarif.Multitool +0 -0
- package/Sarif.Multitool.Library.pdb +0 -0
- package/Sarif.Multitool.Library.xml +1572 -0
- package/Sarif.Multitool.dll.config +8 -0
- package/Sarif.Multitool.pdb +0 -0
- package/Sarif.Multitool.xml +39 -0
- package/Sarif.WorkItems.pdb +0 -0
- package/Sarif.WorkItems.xml +79 -0
- package/Sarif.pdb +0 -0
- package/Sarif.xml +12196 -0
- package/WorkItems.pdb +0 -0
- package/WorkItems.xml +227 -0
- package/amd64/KernelTraceControl.dll +0 -0
- package/amd64/msdia140.dll +0 -0
- package/amd64/msvcp140.dll +0 -0
- package/amd64/vcruntime140.dll +0 -0
- package/amd64/vcruntime140_1.dll +0 -0
- package/arm64/KernelTraceControl.dll +0 -0
- package/arm64/msdia140.dll +0 -0
- package/arm64/msvcp140.dll +0 -0
- package/arm64/vcruntime140.dll +0 -0
- package/arm64/vcruntime140_1.dll +0 -0
- package/default.configuration.xml +6 -0
- package/package.json +1 -1
- package/sarif-2.1.0.json +3370 -0
- package/x86/KernelTraceControl.Win61.dll +0 -0
- package/x86/KernelTraceControl.dll +0 -0
- package/x86/msdia140.dll +0 -0
- package/x86/msvcp140.dll +0 -0
- package/x86/vcruntime140.dll +0 -0
|
@@ -0,0 +1,1572 @@
|
|
|
1
|
+
<?xml version="1.0"?>
|
|
2
|
+
<doc>
|
|
3
|
+
<assembly>
|
|
4
|
+
<name>Sarif.Multitool.Library</name>
|
|
5
|
+
</assembly>
|
|
6
|
+
<members>
|
|
7
|
+
<member name="T:Microsoft.CodeAnalysis.Sarif.Multitool.FileWorkItemsCommand">
|
|
8
|
+
<summary>
|
|
9
|
+
A class that drives SARIF work item filing. This class is responsible for
|
|
10
|
+
collecting and verifying all options relevant to driving the work item filing
|
|
11
|
+
process. These options may be retrieved from a serialized version of the
|
|
12
|
+
aggregated configuration (currently rendered as XML, via the PropertiesDictionary
|
|
13
|
+
class). Command-line arguments will override any options specified in the
|
|
14
|
+
file-based serialized configuration (if present). After verifying that all
|
|
15
|
+
configured options are valid, the command will instantiate an instance of
|
|
16
|
+
SarifWorkItemFiler in order to complete the work.
|
|
17
|
+
</summary>
|
|
18
|
+
</member>
|
|
19
|
+
<member name="T:Microsoft.CodeAnalysis.Sarif.Multitool.MultitoolResources">
|
|
20
|
+
<summary>
|
|
21
|
+
A strongly-typed resource class, for looking up localized strings, etc.
|
|
22
|
+
</summary>
|
|
23
|
+
</member>
|
|
24
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.MultitoolResources.ResourceManager">
|
|
25
|
+
<summary>
|
|
26
|
+
Returns the cached ResourceManager instance used by this class.
|
|
27
|
+
</summary>
|
|
28
|
+
</member>
|
|
29
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.MultitoolResources.Culture">
|
|
30
|
+
<summary>
|
|
31
|
+
Overrides the current thread's CurrentUICulture property for all
|
|
32
|
+
resource lookups using this strongly typed resource class.
|
|
33
|
+
</summary>
|
|
34
|
+
</member>
|
|
35
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.MultitoolResources.Banner">
|
|
36
|
+
<summary>
|
|
37
|
+
Looks up a localized string similar to {0} version {1}.
|
|
38
|
+
</summary>
|
|
39
|
+
</member>
|
|
40
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.MultitoolResources.ErrorIllegalContextReuse">
|
|
41
|
+
<summary>
|
|
42
|
+
Looks up a localized string similar to A context object was reinitialized with a new target URI..
|
|
43
|
+
</summary>
|
|
44
|
+
</member>
|
|
45
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.MultitoolResources.ErrorInvalidSarifLogFile">
|
|
46
|
+
<summary>
|
|
47
|
+
Looks up a localized string similar to '{0}' is not a valid SARIF log file..
|
|
48
|
+
</summary>
|
|
49
|
+
</member>
|
|
50
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.MultitoolResources.ErrorInvalidTransformTargetVersion">
|
|
51
|
+
<summary>
|
|
52
|
+
Looks up a localized string similar to Target version must be 1 or 2.
|
|
53
|
+
</summary>
|
|
54
|
+
</member>
|
|
55
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.MultitoolResources.ErrorNoGroupInFileName">
|
|
56
|
+
<summary>
|
|
57
|
+
Looks up a localized string similar to No "group" (the part of the file name before the dash) found in '{0}'. All file names must be of the form [Group]-[RunID] and each adjacent pair in the same group is compared..
|
|
58
|
+
</summary>
|
|
59
|
+
</member>
|
|
60
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.MultitoolResources.InputFileNotFound">
|
|
61
|
+
<summary>
|
|
62
|
+
Looks up a localized string similar to Input file '{0}' was not found..
|
|
63
|
+
</summary>
|
|
64
|
+
</member>
|
|
65
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.MultitoolResources.ResultDifferenceSummary">
|
|
66
|
+
<summary>
|
|
67
|
+
Looks up a localized string similar to {0:n0} identical, {1:n0} changed.
|
|
68
|
+
</summary>
|
|
69
|
+
</member>
|
|
70
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.MultitoolResources.WorkItemFiling_ErrorUriIsNotAbsolute">
|
|
71
|
+
<summary>
|
|
72
|
+
Looks up a localized string similar to The value '{0}' of the '{1}' option is not an absolute URI..
|
|
73
|
+
</summary>
|
|
74
|
+
</member>
|
|
75
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.MultitoolResources.WorkItemFiling_ErrorUriIsNotLegal">
|
|
76
|
+
<summary>
|
|
77
|
+
Looks up a localized string similar to A valid URI could not be created from the value '{0}' of the '{1}' option..
|
|
78
|
+
</summary>
|
|
79
|
+
</member>
|
|
80
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.MultitoolResources.WorkItemFiling_NoHostUriSpecified">
|
|
81
|
+
<summary>
|
|
82
|
+
Looks up a localized string similar to No host URI was provided via the --host-uri option or as part of an input file specified via --configuration..
|
|
83
|
+
</summary>
|
|
84
|
+
</member>
|
|
85
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.MultitoolResources.WorkItemFiling_NoPatFound">
|
|
86
|
+
<summary>
|
|
87
|
+
Looks up a localized string similar to No security token was provided. Populate the 'SarifWorkItemFilingPat' environment variable with a valid personal access token or pass a token in a configuration file using the --configuration option.
|
|
88
|
+
</summary>
|
|
89
|
+
</member>
|
|
90
|
+
<member name="T:Microsoft.CodeAnalysis.Sarif.Multitool.PageOptions">
|
|
91
|
+
<summary>
|
|
92
|
+
Options for the 'Page' command, which quickly writes a subset of a SARIF file
|
|
93
|
+
for easier consumption of huge files.
|
|
94
|
+
</summary>
|
|
95
|
+
<remarks>
|
|
96
|
+
Excluded Options
|
|
97
|
+
================
|
|
98
|
+
pretty-print: We copy slices of the input file, so we can't change formatting.
|
|
99
|
+
inline: We build a map of the input, so we don't want to write inline and immediately invalidate it.
|
|
100
|
+
</remarks>
|
|
101
|
+
</member>
|
|
102
|
+
<member name="T:Microsoft.CodeAnalysis.Sarif.Multitool.QueryOptions">
|
|
103
|
+
<summary>
|
|
104
|
+
Options for the 'Query' command, which runs a query expression on a SARIF file
|
|
105
|
+
and shows results.
|
|
106
|
+
</summary>
|
|
107
|
+
</member>
|
|
108
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.AdoReferenceFinalSchema.Id">
|
|
109
|
+
<summary>
|
|
110
|
+
ADO1011
|
|
111
|
+
</summary>
|
|
112
|
+
</member>
|
|
113
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.AdoProvideRequiredSarifLogProperties.Id">
|
|
114
|
+
<summary>
|
|
115
|
+
ADO1013
|
|
116
|
+
</summary>
|
|
117
|
+
</member>
|
|
118
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.AdoProvideRequiredRunProperties.Id">
|
|
119
|
+
<summary>
|
|
120
|
+
ADO1014
|
|
121
|
+
</summary>
|
|
122
|
+
</member>
|
|
123
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.AdoProvideRequiredResultProperties.Id">
|
|
124
|
+
<summary>
|
|
125
|
+
ADO1015
|
|
126
|
+
</summary>
|
|
127
|
+
</member>
|
|
128
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.AdoProvideRequiredLocationProperties.Id">
|
|
129
|
+
<summary>
|
|
130
|
+
ADO1016
|
|
131
|
+
</summary>
|
|
132
|
+
</member>
|
|
133
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.AdoProvideRequiredPhysicalLocationProperties.Id">
|
|
134
|
+
<summary>
|
|
135
|
+
ADO1017
|
|
136
|
+
</summary>
|
|
137
|
+
</member>
|
|
138
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.AdoProvideRequiredToolProperties.Id">
|
|
139
|
+
<summary>
|
|
140
|
+
ADO1018
|
|
141
|
+
</summary>
|
|
142
|
+
</member>
|
|
143
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.AdoProvideRequiredReportingDescriptorProperties.Id">
|
|
144
|
+
<summary>
|
|
145
|
+
ADO2012
|
|
146
|
+
</summary>
|
|
147
|
+
</member>
|
|
148
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.BaseReferenceFinalSchema.FullDescription">
|
|
149
|
+
<summary>
|
|
150
|
+
The '$schema' property must refer to the final version of the SARIF 2.1.0 schema. This
|
|
151
|
+
enables IDEs to provide Intellisense for SARIF log files.
|
|
152
|
+
|
|
153
|
+
The SARIF standard was developed over several years, and many intermediate versions of
|
|
154
|
+
the schema were produced. Now that the standard is final, only the OASIS standard version
|
|
155
|
+
of the schema is valid.
|
|
156
|
+
</summary>
|
|
157
|
+
</member>
|
|
158
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ProvideRequiredLocationProperties.Id">
|
|
159
|
+
<summary>
|
|
160
|
+
GH1001
|
|
161
|
+
</summary>
|
|
162
|
+
</member>
|
|
163
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ProvideRequiredLocationProperties.FullDescription">
|
|
164
|
+
<summary>
|
|
165
|
+
Each result location must provide the property 'physicalLocation.artifactLocation.uri'.
|
|
166
|
+
GitHub Advanced Security code scanning will not display a result whose location does not
|
|
167
|
+
provide the URI of the artifact that was analyzed.
|
|
168
|
+
</summary>
|
|
169
|
+
</member>
|
|
170
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.InlineThreadFlowLocations.Id">
|
|
171
|
+
<summary>
|
|
172
|
+
GH1002
|
|
173
|
+
</summary>
|
|
174
|
+
</member>
|
|
175
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.InlineThreadFlowLocations.FullDescription">
|
|
176
|
+
<summary>
|
|
177
|
+
Results that include codeFlows must specify each threadFlowLocation directly within
|
|
178
|
+
the codeFlow, rather than relying on threadFlowLocation.index to refer to an element
|
|
179
|
+
of the run.threadFlowLocations array. GitHub Advanced Security code scanning will not
|
|
180
|
+
display a result that uses such threadFlowLocations.
|
|
181
|
+
</summary>
|
|
182
|
+
</member>
|
|
183
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ProvideRequiredRegionProperties.Id">
|
|
184
|
+
<summary>
|
|
185
|
+
GH1003
|
|
186
|
+
</summary>
|
|
187
|
+
</member>
|
|
188
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ReviewArraysThatExceedConfigurableDefaults.Id">
|
|
189
|
+
<summary>
|
|
190
|
+
GH1004
|
|
191
|
+
</summary>
|
|
192
|
+
</member>
|
|
193
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.LocationsMustBeRelativeUrisOrFilePaths.Id">
|
|
194
|
+
<summary>
|
|
195
|
+
GH1005
|
|
196
|
+
</summary>
|
|
197
|
+
</member>
|
|
198
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ProvideCheckoutPath.Id">
|
|
199
|
+
<summary>
|
|
200
|
+
GH1006
|
|
201
|
+
</summary>
|
|
202
|
+
</member>
|
|
203
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ProvideFullyFormattedMessageStrings.Id">
|
|
204
|
+
<summary>
|
|
205
|
+
GH1007
|
|
206
|
+
</summary>
|
|
207
|
+
</member>
|
|
208
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.GhasReferenceFinalSchema.Id">
|
|
209
|
+
<summary>
|
|
210
|
+
GH1011
|
|
211
|
+
</summary>
|
|
212
|
+
</member>
|
|
213
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.GhProvideRequiredSarifLogProperties.Id">
|
|
214
|
+
<summary>
|
|
215
|
+
GH1013
|
|
216
|
+
</summary>
|
|
217
|
+
</member>
|
|
218
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.GhasProvideRequiredRunProperties.Id">
|
|
219
|
+
<summary>
|
|
220
|
+
GH1014
|
|
221
|
+
</summary>
|
|
222
|
+
</member>
|
|
223
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.GhasProvideRequiredResultProperties.Id">
|
|
224
|
+
<summary>
|
|
225
|
+
GH1015
|
|
226
|
+
</summary>
|
|
227
|
+
</member>
|
|
228
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.GhasProvideRequiredLocationProperties.Id">
|
|
229
|
+
<summary>
|
|
230
|
+
GH1016
|
|
231
|
+
</summary>
|
|
232
|
+
</member>
|
|
233
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.GhasProvideRequiredPhysicalLocationProperties.Id">
|
|
234
|
+
<summary>
|
|
235
|
+
GH1017
|
|
236
|
+
</summary>
|
|
237
|
+
</member>
|
|
238
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.GhasProvideToolDriver.Id">
|
|
239
|
+
<summary>
|
|
240
|
+
GH1018
|
|
241
|
+
</summary>
|
|
242
|
+
</member>
|
|
243
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.GhasProvideRequiredReportingDescriptorProperties.Id">
|
|
244
|
+
<summary>
|
|
245
|
+
GH2012
|
|
246
|
+
</summary>
|
|
247
|
+
</member>
|
|
248
|
+
<member name="T:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources">
|
|
249
|
+
<summary>
|
|
250
|
+
A strongly-typed resource class, for looking up localized strings, etc.
