SonarSource/sonarqube · error · IllegalStateException

Unable to serialize SARIF

Error message

Unable to serialize SARIF

What it means

SarifSerializerImpl.serialize() wraps JsonProcessingException in an IllegalStateException with this message when Jackson cannot serialize a SarifSchema210 object to JSON. Since the SARIF model should always be serializable, failure indicates the in-memory object graph violates the expected model (null where a value is required, an unserializable type, or an invalid value Jackson refuses to write).

Source

Thrown at sonar-core/src/main/java/org/sonar/core/sarif/SarifSerializerImpl.java:66

  @Inject
  public SarifSerializerImpl() {
    this(new ObjectMapper());
  }

  @VisibleForTesting
  SarifSerializerImpl(ObjectMapper mapper) {
    this.mapper = mapper;
  }

  @Override
  public String serialize(SarifSchema210 sarif210) {
    try {
      return mapper
        .writerWithDefaultPrettyPrinter()
        .writeValueAsString(sarif210);
    } catch (JsonProcessingException e) {
      throw new IllegalStateException("Unable to serialize SARIF", e);
    }
  }

  @Override
  public SarifSchema210 deserialize(Path reportPath) {
    try {
      return mapper
        .enable(JsonParser.Feature.INCLUDE_SOURCE_IN_LOCATION)
        .addHandler(new DeserializationProblemHandler() {
          @Override
          public Object handleInstantiationProblem(DeserializationContext ctxt, Class<?> instClass, Object argument, Throwable t) throws IOException {
            if (!instClass.equals(SarifSchema210.Version.class)) {
              return NOT_HANDLED;
            }
            throw new UnsupportedSarifVersionException(format(UNSUPPORTED_VERSION_MESSAGE_TEMPLATE, argument), t);
          }
        })
        .readValue(reportPath.toFile(), SarifSchema210.class);

View on GitHub (pinned to 184c821202)

Solutions

1. Inspect the cause (JsonProcessingException) message to find the field that failed to serialize.
2. Build the SarifSchema210 through the provided model builders/APIs, ensuring required nodes (version, schema, runs) are set.
3. Check for custom or third-party objects inserted into the model that Jackson cannot serialize.
4. Verify no code path mutates the model to null after construction.

Example fix

// before
run.setResults(null); // missing required node
// after
run.setResults(results == null ? List.of() : results);

if (sarif == null || sarif.getRuns() == null || sarif.getRuns().isEmpty()) {
  throw new IllegalArgumentException("SARIF must contain at least one run");
}

boolean isSerializableSarif(SarifSchema210 sarif) {
  return sarif != null && sarif.getVersion() != null && sarif.getRuns() != null;
}

try {
  String json = serializer.serialize(sarif);
} catch (IllegalStateException e) {
  // e.getCause() is the JsonProcessingException — inspect its path/message
  throw new IllegalStateException("Report generation failed: " + e.getCause().getMessage(), e);
}

When it happens

Trigger: Calling serialize(SarifSchema210) with a model containing fields Jackson cannot write (unwrapped/absent required structures, an incompatible object type, or a misconfigured value triggering a JsonMappingException).

Common situations: Programmatically building a SARIF report with null required nodes or custom objects placed where strings/objects are expected; upgrading the SARIF model classes so a constructed object no longer matches the mapper's expectations.

Understand the failure class

Background: json.Marshal / "failed to marshal" errors in Go: why "unsupported type" happens and how to fix it — this error's family across 22 libraries.

Related errors

• SYNTAX
• VALUE
• Fail to write into file:
• Fail to traverse file:
• Fail to open file

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/9619c74c792ea11c. Report an issue: GitHub.