https://gcc.gnu.org/g:277bce3287c5dc5b1a695395120c20735b706032
commit r17-5514-g277bce3287c5dc5b1a695395120c20735b706032 Author: David Malcolm <[email protected]> Date: Fri Oct 23 10:40:36 2026 -0400 diagnostics: update SARIF 2.2 prerelease from 2024_08_08 to CSD01 SARIF 2.2 now has a Committee Specification Draft 01, so update version=sarif-2.2-prelease to use that, rather than a snapshot from two years ago. gcc/ChangeLog: * diagnostics/output-spec.cc (sarif_scheme_handler::maybe_handle_kv): Update enum value for SARIF 2.2 from sarif_version::v2_2_prerelease_2024_08_08 to sarif_version::v2_2_prerelease_csd01. * diagnostics/sarif-sink.cc (sarif_invocation::add_notification_for_ice): Likewise. (add_related_location): Likewise. (sarif_version_to_url): Likewise. Update URL for SARIF 2.2 schema. (sarif_version_to_property): Update enum value for SARIF 2.2. (get_dump_string_for_sarif_version): Likewise, also updating description. * diagnostics/sarif-sink.h (enum class sarif_version): Replace v2_2_prerelease_2024_08_08 with v2_2_prerelease_csd01. * libgdiagnostics.cc (diagnostic_manager_add_sarif_sink): Likewise. gcc/testsuite/ChangeLog: * gcc.dg/plugin/crash-test-ice-in-header-sarif-2_2.py: Update expected URL for schema. * lib/sarif-schema-2.2-prerelease-2024-08-08.json: Replace with... * lib/sarif-schema-2.2-prerelease-csd01.json: ...this. * lib/scansarif.exp (verify-sarif-file): Update for change in name of schema file. Signed-off-by: David Malcolm <[email protected]> Diff: --- gcc/diagnostics/output-spec.cc | 2 +- gcc/diagnostics/sarif-sink.cc | 17 ++++++------- gcc/diagnostics/sarif-sink.h | 2 +- gcc/libgdiagnostics.cc | 2 +- .../plugin/crash-test-ice-in-header-sarif-2_2.py | 2 +- ...json => sarif-schema-2.2-prerelease-csd01.json} | 29 +++++++++++++++++++++- gcc/testsuite/lib/scansarif.exp | 2 +- 7 files changed, 41 insertions(+), 15 deletions(-) diff --git a/gcc/diagnostics/output-spec.cc b/gcc/diagnostics/output-spec.cc index d30b12fc3c28..6089f85dcd8d 100644 --- a/gcc/diagnostics/output-spec.cc +++ b/gcc/diagnostics/output-spec.cc @@ -558,7 +558,7 @@ sarif_scheme_handler::maybe_handle_kv (const context &ctxt, static const std::array<std::pair<const char *, enum sarif_version>, (size_t)sarif_version::num_versions> value_names {{{"2.1", sarif_version::v2_1_0}, - {"2.2-prerelease", sarif_version::v2_2_prerelease_2024_08_08}}}; + {"2.2-prerelease", sarif_version::v2_2_prerelease_csd01}}}; return parse_enum_value<enum sarif_version> (ctxt, key, value, diff --git a/gcc/diagnostics/sarif-sink.cc b/gcc/diagnostics/sarif-sink.cc index d56802c957f6..834b6aec3adf 100644 --- a/gcc/diagnostics/sarif-sink.cc +++ b/gcc/diagnostics/sarif-sink.cc @@ -1092,7 +1092,7 @@ sarif_invocation::add_notification_for_ice (const diagnostic_info &diagnostic, /* Support for related locations within a notification was added in SARIF 2.2; see https://github.com/oasis-tcs/sarif-spec/issues/540 */ - if (builder.get_version () >= sarif_version::v2_2_prerelease_2024_08_08) + if (builder.get_version () >= sarif_version::v2_2_prerelease_csd01) notification->process_worklist (builder); m_notifications_arr->append<sarif_ice_notification> @@ -1552,7 +1552,7 @@ add_related_location (std::unique_ptr<sarif_location> location_obj, { /* Support for related locations within a notification was added in SARIF 2.2; see https://github.com/oasis-tcs/sarif-spec/issues/540 */ - if (builder.get_version () >= sarif_version::v2_2_prerelease_2024_08_08) + if (builder.get_version () >= sarif_version::v2_2_prerelease_csd01) sarif_location_manager::add_related_location (std::move (location_obj), builder); /* Otherwise implicitly discard LOCATION_OBJ. */ @@ -3392,8 +3392,8 @@ sarif_version_to_url (enum sarif_version version) gcc_unreachable (); case sarif_version::v2_1_0: return "https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/sarif-schema-2.1.0.json";; - case sarif_version::v2_2_prerelease_2024_08_08: - return "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/refs/tags/2.2-prerelease-2024-08-08/sarif-2.2/schema/sarif-2-2.schema.json";; + case sarif_version::v2_2_prerelease_csd01: + return "https://docs.oasis-open.org/sarif/sarif/v2.2/csd01/schema/sarif.json";; } } @@ -3409,9 +3409,8 @@ sarif_version_to_property (enum sarif_version version) gcc_unreachable (); case sarif_version::v2_1_0: return "2.1.0"; - case sarif_version::v2_2_prerelease_2024_08_08: - /* I would have used "2.2-prerelease-2024-08-08", - but the schema only accepts "2.2". */ + case sarif_version::v2_2_prerelease_csd01: + /* The schema only accepts "2.2". */ return "2.2"; } } @@ -4608,8 +4607,8 @@ get_dump_string_for_sarif_version (enum sarif_version version) gcc_unreachable (); case sarif_version::v2_1_0: return "v2_1_0"; - case sarif_version::v2_2_prerelease_2024_08_08: - return "v2_2_prerelease_2024_08_08"; + case sarif_version::v2_2_prerelease_csd01: + return "v2_2_prerelease_csd01"; } } diff --git a/gcc/diagnostics/sarif-sink.h b/gcc/diagnostics/sarif-sink.h index 2560b4a6651b..9dc354489c31 100644 --- a/gcc/diagnostics/sarif-sink.h +++ b/gcc/diagnostics/sarif-sink.h @@ -97,7 +97,7 @@ private: enum class sarif_version { v2_1_0, - v2_2_prerelease_2024_08_08, + v2_2_prerelease_csd01, num_versions }; diff --git a/gcc/libgdiagnostics.cc b/gcc/libgdiagnostics.cc index 3e61322541ad..46c371176776 100644 --- a/gcc/libgdiagnostics.cc +++ b/gcc/libgdiagnostics.cc @@ -1701,7 +1701,7 @@ diagnostic_manager_add_sarif_sink (diagnostic_manager *diag_mgr, break; case DIAGNOSTIC_SARIF_VERSION_2_2_PRERELEASE: sarif_gen_opts.m_version - = diagnostics::sarif_version::v2_2_prerelease_2024_08_08; + = diagnostics::sarif_version::v2_2_prerelease_csd01; break; } diff --git a/gcc/testsuite/gcc.dg/plugin/crash-test-ice-in-header-sarif-2_2.py b/gcc/testsuite/gcc.dg/plugin/crash-test-ice-in-header-sarif-2_2.py index d3e4d5403fed..d74ae30db79a 100644 --- a/gcc/testsuite/gcc.dg/plugin/crash-test-ice-in-header-sarif-2_2.py +++ b/gcc/testsuite/gcc.dg/plugin/crash-test-ice-in-header-sarif-2_2.py @@ -20,7 +20,7 @@ def sarif(): def test_basics(sarif): # We expect SARIF 2.2 schema = sarif['$schema'] - assert schema == "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/refs/tags/2.2-prerelease-2024-08-08/sarif-2.2/schema/sarif-2-2.schema.json"; + assert schema == "https://docs.oasis-open.org/sarif/sarif/v2.2/csd01/schema/sarif.json"; version = sarif['version'] assert version == "2.2" diff --git