|
|
251
|
+
</summary>
|
|
252
|
+
</member>
|
|
253
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.ResourceManager">
|
|
254
|
+
<summary>
|
|
255
|
+
Returns the cached ResourceManager instance used by this class.
|
|
256
|
+
</summary>
|
|
257
|
+
</member>
|
|
258
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.Culture">
|
|
259
|
+
<summary>
|
|
260
|
+
Overrides the current thread's CurrentUICulture property for all
|
|
261
|
+
resource lookups using this strongly typed resource class.
|
|
262
|
+
</summary>
|
|
263
|
+
</member>
|
|
264
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.ADO1011_ReferenceFinalSchema_FullDescription_Text">
|
|
265
|
+
<summary>
|
|
266
|
+
Looks up a localized string similar to The '$schema' property must refer to the final version of the SARIF 2.1.0 schema. This enables IDEs to provide Intellisense for SARIF log files.
|
|
267
|
+
|
|
268
|
+
The SARIF standard was developed over several years and many intermediate versions of the schema were produced. Now that the standard is final, only the OASIS standard version of the schema is valid..
|
|
269
|
+
</summary>
|
|
270
|
+
</member>
|
|
271
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.ADO1013_ProvideRequiredSarifLogProperties_FullDescription_Text">
|
|
272
|
+
<summary>
|
|
273
|
+
Looks up a localized string similar to The root element of a SARIF log file is a SarifLog object. The properties of this element provide information about the log's schema version as well as an array of analysis runs. These properties are required by the ADO Advanced Security service.
|
|
274
|
+
|
|
275
|
+
Provide the '$schema' property, which must refer to the final version of the SARIF 2.1.0 schema. This enables IDEs to provide Intellisense for SARIF log files.
|
|
276
|
+
|
|
277
|
+
Provide the 'version' property, which must refer to the the final, OASIS standard version of the SA [rest of string was truncated]";.
|
|
278
|
+
</summary>
|
|
279
|
+
</member>
|
|
280
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.ADO1014_AdoProvideRequiredRunProperties_Error_MissingAutomationDetails_Text">
|
|
281
|
+
<summary>
|
|
282
|
+
Looks up a localized string similar to {0}: This 'run' object does not provide an 'automationDetails' property. This property is required by the {1} service..
|
|
283
|
+
</summary>
|
|
284
|
+
</member>
|
|
285
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.ADO1014_AdoProvideRequiredRunProperties_Error_MissingAutomationDetailsId_Text">
|
|
286
|
+
<summary>
|
|
287
|
+
Looks up a localized string similar to {0}: This 'run' object's 'automationDetails' object does not provide an 'id' value. This property is required by the {1} service..
|
|
288
|
+
</summary>
|
|
289
|
+
</member>
|
|
290
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.ADO1014_ProvideRequiredRunProperties_FullDescription_Text">
|
|
291
|
+
<summary>
|
|
292
|
+
Looks up a localized string similar to The Run object represents a single execution of the specified analysis tool.
|
|
293
|
+
|
|
294
|
+
Provide the 'tool' property, which contains metadata about the software that generated the static analysis results.
|
|
295
|
+
|
|
296
|
+
Provide the 'results' array, even if it is empty.
|
|
297
|
+
|
|
298
|
+
Provide the 'automationDetails' property. The automationDetails's 'id' property is required by the ADO Advanced Security service..
|
|
299
|
+
</summary>
|
|
300
|
+
</member>
|
|
301
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.ADO1015_ProvideRequiredResultProperties_Error_MissingRuleId_Text">
|
|
302
|
+
<summary>
|
|
303
|
+
Looks up a localized string similar to {0}: This 'result' object does not provide a 'ruleId' value. This property is required by the {1} service..
|
|
304
|
+
</summary>
|
|
305
|
+
</member>
|
|
306
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.ADO1015_ProvideRequiredResultProperties_FullDescription_Text">
|
|
307
|
+
<summary>
|
|
308
|
+
Looks up a localized string similar to The Result object represents an analysis finding and should provide details describing the nature of the problem along with its location in the scan target.
|
|
309
|
+
|
|
310
|
+
Provide the 'ruleId' property, which is the unique identifier of the analysis rule that was violated. This property is required by the ADO Advanced Security service.
|
|
311
|
+
|
|
312
|
+
Provide the 'message' property, which is a user-facing explanation of the result occurrence. The message's 'text' property is required by the ADO Advanced Security service.
|
|
313
|
+
|
|
314
|
+
Provide [rest of string was truncated]";.
|
|
315
|
+
</summary>
|
|
316
|
+
</member>
|
|
317
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.ADO1016_ProvideRequiredLocationProperties_FullDescription_Text">
|
|
318
|
+
<summary>
|
|
319
|
+
Looks up a localized string similar to The Location object is important for providing consumers with the location where the result occurred.
|
|
320
|
+
|
|
321
|
+
Provide the 'physicalLocation' property. This property is required by the ADO Advanced Security service..
|
|
322
|
+
</summary>
|
|
323
|
+
</member>
|
|
324
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.ADO1017_ProvideRequiredPhysicalLocationProperties_FullDescription_Text">
|
|
325
|
+
<summary>
|
|
326
|
+
Looks up a localized string similar to Provide the 'region' property, along with the appropriate region properties. This property is required by the ADO Advanced Security service.
|
|
327
|
+
|
|
328
|
+
Provide the 'artifactLocation' property. This property is required by the ADO Advanced Security service..
|
|
329
|
+
</summary>
|
|
330
|
+
</member>
|
|
331
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.ADO1018_ProvideRequiredToolProperties_Error_MissingDriverFullName_Text">
|
|
332
|
+
<summary>
|
|
333
|
+
Looks up a localized string similar to {0}: This 'driver' object does not provide a 'fullName' value. This property is required by the {1} service..
|
|
334
|
+
</summary>
|
|
335
|
+
</member>
|
|
336
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.ADO1018_ProvideRequiredToolProperties_FullDescription_Text">
|
|
337
|
+
<summary>
|
|
338
|
+
Looks up a localized string similar to Provide information that makes it easy to identify the name and version of your tool.
|
|
339
|
+
|
|
340
|
+
Provide the 'driver' property. This property is required by the ADO Advanced Security service.
|
|
341
|
+
|
|
342
|
+
Provide the driver's 'name' and 'fullName' properties.
|
|
343
|
+
|
|
344
|
+
Provide the driver's 'rules' array..
|
|
345
|
+
</summary>
|
|
346
|
+
</member>
|
|
347
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.ADO2012_ProvideRequiredReportingDescriptorProperties_FullDescription_Text">
|
|
348
|
+
<summary>
|
|
349
|
+
Looks up a localized string similar to Rule metadata should provide information that makes it easy to understand and fix the problem.
|
|
350
|
+
rule.id
|
|
351
|
+
|
|
352
|
+
Provide the 'id' property whose value is a stable identifier for the rule.
|
|
353
|
+
|
|
354
|
+
Provide the 'name' property, which contains a "friendly name" that helps users see at a glance the purpose of the rule. For uniformity of experience across all tools that produce SARIF, the friendly name should be a single Pascal-case identifier, for example, 'ProvideRuleFriendlyName'..
|
|
355
|
+
</summary>
|
|
356
|
+
</member>
|
|
357
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.ADO2012_ProvideRequiredResultProperties_Error_MissingName_Text">
|
|
358
|
+
<summary>
|
|
359
|
+
Looks up a localized string similar to {0}: This 'reportingDescriptor' object does not provide a 'name' value. This property is required by the {1} service..
|
|
360
|
+
</summary>
|
|
361
|
+
</member>
|
|
362
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.Base1011_ReferenceFinalSchema_Error_Default_Text">
|
|
363
|
+
<summary>
|
|
364
|
+
Looks up a localized string similar to {0}: The '$schema' property value '{2}' does not refer to the final version of the SARIF 2.1.0 schema. If you are using an earlier version of the SARIF format, consider upgrading your analysis tool to produce the final version. If this file does, in fact, conform to the final version of the schema, upgrade the tool to populate the '$schema' property with a URL that refers to the final version of the schema..
|
|
365
|
+
</summary>
|
|
366
|
+
</member>
|
|
367
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.Base1013_MaximumRunsCount_Note_Default_Text">
|
|
368
|
+
<summary>
|
|
369
|
+
Looks up a localized string similar to {0}: This 'sarifLog' object's 'runs' array contains {2} element(s), which exceeds the limit of {3} imposed by the {1} service..
|
|
370
|
+
</summary>
|
|
371
|
+
</member>
|
|
372
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.Base1013_ProvideSchema_Warning_Default_Text">
|
|
373
|
+
<summary>
|
|
374
|
+
Looks up a localized string similar to {0}: The SARIF log file does not contain a '$schema' property. Add a '$schema' property that refers to the final OASIS standard version of the SARIF 2.1.0 schema. This enables IDEs to provide Intellisense for SARIF log files..
|
|
375
|
+
</summary>
|
|
376
|
+
</member>
|
|
377
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.Base1013_ProvideSchemaVersion_Warning_Default_Text">
|
|
378
|
+
<summary>
|
|
379
|
+
Looks up a localized string similar to {0}: The SARIF log file does not specify 'version' property that refers to the final, OASIS standard version of the SARIF 2.1.0 schema. This enables IDEs to provide Intellisense for SARIF log files..
|
|
380
|
+
</summary>
|
|
381
|
+
</member>
|
|
382
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.Base1013_ReferenceFinalSchema_Error_Default_Text">
|
|
383
|
+
<summary>
|
|
384
|
+
Looks up a localized string similar to {0}: The '$schema' property value '{2}' does not refer to the final version of the SARIF 2.1.0 schema. If you are using an earlier version of the SARIF format, consider upgrading your analysis tool to produce the final version. If this file does in fact conform to the final version of the schema, upgrade the tool to populate the '$schema' property with a URL that refers to the final version of the schema..
|
|
385
|
+
</summary>
|
|
386
|
+
</member>
|
|
387
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.Base1013_SarifLogRunsArray_Note_Default_Text">
|
|
388
|
+
<summary>
|
|
389
|
+
Looks up a localized string similar to {0}: This 'sarifLog' object does not provide a 'runs' array, which is required by the {1} service..
|
|
390
|
+
</summary>
|
|
391
|
+
</member>
|
|
392
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.Base1014_ProvideRequiredRunProperties_Error_MissingResultsArray_Text">
|
|
393
|
+
<summary>
|
|
394
|
+
Looks up a localized string similar to {0}: This 'run' object does not provide a 'results' array property. This property is required by the {1} service..
|
|
395
|
+
</summary>
|
|
396
|
+
</member>
|
|
397
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.Base1014_ProvideRequiredRunProperties_Error_MissingTool_Text">
|
|
398
|
+
<summary>
|
|
399
|
+
Looks up a localized string similar to {0}: This 'run' object does not provide a 'tool' object. This property is required by the {1} service..
|
|
400
|
+
</summary>
|
|
401
|
+
</member>
|
|
402
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.Base1015_ProvideRequiredResultProperties_Error_EmptyLocationsArray_Text">
|
|
403
|
+
<summary>
|
|
404
|
+
Looks up a localized string similar to {0}: The 'locations' array on this 'result' object is empty. This property is required by the {1} service..
|
|
405
|
+
</summary>
|
|
406
|
+
</member>
|
|
407
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.Base1015_ProvideRequiredResultProperties_Error_MissingLocationsArray_Text">
|
|
408
|
+
<summary>
|
|
409
|
+
Looks up a localized string similar to {0}: This 'result' object does not provide a 'locations' array. This property is required by the {1} service..
|
|
410
|
+
</summary>
|
|
411
|
+
</member>
|
|
412
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.Base1015_ProvideRequiredResultProperties_Error_MissingMessage_Text">
|
|
413
|
+
<summary>
|
|
414
|
+
Looks up a localized string similar to {0}: This 'result' object does not provide a 'message' object. This property is required by the {1} service..
|
|
415
|
+
</summary>
|
|
416
|
+
</member>
|
|
417
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.Base1015_ProvideRequiredResultProperties_Error_MissingMessageText_Text">
|
|
418
|
+
<summary>
|
|
419
|
+
Looks up a localized string similar to {0}: The 'message' object on this 'result' object does not provide a 'text' property. This property is required by the {1} service..
|
|
420
|
+
</summary>
|
|
421
|
+
</member>
|
|
422
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.Base1015_ProvideRequiredResultProperties_Error_MissingPartialFingerprints_Text">
|
|
423
|
+
<summary>
|
|
424
|
+
Looks up a localized string similar to {0}: This 'result' object does not provide a 'partialFingerprints' dictionary. This property is required by the {1} service..
|
|
425
|
+
</summary>
|
|
426
|
+
</member>
|
|
427
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.Base1016_ProvideRequiredLocationProperties_Error_MissingPhysicalLocation_Text">
|
|
428
|
+
<summary>
|
|
429
|
+
Looks up a localized string similar to {0}: This 'location' object does not provide a 'physicalLocation' object. This property is required by the {1} service..
|
|
430
|
+
</summary>
|
|
431
|
+
</member>
|
|
432
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.Base1017_ProvideRequiredPhysicalLocationProperties_Error_MissingArtifactLocation_Text">
|
|
433
|
+
<summary>
|
|
434
|
+
Looks up a localized string similar to {0}: This 'physicalLocation' object does not provide an 'artifactLocation' object. This property is required by the {1} service..
|
|
435
|
+
</summary>
|
|
436
|
+
</member>
|
|
437
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.Base1017_ProvideRequiredPhysicalLocationProperties_Error_MissingRegion_Text">
|
|
438
|
+
<summary>
|
|
439
|
+
Looks up a localized string similar to {0}: The 'physicalLocation' object does not provide a 'region' object. This property is required by the {1} service..
|
|
440
|
+
</summary>
|
|
441
|
+
</member>
|
|
442
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.Base1018_ProvideRequiredToolProperties_Error_MissingDriver_Text">
|
|
443
|
+
<summary>
|
|
444
|
+
Looks up a localized string similar to {0}: This 'tool' object does not provide a 'driver' object. This property is required by the {1} service..
|
|
445
|
+
</summary>
|
|
446
|
+
</member>
|
|
447
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.Base1018_ProvideRequiredToolProperties_Error_MissingDriverName_Text">
|
|
448
|
+
<summary>
|
|
449
|
+
Looks up a localized string similar to {0}: The 'driver' object in this tool does not provide a 'name' value. This property is required by the {1} service..
