SonarSource/sonarqube · error · SarifDeserializationException

MAPPING

MAPPING

Error message

Failed to read SARIF report at '%s': %s

What it means

SarifSerializerImpl.deserialize() throws SarifDeserializationException with Category.MAPPING and this message when Jackson fails to map the SARIF file to SarifSchema210 (JsonMappingException not classified as value-range or other specialized categories). This indicates a structural mismatch: the JSON parses but does not match the SARIF 2.1.0 model. Version problems are routed to MAPPING with the version message; range/overflow to VALUE; parse errors to SYNTAX.

Source

Thrown at sonar-core/src/main/java/org/sonar/core/sarif/SarifSerializerImpl.java:86

  }

  @Override
  public SarifSchema210 deserialize(Path reportPath) {
    try {
      return mapper
        .enable(JsonParser.Feature.INCLUDE_SOURCE_IN_LOCATION)
        .addHandler(new DeserializationProblemHandler() {
          @Override
          public Object handleInstantiationProblem(DeserializationContext ctxt, Class<?> instClass, Object argument, Throwable t) throws IOException {
            if (!instClass.equals(SarifSchema210.Version.class)) {
              return NOT_HANDLED;
            }
            throw new UnsupportedSarifVersionException(format(UNSUPPORTED_VERSION_MESSAGE_TEMPLATE, argument), t);
          }
        })
        .readValue(reportPath.toFile(), SarifSchema210.class);
    } catch (UnsupportedSarifVersionException e) {
      throw new SarifDeserializationException(Category.MAPPING, e.getMessage(), e);
    } catch (JsonParseException e) {
      throw new SarifDeserializationException(Category.SYNTAX, format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);
    } catch (JsonMappingException e) {
      if (e.getMessage() != null && (e.getMessage().contains("out of range") || e.getMessage().contains("overflow"))) {
        throw new SarifDeserializationException(Category.VALUE, format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);
      }
      throw new SarifDeserializationException(Category.MAPPING, format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);
    } catch (FileNotFoundException e) {
      throw new SarifDeserializationException(Category.FILE_NOT_FOUND, format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);
    } catch (IOException e) {
      throw new IllegalStateException(format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);
    }
  }

  private static class UnsupportedSarifVersionException extends IOException {

    public UnsupportedSarifVersionException(String message, Throwable t) {
      super(message, t);

View on GitHub (pinned to 184c821202)

Solutions

  1. Read the embedded cause message to find which JSON property failed to map, and fix that field in the report.
  2. Validate the file against the SARIF 2.1.0 schema (sarif-multitool 'validate' or a JSON-schema validator).
  3. Ensure the file is actually a SARIF report, not another JSON format, before importing.
  4. Regenerate the report with the producing tool updated to emit compliant SARIF 2.1.0.

Example fix

// before: pointing import at wrong file
sarif.import("eslint-report.json"); // plain JSON, not SARIF
// after
eslint --format @microsoft/eslint-formatter-sarif --output-file eslint-report.sarif .
sarif.import("eslint-report.sarif");
Defensive patterns

Strategy: try-catch

Validate before calling

// cheap structural check before deserialize
String json = Files.readString(path);
if (!json.contains("\"version\"") || !json.contains("\"runs\"")) {
  throw new IllegalArgumentException("Not a SARIF 2.1.0 report: " + path);
}

Type guard

boolean looksLikeSarif(Path p) throws IOException {
  String s = Files.readString(p);
  return s.contains("\"version\":") && s.contains("\"runs\":");
}

Try / catch

try {
  SarifSchema210 sarif = serializer.deserialize(path);
} catch (SarifDeserializationException e) {
  switch (e.getCategory()) {
    case SYNTAX: /* malformed JSON */ break;
    case VALUE: /* numeric out-of-range */ break;
    case MAPPING: /* structurally invalid SARIF */ break;
  }
}

Prevention

When it happens

Trigger: Calling deserialize(Path) on a JSON file that is valid JSON but violates the SarifSchema210 contract — wrong property types (e.g. a number where a string is expected), missing required wrappers, or nested structures that don't fit the model, where the mapping exception message isn't an out-of-range/overflow case.

Common situations: Pointing the import at a non-SARIF JSON report (e.g. ESLint JSON instead of its SARIF output); a third-party tool emitting SARIF with property type deviations; truncated or hand-edited SARIF files with inconsistent types.

Understand the failure class

Background: "failed to unmarshal" / json.Unmarshal errors: why parsing a response into a Go struct fails and how to fix it — this error's family across 23 libraries.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/31ae671768cce175. Report an issue: GitHub.