a/gcc/testsuite/lib/sarif-schema-2.2-prerelease-2024-08-08.json b/gcc/testsuite/lib/sarif-schema-2.2-prerelease-csd01.json similarity index 98% rename from gcc/testsuite/lib/sarif-schema-2.2-prerelease-2024-08-08.json rename to gcc/testsuite/lib/sarif-schema-2.2-prerelease-csd01.json index 4fa101b60fd8..2031820141bb 100644 --- a/gcc/testsuite/lib/sarif-schema-2.2-prerelease-2024-08-08.json +++ b/gcc/testsuite/lib/sarif-schema-2.2-prerelease-csd01.json @@ -1,7 +1,7 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema";, "title": "Static Analysis Results Format (SARIF) Version 2.2 JSON Schema", - "$id": "https://docs.oasis-open.org/sarif/sarif/v2.2/schemas/sarif-2.2.schema.json";, + "$id": "https://docs.oasis-open.org/sarif/sarif/v2.2/schema/sarif.json";, "description": "Static Analysis Results Format (SARIF) Version 2.2 JSON Schema: a standard format for the output of static analysis tools.", "additionalProperties": false, "type": "object", @@ -146,6 +146,7 @@ "enum": [ "analysisTarget", "attachment", + "conversionSource", "responseFile", "resultFile", "scannedFile", @@ -159,10 +160,12 @@ "uncontrolled", "driver", "extension", + "externalPropertyFile", "translation", "taxonomy", "policy", "referencedOnCommandLine", + "repositoryRoot", "memoryContents", "directory", "userSpecifiedConfiguration", @@ -1738,6 +1741,18 @@ "$ref": "#/$defs/reportingDescriptorRelationship" } }, + "precision": { + "description": "A number between 0.0 and 100.0 inclusive, representing the tool or tool maintainer's confidence that results produced by the rule are true positives.", + "type": "number", + "minimum": 0.0, + "maximum": 100.0 + }, + "securitySeverity": { + "description": "A number between 0.0 and 100.0 inclusive, representing the severity of the class of vulnerabilities found by results produced by the rule.", + "type": "number", + "minimum": 0.0, + "maximum": 100.0 + }, "properties": { "description": "Key/value pairs that provide additional information about the report.", "$ref": "#/$defs/propertyBag" @@ -2029,6 +2044,18 @@ "minimum": -1.0, "maximum": 100.0 }, + "precision": { + "description": "A number between 0.0 and 100.0 inclusive, representing the tool or tool maintainer's confidence that this result is a true positive.", + "type": "number", + "minimum": 0.0, + "maximum": 100.0 + }, + "securitySeverity": { + "description": "A number between 0.0 and 100.0 inclusive, representing the severity of the class of vulnerabilities found by this result.", + "type": "number", + "minimum": 0.0, + "maximum": 100.0 + }, "attachments": { "description": "A set of artifacts relevant to the result.", "type": "array", diff --git a/gcc/testsuite/lib/scansarif.exp b/gcc/testsuite/lib/scansarif.exp index b96458e398fd..a1fe90c41d57 100644 --- a/gcc/testsuite/lib/scansarif.exp +++ b/gcc/testsuite/lib/scansarif.exp @@ -113,7 +113,7 @@ proc verify-sarif-file { args } { if { $version == "2.1" } { set schema_file $srcdir/lib/sarif-schema-2.1.0.json } elseif { $version == "2.2" } { - set schema_file $srcdir/lib/sarif-schema-2.2-prerelease-2024-08-08.json + set schema_file $srcdir/lib/sarif-schema-2.2-prerelease-csd01.json } else { fail "unrecognized sarif version: $version" return