|
|
450
|
+
</summary>
|
|
451
|
+
</member>
|
|
452
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.Base1018_ProvideRequiredToolProperties_Error_MissingDriverRules_Text">
|
|
453
|
+
<summary>
|
|
454
|
+
Looks up a localized string similar to {0}: The 'driver' object in this tool does not provide a 'rules' array. This property is required by the {1} service..
|
|
455
|
+
</summary>
|
|
456
|
+
</member>
|
|
457
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.Base2012_ProvideRequiredReportingDescriptorProperties_Error_MissingIdProperty_Text">
|
|
458
|
+
<summary>
|
|
459
|
+
Looks up a localized string similar to {0}: This 'reportingDescriptor' object does not provide an 'Id' value. This property is required by the {1} service..
|
|
460
|
+
</summary>
|
|
461
|
+
</member>
|
|
462
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH1001_ProvideRequiredLocationProperties_Error_EmptyLocationsArray_Text">
|
|
463
|
+
<summary>
|
|
464
|
+
Looks up a localized string similar to {0}: The 'locations' array is empty. GitHub Advanced Security code scanning will not display a result unless it provides a location that specifies the URI of the artifact that contains the result..
|
|
465
|
+
</summary>
|
|
466
|
+
</member>
|
|
467
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH1001_ProvideRequiredLocationProperties_Error_MissingLocationProperty_Text">
|
|
468
|
+
<summary>
|
|
469
|
+
Looks up a localized string similar to {0}: '{2}' is absent. GitHub Advanced Security code scanning will not display a result location that does not provide the URI of the artifact that contains the result..
|
|
470
|
+
</summary>
|
|
471
|
+
</member>
|
|
472
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH1001_ProvideRequiredLocationProperties_Error_NoLocationsArray_Text">
|
|
473
|
+
<summary>
|
|
474
|
+
Looks up a localized string similar to {0}: The 'locations' property is absent. GitHub Advanced Security code scanning will not display a result unless it provides a location that specifies the URI of the artifact that contains the result..
|
|
475
|
+
</summary>
|
|
476
|
+
</member>
|
|
477
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH1001_ProvideRequiredLocationProperties_FullDescription_Text">
|
|
478
|
+
<summary>
|
|
479
|
+
Looks up a localized string similar to Each result location must provide the property 'physicalLocation.artifactLocation.uri'. GitHub Advanced Security code scanning will not display a result whose location does not provide the URI of the artifact that contains the result..
|
|
480
|
+
</summary>
|
|
481
|
+
</member>
|
|
482
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH1002_InlineThreadFlowLocations_Error_Default_Text">
|
|
483
|
+
<summary>
|
|
484
|
+
Looks up a localized string similar to {0}: This 'threadFlowLocation' uses its 'index' property to refer to information in the 'run.threadFlowLocations' array. GitHub Advanced Security code scanning will not display a result that includes such a 'threadFlowLocation'..
|
|
485
|
+
</summary>
|
|
486
|
+
</member>
|
|
487
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH1002_InlineThreadFlowLocations_FullDescription_Text">
|
|
488
|
+
<summary>
|
|
489
|
+
Looks up a localized string similar to Results that include codeFlows must specify each threadFlowLocation directly within the codeFlow, rather than relying on threadFlowLocation.index to refer to an element of the run.threadFlowLocations array. GitHub Advanced Security code scanning will not display a result that uses such threadFlowLocations..
|
|
490
|
+
</summary>
|
|
491
|
+
</member>
|
|
492
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH1003_ProvideRequiredRegionProperties_Error_MissingRegion_Text">
|
|
493
|
+
<summary>
|
|
494
|
+
Looks up a localized string similar to {0}: The 'region' property is absent. GitHub Advanced Security code scanning can display the correct location only for results that provide a 'region' object with line and optional column information. At minimum, 'region.startLine' is required. 'region' can also provide 'startColumn', 'endLine', and 'endColumn', although all of those have reasonable defaults..
|
|
495
|
+
</summary>
|
|
496
|
+
</member>
|
|
497
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH1003_ProvideRequiredRegionProperties_Error_MissingRegionProperty_Text">
|
|
498
|
+
<summary>
|
|
499
|
+
Looks up a localized string similar to {0}: The 'startLine' property is absent. GitHub Advanced Security code scanning can display the correct location only for results that provide a 'region' object with line and optional column information. At minimum, 'region.startLine' is required. 'region' can also provide 'startColumn', 'endLine', and 'endColumn', although all of those have reasonable defaults..
|
|
500
|
+
</summary>
|
|
501
|
+
</member>
|
|
502
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH1003_ProvideRequiredRegionProperties_FullDescription_Text">
|
|
503
|
+
<summary>
|
|
504
|
+
Looks up a localized string similar to Every result must provide a 'region' that specifies its location with line and optional column information. GitHub Advanced Security code scanning can display the correct location only for results that provide this information. At minimum, 'region.startLine' is required. 'region' can also provide 'startColumn', 'endLine', and 'endColumn', although all of those have reasonable defaults..
|
|
505
|
+
</summary>
|
|
506
|
+
</member>
|
|
507
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH1004_ReviewArraysThatExceedConfigurableDefaults_Error_Default_Text">
|
|
508
|
+
<summary>
|
|
509
|
+
Looks up a localized string similar to {0}: This array contains {1} element(s), which exceeds the default limit of {2} imposed by GitHub Advanced Security code scanning. GitHub will only display information up to that limit. You can provide a configuration file at the root of your repository to specify a higher limit..
|
|
510
|
+
</summary>
|
|
511
|
+
</member>
|
|
512
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH1004_ReviewArraysThatExceedConfigurableDefaults_FullDescription_Text">
|
|
513
|
+
<summary>
|
|
514
|
+
Looks up a localized string similar to GitHub Advanced Security code scanning limits the amount of information it displays. There are limits on the number of runs per log file, rules per run, results per run, locations per result, code flows per result, and steps per code flow. You can provide a configuration file at the root of your repository to specify higher limits..
|
|
515
|
+
</summary>
|
|
516
|
+
</member>
|
|
517
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH1005_LocationsMustBeRelativeUrisOrFilePaths_Error_Default_Text">
|
|
518
|
+
<summary>
|
|
519
|
+
Looks up a localized string similar to {0}: '{1}' is not a file path. GitHub Advanced Security code scanning only displays results whose locations are specified by file paths, either as relative URIs or as absolute URIs that use the 'file' scheme..
|
|
520
|
+
</summary>
|
|
521
|
+
</member>
|
|
522
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH1005_LocationsMustBeRelativeUrisOrFilePaths_FullDescription_Text">
|
|
523
|
+
<summary>
|
|
524
|
+
Looks up a localized string similar to GitHub Advanced Security code scanning only displays results whose locations are specified by file paths, either as relative URIs or as absolute URIs that use the 'file' scheme..
|
|
525
|
+
</summary>
|
|
526
|
+
</member>
|
|
527
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH1006_ProvideCheckoutPath_Error_Default_Text">
|
|
528
|
+
<summary>
|
|
529
|
+
Looks up a localized string similar to {0}: This result location is expressed as an absolute 'file' URI. GitHub Advanced Security code scanning will reject this file because it cannot determine the location of the repository root (which it refers to as the "checkout path"). Either express result locations as relative URI references with respect to the checkout path, place the checkout path in 'invocations[].workingDirectory', or place the checkout path in a configuration file at the root of the repository..
|
|
530
|
+
</summary>
|
|
531
|
+
</member>
|
|
532
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH1006_ProvideCheckoutPath_FullDescription_Text">
|
|
533
|
+
<summary>
|
|
534
|
+
Looks up a localized string similar to GitHub Advanced Security code scanning will reject a SARIF file that expresses result locations as absolute 'file' scheme URIs unless GitHub can determine the URI of the repository root (which GitHub refers to as the "checkout path"). There are three ways to address this issue.
|
|
535
|
+
|
|
536
|
+
1. Recommended: Express all result locations as relative URI references with respect to the checkout path.
|
|
537
|
+
|
|
538
|
+
1. Place the checkout path in 'invocations[].workingDirectory'. The SARIF specification defines that property to be the [rest of string was truncated]";.
|
|
539
|
+
</summary>
|
|
540
|
+
</member>
|
|
541
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH1007_ProvideFullyFormattedMessageStrings_Error_Default_Text">
|
|
542
|
+
<summary>
|
|
543
|
+
Looks up a localized string similar to {0}: The 'text' property of this result message is absent. GitHub Advanced Security code scanning will reject this file because it does not support the argumented message now. Try to provide fully formatted text in 'message.text' property..
|
|
544
|
+
</summary>
|
|
545
|
+
</member>
|
|
546
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH1007_ProvideFullyFormattedMessageStrings_FullDescription_Text">
|
|
547
|
+
<summary>
|
|
548
|
+
Looks up a localized string similar to GitHub Advanced Security code scanning will reject a SARIF file that express result messages with 'message.id' and 'message.arguments' but without the 'message.text' property since the arugmented message format is not supported yet. Please provide fully formatted text in 'message.text' property..
|
|
549
|
+
</summary>
|
|
550
|
+
</member>
|
|
551
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH1011_ReferenceFinalSchema">
|
|
552
|
+
<summary>
|
|
553
|
+
Looks up a localized string similar to The '$schema' property must refer to the final version of the SARIF 2.1.0 schema. This enables IDEs to provide Intellisense for SARIF log files.
|
|
554
|
+
|
|
555
|
+
The SARIF standard was developed over several years and many intermediate versions of the schema were produced. Now that the standard is final, only the OASIS standard version of the schema is valid..
|
|
556
|
+
</summary>
|
|
557
|
+
</member>
|
|
558
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH1013_ProvideRequiredSarifLogProperties_FullDescription_Text">
|
|
559
|
+
<summary>
|
|
560
|
+
Looks up a localized string similar to The root element of a SARIF log file is a SarifLog object. The properties of this element provide information about the log's schema version as well as an array of analysis runs. These properties are required by the ADO Advanced Security service.
|
|
561
|
+
|
|
562
|
+
Provide the '$schema' property, which must refer to the final version of the SARIF 2.1.0 schema. This enables IDEs to provide Intellisense for SARIF log files.
|
|
563
|
+
|
|
564
|
+
Provide the 'version' property, which must refer to the the final, OASIS standard version of the SA [rest of string was truncated]";.
|
|
565
|
+
</summary>
|
|
566
|
+
</member>
|
|
567
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH1014_ProvideRequiredRunProperties_FullDescription_Text">
|
|
568
|
+
<summary>
|
|
569
|
+
Looks up a localized string similar to The Run object represents a single execution of the specified analysis tool.
|
|
570
|
+
|
|
571
|
+
Provide the 'tool' property, which contains metadata about the software that generated the static analysis results.
|
|
572
|
+
|
|
573
|
+
Provide the 'results' array, even if it is empty..
|
|
574
|
+
</summary>
|
|
575
|
+
</member>
|
|
576
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH1015_ProvideRequiredResultProperties_FullDescription_Text">
|
|
577
|
+
<summary>
|
|
578
|
+
Looks up a localized string similar to The Result object represents an analysis finding and should provide details describing the nature of the problem along with its location in the scan target.
|
|
579
|
+
|
|
580
|
+
Provide the 'message' property, which is a user-facing explanation of the result occurrence. The message's 'text' property is required by the GitHub Advanced Security service.
|
|
581
|
+
|
|
582
|
+
Provide the 'locations' array, which must contain at least one location object.
|
|
583
|
+
|
|
584
|
+
Provide the 'partialFingerprints' dictionary. This property is required by the GitHub Adva [rest of string was truncated]";.
|
|
585
|
+
</summary>
|
|
586
|
+
</member>
|
|
587
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH1016_ProvideRequiredLocationProperties_FullDescription_Text">
|
|
588
|
+
<summary>
|
|
589
|
+
Looks up a localized string similar to The Location object is important for providing consumers with the location where the result occurred.
|
|
590
|
+
|
|
591
|
+
Provide the 'physicalLocation' property. This property is required by the GitHub Advanced Security service..
|
|
592
|
+
</summary>
|
|
593
|
+
</member>
|
|
594
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH1017_ProvideRequiredPhysicalLocationProperties_Error_MissingArtifactLocationUri_Text">
|
|
595
|
+
<summary>
|
|
596
|
+
Looks up a localized string similar to {0}: The 'artifactLocation' object on this 'physicalLocation' object does not provide a 'uri' object. This property is required by the {1} service..
|
|
597
|
+
</summary>
|
|
598
|
+
</member>
|
|
599
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH1017_ProvideRequiredPhysicalLocationProperties_FullDescription_Text">
|
|
600
|
+
<summary>
|
|
601
|
+
Looks up a localized string similar to Provide the 'region' property, along with the appropriate region properties. This property is required by the GitHub Advanced Security service.
|
|
602
|
+
|
|
603
|
+
Provide the 'artifactLocation' property. This property is required by the GitHub Advanced Security service..
|
|
604
|
+
</summary>
|
|
605
|
+
</member>
|
|
606
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH1018_ProvideRequiredToolProperties_FullDescription_Text">
|
|
607
|
+
<summary>
|
|
608
|
+
Looks up a localized string similar to Provide information that makes it easy to identify the name and version of your tool.
|
|
609
|
+
|
|
610
|
+
Provide the 'driver' property. This property is required by the GitHub Advanced Security service.
|
|
611
|
+
|
|
612
|
+
Provide the driver's 'name' property.
|
|
613
|
+
|
|
614
|
+
Provide the driver's 'rules' array..
|
|
615
|
+
</summary>
|
|
616
|
+
</member>
|
|
617
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH2012_ProvideRequiredReportingDescriptorProperties_Error_MissingFullDescription_Text">
|
|
618
|
+
<summary>
|
|
619
|
+
Looks up a localized string similar to {0}: This 'reportingDescriptor' object does not provide a 'fullDescription' value. This property is required by the {1} service..
|
|
620
|
+
</summary>
|
|
621
|
+
</member>
|
|
622
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH2012_ProvideRequiredReportingDescriptorProperties_Error_MissingHelp_Text">
|
|
623
|
+
<summary>
|
|
624
|
+
Looks up a localized string similar to {0}: This 'reportingDescriptor' object does not provide a 'help' object. This property is required by the {1} service..
|
|
625
|
+
</summary>
|
|
626
|
+
</member>
|
|
627
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH2012_ProvideRequiredReportingDescriptorProperties_Error_MissingHelpText_Text">
|
|
628
|
+
<summary>
|
|
629
|
+
Looks up a localized string similar to {0}: This 'help' object does not provide a 'text' value. This property is required by the {1} service..
