SonarSource/sonarqube · error · IllegalStateException

Unable to serialize SARIF

Error message

Unable to serialize SARIF

What it means

SarifSerializerImpl.serialize() wraps JsonProcessingException in an IllegalStateException with this message when Jackson cannot serialize a SarifSchema210 object to JSON. Since the SARIF model should always be serializable, failure indicates the in-memory object graph violates the expected model (null where a value is required, an unserializable type, or an invalid value Jackson refuses to write).

Solutions

1. Inspect the cause (JsonProcessingException) message to find the field that failed to serialize.
2. Build the SarifSchema210 through the provided model builders/APIs, ensuring required nodes (version, schema, runs) are set.
3. Check for custom or third-party objects inserted into the model that Jackson cannot serialize.
4. Verify no code path mutates the model to null after construction.

Example fix

// before
run.setResults(null); // missing required node
// after
run.setResults(results == null ? List.of() : results);

if (sarif == null || sarif.getRuns() == null || sarif.getRuns().isEmpty()) {
  throw new IllegalArgumentException("SARIF must contain at least one run");
}

boolean isSerializableSarif(SarifSchema210 sarif) {
  return sarif != null && sarif.getVersion() != null && sarif.getRuns() != null;
}

try {
  String json = serializer.serialize(sarif);
} catch (IllegalStateException e) {
  // e.getCause() is the JsonProcessingException — inspect its path/message
  throw new IllegalStateException("Report generation failed: " + e.getCause().getMessage(), e);
}

When it happens

Trigger: Calling serialize(SarifSchema210) with a model containing fields Jackson cannot write (unwrapped/absent required structures, an incompatible object type, or a misconfigured value triggering a JsonMappingException).

Common situations: Programmatically building a SARIF report with null required nodes or custom objects placed where strings/objects are expected; upgrading the SARIF model classes so a constructed object no longer matches the mapper's expectations.

Understand the failure class

Background: json.Marshal / "failed to marshal" errors in Go: why "unsupported type" happens and how to fix it — this error's family across 22 libraries.

Related errors

• SYNTAX
• VALUE
• Can not write message
• Error while writing protobuf message
• Fail to open file

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/9619c74c792ea11c. Report an issue: GitHub.

Appendix: source

Thrown at sonar-core/src/main/java/org/sonar/core/sarif/SarifSerializerImpl.java:66

  @Inject
  public SarifSerializerImpl() {
    this(new ObjectMapper());
  }

  @VisibleForTesting
  SarifSerializerImpl(ObjectMapper mapper) {
    this.mapper = mapper;
  }

  @Override
  public String serialize(SarifSchema210 sarif210) {
    try {
      return mapper
        .writerWithDefaultPrettyPrinter()
        .writeValueAsString(sarif210);
    } catch (JsonProcessingException e) {
      throw new IllegalStateException("Unable to serialize SARIF", e);
    }
  }

  @Override
  public SarifSchema210 deserialize(Path reportPath) {
    try {
      return mapper
        .enable(JsonParser.Feature.INCLUDE_SOURCE_IN_LOCATION)
        .addHandler(new DeserializationProblemHandler() {
          @Override
          public Object handleInstantiationProblem(DeserializationContext ctxt, Class<?> instClass, Object argument, Throwable t) throws IOException {
            if (!instClass.equals(SarifSchema210.Version.class)) {
              return NOT_HANDLED;
            }
            throw new UnsupportedSarifVersionException(format(UNSUPPORTED_VERSION_MESSAGE_TEMPLATE, argument), t);
          }
        })
        .readValue(reportPath.toFile(), SarifSchema210.class);

View on GitHub (pinned to 184c821202)