|
|
630
|
+
</summary>
|
|
631
|
+
</member>
|
|
632
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH2012_ProvideRequiredReportingDescriptorProperties_Error_MissingShortDescription_Text">
|
|
633
|
+
<summary>
|
|
634
|
+
Looks up a localized string similar to {0}: This 'reportingDescriptor' object does not provide a 'shortDescription' value. This property is required by the {1} service..
|
|
635
|
+
</summary>
|
|
636
|
+
</member>
|
|
637
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH2012_ProvideRequiredReportingDescriptorProperties_FullDescription_Text">
|
|
638
|
+
<summary>
|
|
639
|
+
Looks up a localized string similar to Rule metadata should provide information that makes it easy to understand and fix the problem.
|
|
640
|
+
|
|
641
|
+
Provide the 'id' property whose value is a stable identifier for the rule.
|
|
642
|
+
|
|
643
|
+
Provide the 'shortDescription' and 'fullDescription' properties.
|
|
644
|
+
|
|
645
|
+
Provide the 'help' property and populate the 'text' property with information about the rule..
|
|
646
|
+
</summary>
|
|
647
|
+
</member>
|
|
648
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1001_RuleIdentifiersMustBeValid_FullDescription_Text">
|
|
649
|
+
<summary>
|
|
650
|
+
Looks up a localized string similar to The two identity-related properties of a SARIF rule must be consistent. The required 'id' property must be a "stable, opaque identifier" (the SARIF specification ([3.49.3](https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317839)) explains the reasons for this). The optional 'name' property ([3.49.7](https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317843)) is an identifier that is understandable to an end user. Therefore if both 'id' and 'name' are pre [rest of string was truncated]";.
|
|
651
|
+
</summary>
|
|
652
|
+
</member>
|
|
653
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1001_RuleIdentifiersMustBeValid_Warning_Default_Text">
|
|
654
|
+
<summary>
|
|
655
|
+
Looks up a localized string similar to {0}: The rule '{1}' has a 'name' property that is identical to its 'id' property. The required 'id' property must be a "stable, opaque identifier" (the SARIF specification ([3.49.3](https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317839)) explains the reasons for this). The optional 'name' property ([3.49.7](https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317843)) is an identifier that is understandable to an end user. Therefore if both 'id' and 'nam [rest of string was truncated]";.
|
|
656
|
+
</summary>
|
|
657
|
+
</member>
|
|
658
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1002_UrisMustBeValid_Error_FileUrisMustNotIncludeDotDotSegments_Text">
|
|
659
|
+
<summary>
|
|
660
|
+
Looks up a localized string similar to {0}: The 'file' URI '{1}' contains a '..' segment. This is dangerous because if symbolic links are present, '..' might have different meanings on the machine that produced the log file and the machine where an end user or a tool consumes it..
|
|
661
|
+
</summary>
|
|
662
|
+
</member>
|
|
663
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1002_UrisMustBeValid_Error_UrisMustConformToRfc3986_Text">
|
|
664
|
+
<summary>
|
|
665
|
+
Looks up a localized string similar to {0}: The string '{1}' is not a valid URI reference. URIs must conform to [RFC 3986](https://tools.ietf.org/html/rfc3986)..
|
|
666
|
+
</summary>
|
|
667
|
+
</member>
|
|
668
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1002_UrisMustBeValid_FullDescription_Text">
|
|
669
|
+
<summary>
|
|
670
|
+
Looks up a localized string similar to Specify a valid URI reference for every URI-valued property. URIs must conform to [RFC 3986](https://tools.ietf.org/html/rfc3986). In addition, 'file' URIs must not include '..' segments. If symbolic links are present, '..' might have different meanings on the machine that produced the log file and the machine where an end user or a tool consumes it..
|
|
671
|
+
</summary>
|
|
672
|
+
</member>
|
|
673
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1004_ExpressUriBaseIdsCorrectly_Error_RelativeReferenceMustNotBeginWithSlash_Text">
|
|
674
|
+
<summary>
|
|
675
|
+
Looks up a localized string similar to The relative reference '{0}' begins with a slash, which will prevent it from combining properly with the absolute URI specified by a 'uriBaseId'..
|
|
676
|
+
</summary>
|
|
677
|
+
</member>
|
|
678
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1004_ExpressUriBaseIdsCorrectly_Error_TopLevelUriBaseIdMustBeAbsolute_Text">
|
|
679
|
+
<summary>
|
|
680
|
+
Looks up a localized string similar to {0}: The '{1}' element of 'originalUriBaseIds' has no 'uriBaseId' property, but its 'uri' property '{2}' is not an absolute URI. According to the SARIF specification, every such "top-level" entry in 'originalUriBaseIds' must specify an absolute URI, because the purpose of 'originalUriBaseIds' is to enable the resolution of relative references to absolute URIs..
|
|
681
|
+
</summary>
|
|
682
|
+
</member>
|
|
683
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1004_ExpressUriBaseIdsCorrectly_Error_UriBaseIdRequiresRelativeUri_Text">
|
|
684
|
+
<summary>
|
|
685
|
+
Looks up a localized string similar to {0}: This 'artifactLocation' object has a 'uriBaseId' property '{1}', but its 'uri' property '{2}' is an absolute URI. Since the purpose of 'uriBaseId' is to resolve a relative reference to an absolute URI, it is not allowed when the 'uri' property is already an absolute URI..
|
|
686
|
+
</summary>
|
|
687
|
+
</member>
|
|
688
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1004_ExpressUriBaseIdsCorrectly_Error_UriBaseIdValueMustEndWithSlash_Text">
|
|
689
|
+
<summary>
|
|
690
|
+
Looks up a localized string similar to {0}: The '{1}' element of 'originalUriBaseIds' has a 'uri' property '{2}' that does not end with a slash. The trailing slash is required to minimize the likelihood of an error when concatenating URI segments together..
|
|
691
|
+
</summary>
|
|
692
|
+
</member>
|
|
693
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1004_ExpressUriBaseIdsCorrectly_Error_UriBaseIdValueMustNotContainDotDotSegment_Text">
|
|
694
|
+
<summary>
|
|
695
|
+
Looks up a localized string similar to {0}: The '{1}' element of 'originalUriBaseIds' has a 'uri' property '{2}' that contains a '..' segment. This is dangerous because if symbolic links are present, '..' might have different meanings on the machine that produced the log file and the machine where an end user or a tool consumes it..
|
|
696
|
+
</summary>
|
|
697
|
+
</member>
|
|
698
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1004_ExpressUriBaseIdsCorrectly_Error_UriBaseIdValueMustNotContainQueryOrFragment_Text">
|
|
699
|
+
<summary>
|
|
700
|
+
Looks up a localized string similar to {0}: The '{1}' element of 'originalUriBaseIds' has a 'uri' property '{2}' that contains a query or a fragment. This is not valid because the purpose of the 'uriBaseId' property is to help resolve a relative reference to an absolute URI by concatenating the relative reference to the absolute base URI. This won't work if the base URI contains a query or a fragment..
|
|
701
|
+
</summary>
|
|
702
|
+
</member>
|
|
703
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1004_ExpressUriBaseIdsCorrectly_FullDescription_Text">
|
|
704
|
+
<summary>
|
|
705
|
+
Looks up a localized string similar to When using the 'uriBaseId' property, obey the requirements in the SARIF specification [3.4.4](https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317431) that enable it to fulfill its purpose of resolving relative references to absolute locations. In particular: If an 'artifactLocation' object has a 'uriBaseId' property, its 'uri' property must be a relative reference, because if 'uri' is an absolute URI then 'uriBaseId' serves no purpose. Every URI reference in 'originalUriBaseIds' [rest of string was truncated]";.
|
|
706
|
+
</summary>
|
|
707
|
+
</member>
|
|
708
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1005_UriMustBeAbsolute_Error_Default_Text">
|
|
709
|
+
<summary>
|
|
710
|
+
Looks up a localized string similar to {0}: The value of this property is required to be an absolute URI, but '{1}' is a relative URI reference..
|
|
711
|
+
</summary>
|
|
712
|
+
</member>
|
|
713
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1005_UriMustBeAbsolute_FullDescription_Text">
|
|
714
|
+
<summary>
|
|
715
|
+
Looks up a localized string similar to Certain URIs are required to be absolute. For the most part, these are URIs that refer to http addresses, such as work items or rule help topics..
|
|
716
|
+
</summary>
|
|
717
|
+
</member>
|
|
718
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1006_InvocationPropertiesMustBeConsistent_Error_EndTimeMustNotPrecedeStartTime_Text">
|
|
719
|
+
<summary>
|
|
720
|
+
Looks up a localized string similar to {0}: The 'endTimeUtc' value '{1}' precedes the 'startTimeUtc' value '{2}'. The properties of an 'invocation' object must be internally consistent..
|
|
721
|
+
</summary>
|
|
722
|
+
</member>
|
|
723
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1006_InvocationPropertiesMustBeConsistent_FullDescription_Text">
|
|
724
|
+
<summary>
|
|
725
|
+
Looks up a localized string similar to The properties of an 'invocation' object must be consistent. If the 'invocation' object specifies both 'startTimeUtc' and 'endTimeUtc', then 'endTimeUtc' must not precede 'startTimeUtc'. To allow for the possibility that the duration of the run is less than the resolution of the string representation of the time, the start time and the end time may be equal..
|
|
726
|
+
</summary>
|
|
727
|
+
</member>
|
|
728
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1007_RegionPropertiesMustBeConsistent_Error_EndColumnMustNotPrecedeStartColumn_Text">
|
|
729
|
+
<summary>
|
|
730
|
+
Looks up a localized string similar to {0}: In this 'region' object, the 'endColumn' property '{1}' is less than the 'startColumn' property '{2}'. The properties of a 'region' object must be internally consistent..
|
|
731
|
+
</summary>
|
|
732
|
+
</member>
|
|
733
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1007_RegionPropertiesMustBeConsistent_Error_EndLineMustNotPrecedeStartLine_Text">
|
|
734
|
+
<summary>
|
|
735
|
+
Looks up a localized string similar to {0}: In this 'region' object, the 'endLine' property '{1}' is less than the 'startLine' property '{2}'. The properties of a 'region' object must be internally consistent..
|
|
736
|
+
</summary>
|
|
737
|
+
</member>
|
|
738
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1007_RegionPropertiesMustBeConsistent_Error_RegionStartPropertyMustBePresent_Text">
|
|
739
|
+
<summary>
|
|
740
|
+
Looks up a localized string similar to {0}: This 'region' object does not specify 'startLine', 'charOffset', or 'byteOffset'. As a result, it is impossible to determine whether this 'region' object describes a line/column text region, a character offset/length text region, or a binary region..
|
|
741
|
+
</summary>
|
|
742
|
+
</member>
|
|
743
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1007_RegionPropertiesMustBeConsistent_FullDescription_Text">
|
|
744
|
+
<summary>
|
|
745
|
+
Looks up a localized string similar to The properties of a 'region' object must be consistent. SARIF can specify a 'region' (a contiguous portion of a file) in a variety of ways: with line and column numbers, with a character offset and count, or with a byte offset and count. The specification states certain constraints on these properties, both within each property group (for example, the start line cannot be greater than end line) and between the groups (for example, if more than one group is present, they must independently specify the same p [rest of string was truncated]";.
|
|
746
|
+
</summary>
|
|
747
|
+
</member>
|
|
748
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1008_PhysicalLocationPropertiesMustBeConsistent_Error_ContextRegionMustBeProperSupersetOfRegion_Text">
|
|
749
|
+
<summary>
|
|
750
|
+
Looks up a localized string similar to {0}: This 'physicalLocation' object contains both a 'region' and a 'contextRegion' property, but 'contextRegion' is not a proper superset of 'region'. This is invalid because the purpose of 'contextRegion' is to provide a viewing context around the 'region' which is the location of the result. It's possible that the tool reversed 'region' and 'contextRegion'. If 'region' and 'contextRegion' are identical, the tool must omit 'contextRegion'..
|
|
751
|
+
</summary>
|
|
752
|
+
</member>
|
|
753
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1008_PhysicalLocationPropertiesMustBeConsistent_Error_ContextRegionRequiresRegion_Text">
|
|
754
|
+
<summary>
|
|
755
|
+
Looks up a localized string similar to {0}: This 'physicalLocation' object contains a 'contextRegion' property, but it does not contain a 'region' property. This is invalid because the purpose of 'contextRegion' is to provide a viewing context around the 'region' which is the location of the result. If a tool associates only one region with a result, it must populate 'region', not 'contextRegion'..
|
|
756
|
+
</summary>
|
|
757
|
+
</member>
|
|
758
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1008_PhysicalLocationPropertiesMustBeConsistent_FullDescription_Text">
|
|
759
|
+
<summary>
|
|
760
|
+
Looks up a localized string similar to Ensure consistency among the properties of a 'physicalLocation' object. A SARIF 'physicalLocation' object has two related properties 'region' and 'contextRegion'. If 'contextRegion' is present, then 'region' must also be present, and 'contextRegion' must be a "proper superset" of 'region'. That is, 'contextRegion' must completely contain 'region', and it must be larger than 'region'. To understand why this is so we must understand the roles of the 'region' and 'contextRegion' properties. 'region' allows bot [rest of string was truncated]";.
|
|
761
|
+
</summary>
|
|
762
|
+
</member>
|
|
763
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1009_IndexPropertiesMustBeConsistentWithArrays_Error_TargetArrayMustBeLongEnough_Text">
|
|
764
|
+
<summary>
|
|
765
|
+
Looks up a localized string similar to {0}: This '{1}' object contains a property '{2}' with value {3}, but '{4}' has fewer than {5} elements. An index-valued properties must be valid for the array that it refers to..
|
|
766
|
+
</summary>
|
|
767
|
+
</member>
|
|
768
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1009_IndexPropertiesMustBeConsistentWithArrays_Error_TargetArrayMustExist_Text">
|
|
769
|
+
<summary>
|
|
770
|
+
Looks up a localized string similar to {0}: This '{1}' object contains a property '{2}' with value {3}, but '{4}' does not exist. An index-valued property always refers to an array, so the array must be present..
|
|
771
|
+
</summary>
|
|
772
|
+
</member>
|
|
773
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1009_IndexPropertiesMustBeConsistentWithArrays_FullDescription_Text">
|
|
774
|
+
<summary>
|
|
775
|
+
Looks up a localized string similar to If an object contains a property that is used as an array index (an "index-valued property"), then that array must be present and must contain at least "index + 1" elements..
|
|
776
|
+
</summary>
|
|
777
|
+
</member>
|
|
778
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1010_RuleIdMustBeConsistent_Error_ResultMustSpecifyRuleId_Text">
|
|
779
|
+
<summary>
|
|
780
|
+
Looks up a localized string similar to {0}: This result contains neither of the properties 'ruleId' or 'rule.id'. The SARIF specification ([§3.27.5](https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317643)) requires at least one of these properties to be present..
|
|
781
|
+
</summary>
|
|
782
|
+
</member>
|
|
783
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1010_RuleIdMustBeConsistent_Error_ResultRuleIdMustBeConsistent_Text">
|
|
784
|
+
<summary>
|
|
785
|
+
Looks up a localized string similar to {0}: This result contains both the 'ruleId' property '{1}' and the 'rule.id' property '{2}', but they are not equal. The SARIF specification ([§3.27.5](https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317643)) requires that if both of these properties are present, they must be equal..
|
|
786
|
+
</summary>
|
|
787
|
+
</member>
|
|
788
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1010_RuleIdMustBeConsistent_FullDescription_Text">
|
|
789
|
+
<summary>
|
|
790
|
+
Looks up a localized string similar to Every result must contain at least one of the properties 'ruleId' and 'rule.id'. If both are present, they must be equal. See the SARIF specification ([§3.27.5](https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317643))..
|
|
791
|
+
</summary>
|
|
792
|
+
</member>
|
|
793
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1011_ReferenceFinalSchema_Error_Default_Text">
|
|
794
|
+
<summary>
|
|
795
|
+
Looks up a localized string similar to {0}: The '$schema' property value '{1}' does not refer to the final version of the SARIF 2.1.0 schema. If you are using an earlier version of the SARIF format, consider upgrading your analysis tool to produce the final version. If this file does in fact conform to the final version of the schema, upgrade the tool to populate the '$schema' property with a URL that refers to the final version of the schema..
|
|
796
|
+
</summary>
|
|
797
|
+
</member>
|
|
798
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1011_ReferenceFinalSchema_FullDescription_Text">
|
|
799
|
+
<summary>
|
|
800
|
+
Looks up a localized string similar to The '$schema' property must refer to the final version of the SARIF 2.1.0 schema. This enables IDEs to provide Intellisense for SARIF log files.
|
|
801
|
+
|
|
802
|
+
The SARIF standard was developed over several years, and many intermediate versions of the schema were produced. Now that the standard is final, only the OASIS standard version of the schema is valid..
|
|
803
|
+
</summary>
|
|
804
|
+
</member>
|
|
805
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1012_MessageArgumentsMustBeConsistentWithRule_Error_MessageIdMustExist_Text">
|
|
806
|
+
<summary>
|
|
807
|
+
Looks up a localized string similar to {0}: This message object refers to the message with id '{1}' in rule '{2}', but that rule does not define a message with that id. When a tool creates a result message that uses the 'id' property, it must ensure that the specified rule actually has a message with that id..
|
|
808
|
+
</summary>
|
|
809
|
+
</member>
|
|
810
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1012_MessageArgumentsMustBeConsistentWithRule_Error_SupplyEnoughMessageArguments_Text">
|
|
811
|
+
<summary>
|
|
812
|
+
Looks up a localized string similar to {0}: The message with id '{1}' in rule '{2}' requires '{3}' arguments, but the 'arguments' array in this message object has only '{4}' element(s). When a tool creates a result message that use the 'id' and 'arguments' properties, it must ensure that the 'arguments' array has enough elements to provide values for every replacement sequence in the message specified by 'id'. For example, if the highest numbered replacement sequence in the specified message string is '{{3}}', then the 'arguments' array must con [rest of string was truncated]";.
|
|
813
|
+
</summary>
|
|
814
|
+
</member>
|
|
815
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF1012_MessageArgumentsMustBeConsistentWithRule_FullDescription_Text">
|
|
816
|
+
<summary>
|
|
817
|
+
Looks up a localized string similar to The properties of a result's 'message' property must be consistent with the properties of the rule that the result refers to.
|
|
818
|
+
|
|
819
|
+
When a result's 'message' object uses the 'id' and 'arguments' properties (which, by the way, is recommended: see SARIF2002.ProvideMessageArguments), it must ensure that the rule actually defines a message string with that id, and that 'arguments' array has enough elements to provide values for every replacement sequence in the message specified by 'id'. For example, if the highes [rest of string was truncated]";.
|
|
820
|
+
</summary>
|
|
821
|
+
</member>
|
|
822
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2001_TerminateMessagesWithPeriod_FullDescription_Text">
|
|
823
|
+
<summary>
|
|
824
|
+
Looks up a localized string similar to Express plain text result messages as complete sentences and end each sentence with a period. This guidance does not apply to Markdown messages, which might include formatting that makes the punctuation unnecessary.
|
|
825
|
+
|
|
826
|
+
This is part of a set of authoring practices that make your rule messages more readable, understandable, and actionable. See also `SARIF2014.ProvideDynamicMessageContent` and `SARIF2015.EnquoteDynamicMessageContent`..
|
|
827
|
+
</summary>
|
|
828
|
+
</member>
|
|
829
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2001_TerminateMessagesWithPeriod_Warning_Default_Text">
|
|
830
|
+
<summary>
|
|
831
|
+
Looks up a localized string similar to {0}: In rule '{1}', the message with id '{2}' does not end in a period. Express plain text rule messages as complete sentences. This guidance does not apply to Markdown messages, which might include formatting that makes the punctuation unnecessary..
|
|
832
|
+
</summary>
|
|
833
|
+
</member>
|
|
834
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2002_ProvideMessageArguments_FullDescription_Text">
|
|
835
|
+
<summary>
|
|
836
|
+
Looks up a localized string similar to In result messages, use the 'message.id' and 'message.arguments' properties rather than 'message.text'. This has several advantages. If 'text' is lengthy, using 'id' and 'arguments' makes the SARIF file smaller. If the rule metadata is stored externally to the SARIF log file, the message text can be improved (for example, by adding more text, clarifying the phrasing, or fixing typos), and the result messages will pick up the improvements the next time it is displayed. Finally, SARIF supports localizing mess [rest of string was truncated]";.
|
|
837
|
+
</summary>
|
|
838
|
+
</member>
|
|
839
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2002_ProvideMessageArguments_Note_Default_Text">
|
|
840
|
+
<summary>
|
|
841
|
+
Looks up a localized string similar to {0}: The 'message' property of this result contains a 'text' property. Consider replacing it with 'id' and 'arguments' properties. This potentially reduces the log file size, allows the message text to be improved without modifying the log file, and enables localization..
|
|
842
|
+
</summary>
|
|
843
|
+
</member>
|
|
844
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2003_ProvideVersionControlProvenance_FullDescription_Text">
|
|
845
|
+
<summary>
|
|
846
|
+
Looks up a localized string similar to Provide 'versionControlProvenance' to record which version of the code was analyzed, and to enable paths to be expressed relative to the root of the repository..
|
|
847
|
+
</summary>
|
|
848
|
+
</member>
|
|
849
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2003_ProvideVersionControlProvenance_Note_Default_Text">
|
|
850
|
+
<summary>
|
|
851
|
+
Looks up a localized string similar to {0}: This run does not provide 'versionControlProvenance'. As a result, it is not possible to determine which version of code was analyzed, nor to map relative paths to their locations within the repository..
|
|
852
|
+
</summary>
|
|
853
|
+
</member>
|
|
854
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2004_OptimizeFileSize_FullDescription_Text">
|
|
855
|
+
<summary>
|
|
856
|
+
Looks up a localized string similar to Emit arrays only if they provide additional information.
|
|
857
|
+
|
|
858
|
+
In several parts of a SARIF log file, a subset of information about an object appears in one place, and the full information describing all such objects appears in an array elsewhere in the log file. For example, each 'result' object has a 'ruleId' property that identifies the rule that was violated. Elsewhere in the log file, the array 'run.tool.driver.rules' contains additional information about the rules. But if the elements of the 'rules' array [rest of string was truncated]";.
|
|
859
|
+
</summary>
|
|
860
|
+
</member>
|
|
861
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2004_OptimizeFileSize_Warning_AvoidDuplicativeAnalysisTarget_Text">
|
|
862
|
+
<summary>
|
|
863
|
+
Looks up a localized string similar to The 'analysisTarget' property '{1}' at '{0}' can be removed because it is the same as the result location. This unnecessarily increases log file size. The 'analysisTarget' property is used to distinguish cases when a tool detects a result in a file (such as an included header) that is different than the file that was scanned (such as a .cpp file that included the header)..
|
|
864
|
+
</summary>
|
|
865
|
+
</member>
|
|
866
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2004_OptimizeFileSize_Warning_AvoidDuplicativeResultRuleInformation_Text">
|
|
867
|
+
<summary>
|
|
868
|
+
Looks up a localized string similar to '{0}' uses the 'rule' property to specify the violated rule, so it is not necessary also to specify 'ruleId' or 'ruleIndex'. This unnecessarily increases log file size. Remove the 'ruleId' and 'ruleIndex' properties..
|
|
869
|
+
</summary>
|
|
870
|
+
</member>
|
|
871
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2004_OptimizeFileSize_Warning_EliminateIdOnlyRules_Text">
|
|
872
|
+
<summary>
|
|
873
|
+
Looks up a localized string similar to The 'rules' array at '{0}' contains no information beyond the ids of the rules. Removing this array might reduce the log file size without losing information. In some scenarios (for example, when assessing compliance with policy), the 'rules' array might be used to record the full set of rules that were evaluated. In such a scenario, the 'rules' array should be retained even if it contains only id information..
|
|
874
|
+
</summary>
|
|
875
|
+
</member>
|
|
876
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2004_OptimizeFileSize_Warning_EliminateLocationOnlyArtifacts_Text">
|
|
877
|
+
<summary>
|
|
878
|
+
Looks up a localized string similar to The 'artifacts' array at '{0}' contains no information beyond the locations of the artifacts. Removing this array might reduce the log file size without losing information. In some scenarios (for example, when assessing compliance with policy), the 'artifacts' array might be used to record the full set of artifacts that were analyzed. In such a scenario, the 'artifacts' array should be retained even if it contains only location information..
|
|
879
|
+
</summary>
|
|
880
|
+
</member>
|
|
881
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2004_OptimizeFileSize_Warning_PreferRuleId_Text">
|
|
882
|
+
<summary>
|
|
883
|
+
Looks up a localized string similar to The result at '{0}' uses the 'rule' property to specify the violated rule, but this is not necessary because the rule is defined by 'tool.driver'. Use the 'ruleId' and 'ruleIndex' instead, because they are shorter and just as clear..
|
|
884
|
+
</summary>
|
|
885
|
+
</member>
|
|
886
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2005_ProvideToolProperties_FullDescription_Text">
|
|
887
|
+
<summary>
|
|
888
|
+
Looks up a localized string similar to Provide information that makes it easy to identify the name and version of your tool.
|
|
889
|
+
|
|
890
|
+
The tool's 'name' property should be no more than three words long. This makes it easy to remember and allows it to fit into a narrow column when displaying a list of results. If you need to provide more information about your tool, use the 'fullName' property.
|
|
891
|
+
|
|
892
|
+
The tool should provide either or both of the 'version' and 'semanticVersion' properties. This enables the log file consumer to determine whether the file was [rest of string was truncated]";.
|
|
893
|
+
</summary>
|
|
894
|
+
</member>
|
|
895
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2005_ProvideToolProperties_Warning_ProvideConciseToolName_Text">
|
|
896
|
+
<summary>
|
|
897
|
+
Looks up a localized string similar to {0}: The tool name '{1}' contains {2} words, which is more than the recommended maximum of {3} words. A short tool name is easy to remember and fits into a narrow column when displaying a list of results. If you need to provide more information about your tool, use the 'fullName' property..
|
|
898
|
+
</summary>
|
|
899
|
+
</member>
|
|
900
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2005_ProvideToolProperties_Warning_ProvideToolnformationUri_Text">
|
|
901
|
+
<summary>
|
|
902
|
+
Looks up a localized string similar to {0}: The tool '{1}' does not provide 'informationUri'. This property helps the developer responsible for addessing a result by providing a way to learn more about the tool..
|
|
903
|
+
</summary>
|
|
904
|
+
</member>
|
|
905
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2005_ProvideToolProperties_Warning_ProvideToolVersion_Text">
|
|
906
|
+
<summary>
|
|
907
|
+
Looks up a localized string similar to {0}: The tool '{1}' does not provide any of the version-related properties {2}. Providing version information enables the log file consumer to determine whether the file was produced by an up to date version, and to avoid accidentally comparing log files produced by different tool versions..
|
|
908
|
+
</summary>
|
|
909
|
+
</member>
|
|
910
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2005_ProvideToolProperties_Warning_UseNumericToolVersions_Text">
|
|
911
|
+
<summary>
|
|
912
|
+
Looks up a localized string similar to {0}: The tool '{1}' contains the 'version' property '{2}', which is not numeric. To facilitate comparison between versions, specify a 'version' that starts with an integer, optionally followed by any desired characters..
|
|
913
|
+
</summary>
|
|
914
|
+
</member>
|
|
915
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2006_UrisShouldBeReachable_FullDescription_Text">
|
|
916
|
+
<summary>
|
|
917
|
+
Looks up a localized string similar to URIs that refer to locations such as rule help pages and result-related work items should be reachable via an HTTP GET request..
|
|
918
|
+
</summary>
|
|
919
|
+
</member>
|
|
920
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2006_UrisShouldBeReachable_Note_Default_Text">
|
|
921
|
+
<summary>
|
|
922
|
+
Looks up a localized string similar to {0}: The URI '{1}' was not reachable via an HTTP GET request..
|
|
923
|
+
</summary>
|
|
924
|
+
</member>
|
|
925
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2007_ExpressPathsRelativeToRepoRoot_FullDescription_Text">
|
|
926
|
+
<summary>
|
|
927
|
+
Looks up a localized string similar to Provide information that makes it possible to determine the repo-relative locations of files that contain analysis results.
|
|
928
|
+
|
|
929
|
+
Each element of the 'versionControlProvenance' array is a 'versionControlDetails' object that describes a repository containing files that were analyzed. 'versionControlDetails.mappedTo' defines the file system location to which the root of that repository is mapped. If 'mappedTo.uriBaseId' is present, and if result locations are expressed relative to that 'uriBaseId', then the repo [rest of string was truncated]";.
|
|
930
|
+
</summary>
|
|
931
|
+
</member>
|
|
932
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2007_ExpressPathsRelativeToRepoRoot_Warning_ExpressResultLocationsRelativeToMappedTo_Text">
|
|
933
|
+
<summary>
|
|
934
|
+
Looks up a localized string similar to {0}: This result location does not provide any of the 'uriBaseId' values that specify repository locations: '{1}'. As a result, it will not be possible to determine the location of the file containing this result relative to the root of the repository that contains it..
|
|
935
|
+
</summary>
|
|
936
|
+
</member>
|
|
937
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2007_ExpressPathsRelativeToRepoRoot_Warning_ProvideUriBaseIdForMappedTo_Text">
|
|
938
|
+
<summary>
|
|
939
|
+
Looks up a localized string similar to {0}: The 'versionControlDetails' object that describes the repository '{1}' does not provide 'mappedTo.uriBaseId'. As a result, it will not be possible to determine the repo-relative location of files containing analysis results for this repository..
|
|
940
|
+
</summary>
|
|
941
|
+
</member>
|
|
942
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2008_ProvideSchema_FullDescription_Text">
|
|
943
|
+
<summary>
|
|
944
|
+
Looks up a localized string similar to A SARIF log file should contain, on the root object, a '$schema' property that refers to the final, OASIS standard version of the SARIF 2.1.0 schema. This enables IDEs to provide Intellisense for SARIF log files..
|
|
945
|
+
</summary>
|
|
946
|
+
</member>
|
|
947
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2008_ProvideSchema_Warning_Default_Text">
|
|
948
|
+
<summary>
|
|
949
|
+
Looks up a localized string similar to {0}: The SARIF log file does not contain a '$schema' property. Add a '$schema' property that refers to the final, OASIS standard version of the SARIF 2.1.0 schema. This enables IDEs to provide Intellisense for SARIF log files..
|
|
950
|
+
</summary>
|
|
951
|
+
</member>
|
|
952
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2009_ConsiderConventionalIdentifierValues_FullDescription_Text">
|
|
953
|
+
<summary>
|
|
954
|
+
Looks up a localized string similar to Adopt uniform naming conventions for rule ids. Many tools follow a conventional format for the 'reportingDescriptor.id' property: a short string identifying the tool concatenated with a numeric rule number, for example, 'CS2001' for a diagnostic from the Roslyn C# compiler. For uniformity of experience across tools, we recommend this format..
|
|
955
|
+
</summary>
|
|
956
|
+
</member>
|
|
957
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2009_ConsiderConventionalIdentifierValues_Note_UseConventionalRuleIds_Text">
|
|
958
|
+
<summary>
|
|
959
|
+
Looks up a localized string similar to {0}: The 'id' property of the rule '{1}' does not follow the recommended format: a short string identifying the tool concatenated with a numeric rule number, for example, 'CS2001'. Using a conventional format for the rule id provides a more uniform experience across tools..
|
|
960
|
+
</summary>
|
|
961
|
+
</member>
|
|
962
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2010_ProvideCodeSnippets_FullDescription_Text">
|
|
963
|
+
<summary>
|
|
964
|
+
Looks up a localized string similar to Provide code snippets to enable users to see the code that triggered each result, even if they are not enlisted in the code..
|
|
965
|
+
</summary>
|
|
966
|
+
</member>
|
|
967
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2010_ProvideCodeSnippets_Note_Default_Text">
|
|
968
|
+
<summary>
|
|
969
|
+
Looks up a localized string similar to {0}: The 'region' object in this result location does not provide a 'snippet' property. Providing a code snippet enables users to see the code that triggered the result, even if they are not enlisted in the code..
|
|
970
|
+
</summary>
|
|
971
|
+
</member>
|
|
972
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2011_ProvideContextRegion_FullDescription_Text">
|
|
973
|
+
<summary>
|
|
974
|
+
Looks up a localized string similar to Provide context regions to enable users to see a portion of the code that surrounds each result, even if they are not enlisted in the code..
|
|
975
|
+
</summary>
|
|
976
|
+
</member>
|
|
977
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2011_ProvideContextRegion_Note_Default_Text">
|
|
978
|
+
<summary>
|
|
979
|
+
Looks up a localized string similar to {0}: This result location does not provide a 'contextRegion' property. Providing a context region enables users to see a portion of the code that surrounds the result, even if they are not enlisted in the code..
|
|
980
|
+
</summary>
|
|
981
|
+
</member>
|
|
982
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2012_ProvideRuleProperties_FullDescription_Text">
|
|
983
|
+
<summary>
|
|
984
|
+
Looks up a localized string similar to Rule metadata should provide information that makes it easy to understand and fix the problem.
|
|
985
|
+
|
|
986
|
+
Provide the 'name' property, which contains a "friendly name" that helps users see at a glance the purpose of the rule. For uniformity of experience across all tools that produce SARIF, the friendly name should be a single Pascal-case identifier, for example, 'ProvideRuleFriendlyName'.
|
|
987
|
+
|
|
988
|
+
Provide the 'helpUri' property, which contains a URI where users can find detailed information about the rule. This informat [rest of string was truncated]";.
|
|
989
|
+
</summary>
|
|
990
|
+
</member>
|
|
991
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2012_ProvideRuleProperties_Note_FriendlyNameNotAPascalIdentifier_Text">
|
|
992
|
+
<summary>
|
|
993
|
+
Looks up a localized string similar to {0}: '{1}' is not a Pascal-case identifier. For uniformity of experience across all tools that produce SARIF, the friendly name should be a single Pascal-case identifier, for example, 'ProvideRuleFriendlyName'..
|
|
994
|
+
</summary>
|
|
995
|
+
</member>
|
|
996
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2012_ProvideRuleProperties_Note_ProvideFriendlyName_Text">
|
|
997
|
+
<summary>
|
|
998
|
+
Looks up a localized string similar to {0}: The rule '{1}' does not provide a "friendly name" in its 'name' property. The friendly name should be a single Pascal-case identifier, for example, 'ProvideRuleFriendlyName', that helps users see at a glance the purpose of the analysis rule..
|
|
999
|
+
</summary>
|
|
1000
|
+
</member>
|
|
1001
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2012_ProvideRuleProperties_Note_ProvideHelpUri_Text">
|
|
1002
|
+
<summary>
|
|
1003
|
+
Looks up a localized string similar to {0}: The rule '{1}' does not provide a help URI. Providing a URI where users can find detailed information about the rule helps users to understand the result and how they can best address it..
|
|
1004
|
+
</summary>
|
|
1005
|
+
</member>
|
|
1006
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2012_ProvideRuleProperties_Note_ProvideMetadataForAllViolatedRules_Text">
|
|
1007
|
+
<summary>
|
|
1008
|
+
Looks up a localized string similar to '{0}' does not provide a 'rules' property. 'rules' contain information that helps users understand why each rule fires and what the user can do to fix it..
|
|
1009
|
+
</summary>
|
|
1010
|
+
</member>
|
|
1011
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2012_ProvideRuleProperties_Note_ProvideRuleMetadata_Text">
|
|
1012
|
+
<summary>
|
|
1013
|
+
Looks up a localized string similar to '{0}' does not provide metadata for rule '{1}'. Rule metadata contains information that helps the user understand why each rule fires and what the user can do to fix it..
|
|
1014
|
+
</summary>
|
|
1015
|
+
</member>
|
|
1016
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2013_ProvideEmbeddedFileContent_FullDescription_Text">
|
|
1017
|
+
<summary>
|
|
1018
|
+
Looks up a localized string similar to Provide embedded file content so that users can examine results in their full context without having to enlist in the source repository. Embedding file content in a SARIF log file can dramatically increase its size, so consider the usage scenario when you decide whether to provide it..
|
|
1019
|
+
</summary>
|
|
1020
|
+
</member>
|
|
1021
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2013_ProvideEmbeddedFileContent_Note_Default_Text">
|
|
1022
|
+
<summary>
|
|
1023
|
+
Looks up a localized string similar to {0}: This run does not provide embedded file content. Providing embedded file content enables users to examine results in their full context without having to enlist in the source repository. Embedding file content in a SARIF log file can dramatically increase its size, so consider the usage scenario when you decide whether to provide it..
|
|
1024
|
+
</summary>
|
|
1025
|
+
</member>
|
|
1026
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2014_ProvideDynamicMessageContent_FullDescription_Text">
|
|
1027
|
+
<summary>
|
|
1028
|
+
Looks up a localized string similar to Include "dynamic content" (information that varies among results from the same rule) to makes your messages more specific, and to avoid the "wall of bugs" phenomenon, where hundreds of occurrences of the same message appear unapproachable.
|
|
1029
|
+
|
|
1030
|
+
This is part of a set of authoring practices that make your rule messages more readable, understandable, and actionable. See also 'SARIF2001.TerminateMessagesWithPeriod' and 'SARIF2015.EnquoteDynamicMessageContent'..
|
|
1031
|
+
</summary>
|
|
1032
|
+
</member>
|
|
1033
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2014_ProvideDynamicMessageContent_Note_Default_Text">
|
|
1034
|
+
<summary>
|
|
1035
|
+
Looks up a localized string similar to {0}: In rule '{1}', the message with id '{2}' does not include any dynamic content. Dynamic content makes your messages more specific and avoids the "wall of bugs" phenomenon, where hundreds of occurrences of the same message appear unapproachable..
|
|
1036
|
+
</summary>
|
|
1037
|
+
</member>
|
|
1038
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2015_EnquoteDynamicMessageContent_FullDescription_Text">
|
|
1039
|
+
<summary>
|
|
1040
|
+
Looks up a localized string similar to Place dynamic content in single quotes to set it off from the static text and to make it easier to spot. It's especially helpful when the dynamic content is a string that might contain spaces, and most especially when the string might be empty (and so would be invisible if it weren't for the quotes). We recommend single quotes for a less cluttered appearance, even though US English usage would require double quotes.
|
|
1041
|
+
|
|
1042
|
+
This is part of a set of authoring practices that make your rule messages more readable, [rest of string was truncated]";.
|
|
1043
|
+
</summary>
|
|
1044
|
+
</member>
|
|
1045
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2015_EnquoteDynamicMessageContent_Note_Default_Text">
|
|
1046
|
+
<summary>
|
|
1047
|
+
Looks up a localized string similar to {0}: In rule '{1}', the message with id '{2}' includes dynamic content that is not enclosed in single quotes. Enquoting dynamic content makes it easier to spot, and single quotes give a less cluttered appearance..
|
|
1048
|
+
</summary>
|
|
1049
|
+
</member>
|
|
1050
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2016_FileUrisShouldBeRelative_FullDescription_Text">
|
|
1051
|
+
<summary>
|
|
1052
|
+
Looks up a localized string similar to When an artifact location refers to a file on the local file system, specify a relative reference for the uri property and provide a uriBaseId property, rather than specifying an absolute URI.
|
|
1053
|
+
|
|
1054
|
+
There are several advantages to this approach:
|
|
1055
|
+
|
|
1056
|
+
Portability: A log file that contains relative references together with uriBaseI properties can be interpreted on a machine where the files are located at a different absolute location.
|
|
1057
|
+
|
|
1058
|
+
Determinism: A log file that uses uriBaseId properties has a better chance of [rest of string was truncated]";.
|
|
1059
|
+
</summary>
|
|
1060
|
+
</member>
|
|
1061
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2016_FileUrisShouldBeRelative_Note_Default_Text">
|
|
1062
|
+
<summary>
|
|
1063
|
+
Looks up a localized string similar to {0}: The file location '{1}' is specified with absolute URI. Prefer a relative reference together with a uriBaseId property..
|
|
1064
|
+
</summary>
|
|
1065
|
+
</member>
|
|
1066
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2016_FileUrisShouldBeRelative_Note_ShouldNotContainBackSlash_Text">
|
|
1067
|
+
<summary>
|
|
1068
|
+
Looks up a localized string similar to {0}: The relative file URL '{1}' contains one or more backslashes, which will be preserved when concatenating to an absolute URL. This can result in inconsistent representations, compared to URLs created from an absolute file path, which may be regarded as not equivalent. Replace all backslashes with forward slashes..
|
|
1069
|
+
</summary>
|
|
1070
|
+
</member>
|
|
1071
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.SARIF2016_FileUrisShouldBeRelative_Note_ShouldNotStartWithSlash_Text">
|
|
1072
|
+
<summary>
|
|
1073
|
+
Looks up a localized string similar to {0}: The relative file URL '{1}' is prefixed with a leading slash, which can lead to unintended behavior when concatenating with absolute URLs. Remove the leading slash..
|
|
1074
|
+
</summary>
|
|
1075
|
+
</member>
|
|
1076
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.ServiceName_ADO">
|
|
1077
|
+
<summary>
|
|
1078
|
+
Looks up a localized string similar to Azure DevOps Advanced Security.
|
|
1079
|
+
</summary>
|
|
1080
|
+
</member>
|
|
1081
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.ServiceName_GHAS">
|
|
1082
|
+
<summary>
|
|
1083
|
+
Looks up a localized string similar to GitHub Advanced Security.
|
|
1084
|
+
</summary>
|
|
1085
|
+
</member>
|
|
1086
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleIdentifiersMustBeValid.Id">
|
|
1087
|
+
<summary>
|
|
1088
|
+
SARIF2001
|
|
1089
|
+
</summary>
|
|
1090
|
+
</member>
|
|
1091
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleIdentifiersMustBeValid.FullDescription">
|
|
1092
|
+
<summary>
|
|
1093
|
+
The two identity-related properties of a SARIF rule must be consistent. The required 'id'
|
|
1094
|
+
property must be a "stable, opaque identifier" (the SARIF specification
|
|
1095
|
+
([3.49.3](https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317839))
|
|
1096
|
+
explains the reasons for this). The optional 'name' property
|
|
1097
|
+
([3.49.7](https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317843))
|
|
1098
|
+
is an identifier that is understandable to an end user. Therefore if both 'id' and 'name'
|
|
1099
|
+
are present, they must be different. If both 'name' and 'id' are opaque identifiers,
|
|
1100
|
+
omit the 'name' property. If both 'name' and 'id' are human-readable identifiers, then
|
|
1101
|
+
consider assigning an opaque identifier to each rule, but in the meantime, omit the 'name'
|
|
1102
|
+
property.
|
|
1103
|
+
</summary>
|
|
1104
|
+
</member>
|
|
1105
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.UrisMustBeValid.Id">
|
|
1106
|
+
<summary>
|
|
1107
|
+
SARIF1002
|
|
1108
|
+
</summary>
|
|
1109
|
+
</member>
|
|
1110
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.UrisMustBeValid.FullDescription">
|
|
1111
|
+
<summary>
|
|
1112
|
+
Specify a valid URI reference for every URI-valued property.
|
|
1113
|
+
|
|
1114
|
+
URIs must conform to [RFC 3986](https://tools.ietf.org/html/rfc3986). In addition,
|
|
1115
|
+
'file' URIs must not include '..' segments. If symbolic links are present, '..'
|
|
1116
|
+
might have different meanings on the machine that produced the log file and the
|
|
1117
|
+
machine where an end user or a tool consumes it.
|
|
1118
|
+
</summary>
|
|
1119
|
+
</member>
|
|
1120
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ExpressUriBaseIdsCorrectly.Id">
|
|
1121
|
+
<summary>
|
|
1122
|
+
SARIF1004
|
|
1123
|
+
</summary>
|
|
1124
|
+
</member>
|
|
1125
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ExpressUriBaseIdsCorrectly.FullDescription">
|
|
1126
|
+
<summary>
|
|
1127
|
+
When using the 'uriBaseId' property, obey the requirements in the SARIF specification
|
|
1128
|
+
[3.4.4](https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317431)
|
|
1129
|
+
that enable it to fulfill its purpose of resolving relative references to absolute locations.
|
|
1130
|
+
In particular:
|
|
1131
|
+
|
|
1132
|
+
If an 'artifactLocation' object has a 'uriBaseId' property, its 'uri' property must be a
|
|
1133
|
+
relative reference, because if 'uri' is an absolute URI then 'uriBaseId' serves no purpose.
|
|
1134
|
+
|
|
1135
|
+
Every URI reference in 'originalUriBaseIds' must resolve to an absolute URI in the manner
|
|
1136
|
+
described in the SARIF specification
|
|
1137
|
+
[3.14.14] (https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317498).
|
|
1138
|
+
|
|
1139
|
+
Finally, a relative reference in 'artifactLocation.uri' must not begin with a slash, because
|
|
1140
|
+
that prevents it from combining properly with the absolute URI specified by a 'uriBaseId'.
|
|
1141
|
+
</summary>
|
|
1142
|
+
</member>
|
|
1143
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.UriMustBeAbsolute.Id">
|
|
1144
|
+
<summary>
|
|
1145
|
+
SARIF1005
|
|
1146
|
+
</summary>
|
|
1147
|
+
</member>
|
|
1148
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.UriMustBeAbsolute.FullDescription">
|
|
1149
|
+
<summary>
|
|
1150
|
+
Certain URIs are required to be absolute. For the most part, these are URIs that refer to http
|
|
1151
|
+
addresses, such as work items or rule help topics.
|
|
1152
|
+
</summary>
|
|
1153
|
+
</member>
|
|
1154
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.InvocationPropertiesMustBeConsistent.Id">
|
|
1155
|
+
<summary>
|
|
1156
|
+
SARIF1006
|
|
1157
|
+
</summary>
|
|
1158
|
+
</member>
|
|
1159
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.InvocationPropertiesMustBeConsistent.FullDescription">
|
|
1160
|
+
<summary>
|
|
1161
|
+
The properties of an 'invocation' object must be consistent.
|
|
1162
|
+
|
|
1163
|
+
If the 'invocation' object specifies both 'startTimeUtc' and 'endTimeUtc', then 'endTimeUtc'
|
|
1164
|
+
must not precede 'startTimeUtc'. To allow for the possibility that the duration of the run
|
|
1165
|
+
is less than the resolution of the string representation of the time, the start time and the
|
|
1166
|
+
end time may be equal.
|
|
1167
|
+
</summary>
|
|
1168
|
+
</member>
|
|
1169
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RegionPropertiesMustBeConsistent.Id">
|
|
1170
|
+
<summary>
|
|
1171
|
+
SARIF1007
|
|
1172
|
+
</summary>
|
|
1173
|
+
</member>
|
|
1174
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RegionPropertiesMustBeConsistent.FullDescription">
|
|
1175
|
+
<summary>
|
|
1176
|
+
The properties of a 'region' object must be consistent.
|
|
1177
|
+
|
|
1178
|
+
SARIF can specify a 'region' (a contiguous portion of a file) in a variety of ways:
|
|
1179
|
+
with line and column numbers, with a character offset and count, or with a byte offset
|
|
1180
|
+
and count.The specification states certain constraints on these properties, both within
|
|
1181
|
+
each property group (for example, the start line cannot be greater than end line) and
|
|
1182
|
+
between the groups(for example, if more than one group is present, they must independently
|
|
1183
|
+
specify the same portion of the file). See the SARIF specification
|
|
1184
|
+
([3.30] (https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317685)).
|
|
1185
|
+
</summary>
|
|
1186
|
+
</member>
|
|
1187
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.PhysicalLocationPropertiesMustBeConsistent.Id">
|
|
1188
|
+
<summary>
|
|
1189
|
+
SARIF1008
|
|
1190
|
+
</summary>
|
|
1191
|
+
</member>
|
|
1192
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.PhysicalLocationPropertiesMustBeConsistent.FullDescription">
|
|
1193
|
+
<summary>
|
|
1194
|
+
Ensure consistency among the properties of a 'physicalLocation' object.
|
|
1195
|
+
|
|
1196
|
+
A SARIF 'physicalLocation' object has two related properties 'region' and 'contextRegion'.
|
|
1197
|
+
If 'contextRegion' is present, then 'region' must also be present, and 'contextRegion'
|
|
1198
|
+
must be a "proper superset" of 'region'. That is, 'contextRegion' must completely contain
|
|
1199
|
+
'region', and it must be larger than 'region'. To understand why this is so we must
|
|
1200
|
+
understand the roles of the 'region' and 'contextRegion' properties.
|
|
1201
|
+
|
|
1202
|
+
'region' allows both users and tools to distinguish similar results within the same
|
|
1203
|
+
artifact. If a SARIF viewer has access to the artifact, it can display it, and highlight
|
|
1204
|
+
the location identified by the analysis tool.If the region has a 'snippet' property,
|
|
1205
|
+
then even if the viewer doesn't have access to the artifact (which might be the case
|
|
1206
|
+
for a web-based viewer), it can still display the faulty code.
|
|
1207
|
+
|
|
1208
|
+
'contextRegion' provides users with a broader view of the result location. Typically,
|
|
1209
|
+
it consists of a range starting a few lines before 'region' and ending a few lines after.
|
|
1210
|
+
Again, if a SARIF viewer has access to the artifact, it can display it, and highlight
|
|
1211
|
+
the context region (perhaps in a lighter shade than the region itself). This isn't
|
|
1212
|
+
terribly useful since the user can already see the whole file, with the 'region'
|
|
1213
|
+
already highlighted. But if 'contextRegion' has a 'snippet' property, then even a
|
|
1214
|
+
viewer without access to the artifact can display a few lines of code surrounding
|
|
1215
|
+
the actual result, which is helpful to users.
|
|
1216
|
+
|
|
1217
|
+
If the validator reports that 'contextRegion' is not a proper superset of 'region',
|
|
1218
|
+
then it's possible that the tool reversed 'region' and 'contextRegion'. If 'region'
|
|
1219
|
+
and 'contextRegion' are identical, the tool should simply omit 'contextRegion'.
|
|
1220
|
+
</summary>
|
|
1221
|
+
</member>
|
|
1222
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.IndexPropertiesMustBeConsistentWithArrays.Id">
|
|
1223
|
+
<summary>
|
|
1224
|
+
SARIF1009
|
|
1225
|
+
</summary>
|
|
1226
|
+
</member>
|
|
1227
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.IndexPropertiesMustBeConsistentWithArrays.FullDescription">
|
|
1228
|
+
<summary>
|
|
1229
|
+
If an object contains a property that is used as an array index (an "index-valued
|
|
1230
|
+
property"), then that array must be present and must contain at least "index + 1"
|
|
1231
|
+
elements.
|
|
1232
|
+
</summary>
|
|
1233
|
+
</member>
|
|
1234
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleIdMustBeConsistent.Id">
|
|
1235
|
+
<summary>
|
|
1236
|
+
SARIF1010
|
|
1237
|
+
</summary>
|
|
1238
|
+
</member>
|
|
1239
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleIdMustBeConsistent.FullDescription">
|
|
1240
|
+
<summary>
|
|
1241
|
+
Every result must contain at least one of the properties 'ruleId' and 'rule.id'.
|
|
1242
|
+
If both are present, they must be equal. See the SARIF specification ([§3.27.5]
|
|
1243
|
+
(https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317643)).
|
|
1244
|
+
</summary>
|
|
1245
|
+
</member>
|
|
1246
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ReferenceFinalSchema.Id">
|
|
1247
|
+
<summary>
|
|
1248
|
+
SARIF1011
|
|
1249
|
+
</summary>
|
|
1250
|
+
</member>
|
|
1251
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ReferenceFinalSchema.FullDescription">
|
|
1252
|
+
<summary>
|
|
1253
|
+
The '$schema' property must refer to the final version of the SARIF 2.1.0 schema. This
|
|
1254
|
+
enables IDEs to provide Intellisense for SARIF log files.
|
|
1255
|
+
|
|
1256
|
+
The SARIF standard was developed over several years, and many intermediate versions of
|
|
1257
|
+
the schema were produced. Now that the standard is final, only the OASIS standard version
|
|
1258
|
+
of the schema is valid.
|
|
1259
|
+
</summary>
|
|
1260
|
+
</member>
|
|
1261
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.MessageArgumentsMustBeConsistentWithRule.Id">
|
|
1262
|
+
<summary>
|
|
1263
|
+
SARIF1012
|
|
1264
|
+
</summary>
|
|
1265
|
+
</member>
|
|
1266
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.MessageArgumentsMustBeConsistentWithRule.FullDescription">
|
|
1267
|
+
<summary>
|
|
1268
|
+
The properties of a result's 'message' property must be consistent with the properties
|
|
1269
|
+
of the rule that the result refers to.
|
|
1270
|
+
|
|
1271
|
+
When a result's 'message' object uses the 'id' and 'arguments' properties (which, by the
|
|
1272
|
+
way, is recommended: see SARIF2002.ProvideMessageArguments), it must ensure that the rule
|
|
1273
|
+
actually defines a message string with that id, and that 'arguments' array has enough
|
|
1274
|
+
elements to provide values for every replacement sequence in the message specified by 'id'.
|
|
1275
|
+
For example, if the highest numbered replacement sequence in the specified message string
|
|
1276
|
+
is '{3}', then the 'arguments' array must contain at least 4 elements.
|
|
1277
|
+
</summary>
|
|
1278
|
+
</member>
|
|
1279
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.TerminateMessagesWithPeriod.Id">
|
|
1280
|
+
<summary>
|
|
1281
|
+
SARIF2001
|
|
1282
|
+
</summary>
|
|
1283
|
+
</member>
|
|
1284
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.TerminateMessagesWithPeriod.FullDescription">
|
|
1285
|
+
<summary>
|
|
1286
|
+
Express plain text result messages as complete sentences and end each sentence with a period.
|
|
1287
|
+
This guidance does not apply to Markdown messages, which might include formatting that makes
|
|
1288
|
+
the punctuation unnecessary.
|
|
1289
|
+
|
|
1290
|
+
This is part of a set of authoring practices that make your rule messages more readable,
|
|
1291
|
+
understandable, and actionable.See also `SARIF2014.ProvideDynamicMessageContent` and
|
|
1292
|
+
`SARIF2015.EnquoteDynamicMessageContent`.
|
|
1293
|
+
</summary>
|
|
1294
|
+
</member>
|
|
1295
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ProvideMessageArguments.Id">
|
|
1296
|
+
<summary>
|
|
1297
|
+
SARIF2002
|
|
1298
|
+
</summary>
|
|
1299
|
+
</member>
|
|
1300
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ProvideMessageArguments.FullDescription">
|
|
1301
|
+
<summary>
|
|
1302
|
+
In result messages, use the 'message.id' and 'message.arguments' properties rather than
|
|
1303
|
+
'message.text'. This has several advantages. If 'text' is lengthy, using 'id' and 'arguments'
|
|
1304
|
+
makes the SARIF file smaller. If the rule metadata is stored externally to the SARIF log file,
|
|
1305
|
+
the message text can be improved (for example, by adding more text, clarifying the phrasing,
|
|
1306
|
+
or fixing typos), and the result messages will pick up the improvements the next time it is
|
|
1307
|
+
displayed. Finally, SARIF supports localizing messages into different languages, which is
|
|
1308
|
+
possible if the SARIF file contains 'message.id' and 'message.arguments', but not if it contains
|
|
1309
|
+
'message.text' directly.
|
|
1310
|
+
</summary>
|
|
1311
|
+
</member>
|
|
1312
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ProvideVersionControlProvenance.Id">
|
|
1313
|
+
<summary>
|
|
1314
|
+
SARIF2003
|
|
1315
|
+
</summary>
|
|
1316
|
+
</member>
|
|
1317
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ProvideVersionControlProvenance.FullDescription">
|
|
1318
|
+
<summary>
|
|
1319
|
+
Provide 'versionControlProvenance' to record which version of the code was analyzed,
|
|
1320
|
+
and to enable paths to be expressed relative to the root of the repository.
|
|
1321
|
+
</summary>
|
|
1322
|
+
</member>
|
|
1323
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.OptimizeFileSize.Id">
|
|
1324
|
+
<summary>
|
|
1325
|
+
SARIF2004
|
|
1326
|
+
</summary>
|
|
1327
|
+
</member>
|
|
1328
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.OptimizeFileSize.FullDescription">
|
|
1329
|
+
<summary>
|
|
1330
|
+
Emit arrays only if they provide additional information.
|
|
1331
|
+
|
|
1332
|
+
In several parts of a SARIF log file, a subset of information about an object appears
|
|
1333
|
+
in one place, and the full information describing all such objects appears in an array
|
|
1334
|
+
elsewhere in the log file. For example, each 'result' object has a 'ruleId' property
|
|
1335
|
+
that identifies the rule that was violated. Elsewhere in the log file, the array
|
|
1336
|
+
'run.tool.driver.rules' contains additional information about the rules. But if the
|
|
1337
|
+
elements of the 'rules' array contained no information about the rules beyond their ids,
|
|
1338
|
+
then there might be no reason to include the 'rules' array at all, and the log file
|
|
1339
|
+
could be made smaller simply by omitting it. In some scenarios (for example, when
|
|
1340
|
+
assessing compliance with policy), the 'rules' array might be used to record the full
|
|
1341
|
+
set of rules that were evaluated. In such a scenario, the 'rules' array should be retained
|
|
1342
|
+
even if it contains only id information.
|
|
1343
|
+
|
|
1344
|
+
Similarly, most 'result' objects contain at least one 'artifactLocation' object. Elsewhere
|
|
1345
|
+
in the log file, the array 'run.artifacts' contains additional information about the artifacts
|
|
1346
|
+
that were analyzed. But if the elements of the 'artifacts' array contained not information
|
|
1347
|
+
about the artifacts beyond their locations, then there might be no reason to include the
|
|
1348
|
+
'artifacts' array at all, and again the log file could be made smaller by omitting it. In
|
|
1349
|
+
some scenarios (for example, when assessing compliance with policy), the 'artifacts' array
|
|
1350
|
+
might be used to record the full set of artifacts that were analyzed. In such a scenario,
|
|
1351
|
+
the 'artifacts' array should be retained even if it contains only location information.
|
|
1352
|
+
|
|
1353
|
+
In addition to the avoiding unnecessary arrays, there are other ways to optimize the
|
|
1354
|
+
size of SARIF log files.
|
|
1355
|
+
|
|
1356
|
+
Prefer the result object properties 'ruleId' and 'ruleIndex' to the nested object-valued
|
|
1357
|
+
property 'result.rule', unless the rule comes from a tool component other than the driver
|
|
1358
|
+
(in which case only 'result.rule' can accurately point to the metadata for the rule).
|
|
1359
|
+
The 'ruleId' and 'ruleIndex' properties are shorter and just as clear.
|
|
1360
|
+
|
|
1361
|
+
Do not specify the result object's 'analysisTarget' property unless it differs from the
|
|
1362
|
+
result location. The canonical scenario for using 'result.analysisTarget' is a C/C++ language
|
|
1363
|
+
analyzer that is instructed to analyze example.c, and detects a result in the included file
|
|
1364
|
+
example.h. In this case, 'analysisTarget' is example.c, and the result location is in example.h.
|
|
1365
|
+
</summary>
|
|
1366
|
+
</member>
|
|
1367
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ProvideToolProperties.Id">
|
|
1368
|
+
<summary>
|
|
1369
|
+
SARIF2005
|
|
1370
|
+
</summary>
|
|
1371
|
+
</member>
|
|
1372
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ProvideToolProperties.FullDescription">
|
|
1373
|
+
<summary>
|
|
1374
|
+
Provide information that makes it easy to identify the name and version of your tool.
|
|
1375
|
+
|
|
1376
|
+
The tool's 'name' property should be no more than three words long. This makes it easy
|
|
1377
|
+
to remember and allows it to fit into a narrow column when displaying a list of results.
|
|
1378
|
+
If you need to provide more information about your tool, use the 'fullName' property.
|
|
1379
|
+
|
|
1380
|
+
The tool should provide either or both of the 'version' and 'semanticVersion' properties.
|
|
1381
|
+
This enables the log file consumer to determine whether the file was produced by an up
|
|
1382
|
+
to date version, and to avoid accidentally comparing log files produced by different tool
|
|
1383
|
+
versions.
|
|
1384
|
+
|
|
1385
|
+
If 'version' is used, facilitate comparison between versions by specifying a version number
|
|
1386
|
+
that starts with an integer, optionally followed by any desired characters.
|
|
1387
|
+
</summary>
|
|
1388
|
+
</member>
|
|
1389
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.UrisShouldBeReachable.Id">
|
|
1390
|
+
<summary>
|
|
1391
|
+
SARIF2006
|
|
1392
|
+
</summary>
|
|
1393
|
+
</member>
|
|
1394
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.UrisShouldBeReachable.FullDescription">
|
|
1395
|
+
<summary>
|
|
1396
|
+
URIs that refer to locations such as rule help pages and result-related work items
|
|
1397
|
+
should be reachable via an HTTP GET request.
|
|
1398
|
+
</summary>
|
|
1399
|
+
</member>
|
|
1400
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ExpressPathsRelativeToRepoRoot.Id">
|
|
1401
|
+
<summary>
|
|
1402
|
+
SARIF2007
|
|
1403
|
+
</summary>
|
|
1404
|
+
</member>
|
|
1405
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ExpressPathsRelativeToRepoRoot.FullDescription">
|
|
1406
|
+
<summary>
|
|
1407
|
+
Provide information that makes it possible to determine the repo-relative locations of
|
|
1408
|
+
files that contain analysis results.
|
|
1409
|
+
|
|
1410
|
+
Each element of the 'versionControlProvenance' array is a 'versionControlDetails' object
|
|
1411
|
+
that describes a repository containing files that were analyzed. 'versionControlDetails.mappedTo'
|
|
1412
|
+
defines the file system location to which the root of that repository is mapped. If
|
|
1413
|
+
'mappedTo.uriBaseId' is present, and if result locations are expressed relative to that
|
|
1414
|
+
'uriBaseId', then the repo-relative location of each result can be determined.
|
|
1415
|
+
</summary>
|
|
1416
|
+
</member>
|
|
1417
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ProvideSchema.Id">
|
|
1418
|
+
<summary>
|
|
1419
|
+
SARIF2008
|
|
1420
|
+
</summary>
|
|
1421
|
+
</member>
|
|
1422
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ProvideSchema.FullDescription">
|
|
1423
|
+
<summary>
|
|
1424
|
+
A SARIF log file should contain, on the root object, a '$schema' property that refers to
|
|
1425
|
+
the final, OASIS standard version of the SARIF 2.1.0 schema. This enables IDEs to provide
|
|
1426
|
+
Intellisense for SARIF log files.
|
|
1427
|
+
</summary>
|
|
1428
|
+
</member>
|
|
1429
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ConsiderConventionalIdentifierValues.Id">
|
|
1430
|
+
<summary>
|
|
1431
|
+
SARIF2009
|
|
1432
|
+
</summary>
|
|
1433
|
+
</member>
|
|
1434
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ConsiderConventionalIdentifierValues.FullDescription">
|
|
1435
|
+
<summary>
|
|
1436
|
+
Adopt uniform naming conventions for rule ids.
|
|
1437
|
+
|
|
1438
|
+
Many tools follow a conventional format for the 'reportingDescriptor.id' property:
|
|
1439
|
+
a short string identifying the tool concatenated with a numeric rule number, for
|
|
1440
|
+
example, 'CS2001' for a diagnostic from the Roslyn C# compiler. For uniformity of
|
|
1441
|
+
experience across tools, we recommend this format.
|
|
1442
|
+
</summary>
|
|
1443
|
+
</member>
|
|
1444
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ProvideCodeSnippets.Id">
|
|
1445
|
+
<summary>
|
|
1446
|
+
SARIF2010
|
|
1447
|
+
</summary>
|
|
1448
|
+
</member>
|
|
1449
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ProvideCodeSnippets.FullDescription">
|
|
1450
|
+
<summary>
|
|
1451
|
+
Provide code snippets to enable users to see the code that triggered each result,
|
|
1452
|
+
even if they are not enlisted in the code.
|
|
1453
|
+
</summary>
|
|
1454
|
+
</member>
|
|
1455
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ProvideContextRegion.Id">
|
|
1456
|
+
<summary>
|
|
1457
|
+
SARIF2011
|
|
1458
|
+
</summary>
|
|
1459
|
+
</member>
|
|
1460
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ProvideContextRegion.FullDescription">
|
|
1461
|
+
<summary>
|
|
1462
|
+
Provide context regions to enable users to see a portion of the code that surrounds
|
|
1463
|
+
each result, even if they are not enlisted in the code.
|
|
1464
|
+
</summary>
|
|
1465
|
+
</member>
|
|
1466
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ProvideRuleProperties.Id">
|
|
1467
|
+
<summary>
|
|
1468
|
+
SARIF2012
|
|
1469
|
+
</summary>
|
|
1470
|
+
</member>
|
|
1471
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ProvideRuleProperties.FullDescription">
|
|
1472
|
+
<summary>
|
|
1473
|
+
Rule metadata should provide information that makes it easy to understand and fix the problem.
|
|
1474
|
+
|
|
1475
|
+
Provide the 'name' property, which contains a "friendly name" that helps users see at a glance
|
|
1476
|
+
the purpose of the rule.For uniformity of experience across all tools that produce SARIF, the
|
|
1477
|
+
friendly name should be a single Pascal identifier, for example, 'ProvideRuleFriendlyName'.
|
|
1478
|
+
|
|
1479
|
+
Provide the 'helpUri' property, which contains a URI where users can find detailed information
|
|
1480
|
+
about the rule.This information should include a detailed description of the invalid pattern,
|
|
1481
|
+
an explanation of why the pattern is poor practice (particularly in contexts such as security
|
|
1482
|
+
or accessibility where driving considerations might not be readily apparent), guidance for
|
|
1483
|
+
resolving the problem(including describing circumstances in which ignoring the problem
|
|
1484
|
+
altogether might be appropriate), examples of invalid and valid patterns, and special considerations
|
|
1485
|
+
(such as noting when a violation should never be ignored or suppressed, noting when a violation
|
|
1486
|
+
could cause downstream tool noise, and noting when a rule can be configured in some way to refine
|
|
1487
|
+
or alter the analysis).
|
|
1488
|
+
</summary>
|
|
1489
|
+
</member>
|
|
1490
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ProvideEmbeddedFileContent.Id">
|
|
1491
|
+
<summary>
|
|
1492
|
+
SARIF2013
|
|
1493
|
+
</summary>
|
|
1494
|
+
</member>
|
|
1495
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ProvideEmbeddedFileContent.FullDescription">
|
|
1496
|
+
<summary>
|
|
1497
|
+
Provide embedded file content so that users can examine results in their full context
|
|
1498
|
+
without having to enlist in the source repository. Embedding file content in a SARIF
|
|
1499
|
+
log file can dramatically increase its size, so consider the usage scenario when you
|
|
1500
|
+
decide whether to provide it.
|
|
1501
|
+
</summary>
|
|
1502
|
+
</member>
|
|
1503
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ProvideDynamicMessageContent.Id">
|
|
1504
|
+
<summary>
|
|
1505
|
+
SARIF2014
|
|
1506
|
+
</summary>
|
|
1507
|
+
</member>
|
|
1508
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ProvideDynamicMessageContent.FullDescription">
|
|
1509
|
+
<summary>
|
|
1510
|
+
Include "dynamic content" (information that varies among results from the same rule) to
|
|
1511
|
+
makes your messages more specific, and to avoid the "wall of bugs" phenomenon, where
|
|
1512
|
+
hundreds of occurrences of the same message appear unapproachable.
|
|
1513
|
+
|
|
1514
|
+
This is part of a set of authoring practices that make your rule messages more readable,
|
|
1515
|
+
understandable, and actionable. See also 'SARIF2001.TerminateMessagesWithPeriod' and
|
|
1516
|
+
'SARIF2015.EnquoteDynamicMessageContent'.
|
|
1517
|
+
</summary>
|
|
1518
|
+
</member>
|
|
1519
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.EnquoteDynamicMessageContent.Id">
|
|
1520
|
+
<summary>
|
|
1521
|
+
SARIF2015
|
|
1522
|
+
</summary>
|
|
1523
|
+
</member>
|
|
1524
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.EnquoteDynamicMessageContent.FullDescription">
|
|
1525
|
+
<summary>
|
|
1526
|
+
Place dynamic content in single quotes to set it off from the static text and to make it easier
|
|
1527
|
+
to spot. It's especially helpful when the dynamic content is a string that might contain spaces,
|
|
1528
|
+
and most especially when the string might be empty (and so would be invisible if it weren't for
|
|
1529
|
+
the quotes). We recommend single quotes for a less cluttered appearance, even though US English
|
|
1530
|
+
usage would require double quotes.
|
|
1531
|
+
|
|
1532
|
+
This is part of a set of authoring practices that make your rule messages more readable,
|
|
1533
|
+
understandable, and actionable. See also 'SARIF2001.TerminateMessagesWithPeriod' and
|
|
1534
|
+
'SARIF2014.ProvideDynamicMessageContent'.
|
|
1535
|
+
</summary>
|
|
1536
|
+
</member>
|
|
1537
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.FileUrisShouldBeRelative.Id">
|
|
1538
|
+
<summary>
|
|
1539
|
+
SARIF2016
|
|
1540
|
+
</summary>
|
|
1541
|
+
</member>
|
|
1542
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.FileUrisShouldBeRelative.FullDescription">
|
|
1543
|
+
<summary>
|
|
1544
|
+
When an artifact location refers to a file on the local file system, specify a relative reference
|
|
1545
|
+
for the uri property and provide a uriBaseId property, rather than specifying an absolute URI.
|
|
1546
|
+
|
|
1547
|
+
There are several advantages to this approach:
|
|
1548
|
+
Portability: A log file that contains relative references together with uriBaseI properties can
|
|
1549
|
+
be interpreted on a machine where the files are located at a different absolute location.
|
|
1550
|
+
|
|
1551
|
+
Determinism: A log file that uses uriBaseId properties has a better chance of being “deterministic”;
|
|
1552
|
+
that is, of being identical from run to run if none of its inputs have changed, even if those runs
|
|
1553
|
+
occur on machines where the files are located at different absolute locations.
|
|
1554
|
+
|
|
1555
|
+
Security: The use of uriBaseId properties avoids the persistence of absolute path names in the
|
|
1556
|
+
log file.Absolute path names can reveal information that might be sensitive.
|
|
1557
|
+
|
|
1558
|
+
Semantics: Assuming the reader of the log file (an end user or another tool) has the necessary
|
|
1559
|
+
context, they can understand the meaning of the location specified by the uri property, for
|
|
1560
|
+
example, “this is a source file”.
|
|
1561
|
+
</summary>
|
|
1562
|
+
</member>
|
|
1563
|
+
<member name="M:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.SarifValidationSkimmerBase.IsWellFormedUriString(System.String,System.UriKind)">
|
|
1564
|
+
<summary>
|
|
1565
|
+
Validate URIs conform to [RFC 3986](https://tools.ietf.org/html/rfc3986).
|
|
1566
|
+
</summary>
|
|
1567
|
+
<param name="uriString">The string used to attempt to construct a `Uri`.</param>
|
|
1568
|
+
<param name="uriKind">The type of the `Uri` in `uriString`.</param>
|
|
1569
|
+
<returns></returns>
|
|
1570
|
+
</member>
|
|
1571
|
+
</members>
|
|
1572
|
+
</doc>
|