SonarSource/sonarqube · error · SarifDeserializationException

VALUE

VALUE

Error message

Failed to read SARIF report at '%s': %s

What it means

When Jackson raises JsonMappingException whose message contains 'out of range' or 'overflow', the importer classifies the failure as Category.VALUE: the JSON is syntactically valid but a numeric value in the report cannot fit the target Java type during binding (e.g. a rule id index, result column, or timestamp field exceeding int/long range). The generic message 'Failed to read SARIF report at %s: %s' carries the path and Jackson's out-of-range/overflow description. This branch deliberately separates numeric-binding problems from generic mapping problems.

Source

Thrown at sonar-core/src/main/java/org/sonar/core/sarif/SarifSerializerImpl.java:91

      return mapper
        .enable(JsonParser.Feature.INCLUDE_SOURCE_IN_LOCATION)
        .addHandler(new DeserializationProblemHandler() {
          @Override
          public Object handleInstantiationProblem(DeserializationContext ctxt, Class<?> instClass, Object argument, Throwable t) throws IOException {
            if (!instClass.equals(SarifSchema210.Version.class)) {
              return NOT_HANDLED;
            }
            throw new UnsupportedSarifVersionException(format(UNSUPPORTED_VERSION_MESSAGE_TEMPLATE, argument), t);
          }
        })
        .readValue(reportPath.toFile(), SarifSchema210.class);
    } catch (UnsupportedSarifVersionException e) {
      throw new SarifDeserializationException(Category.MAPPING, e.getMessage(), e);
    } catch (JsonParseException e) {
      throw new SarifDeserializationException(Category.SYNTAX, format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);
    } catch (JsonMappingException e) {
      if (e.getMessage() != null && (e.getMessage().contains("out of range") || e.getMessage().contains("overflow"))) {
        throw new SarifDeserializationException(Category.VALUE, format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);
      }
      throw new SarifDeserializationException(Category.MAPPING, format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);
    } catch (FileNotFoundException e) {
      throw new SarifDeserializationException(Category.FILE_NOT_FOUND, format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);
    } catch (IOException e) {
      throw new IllegalStateException(format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);
    }
  }

  private static class UnsupportedSarifVersionException extends IOException {

    public UnsupportedSarifVersionException(String message, Throwable t) {
      super(message, t);
    }
  }
}

View on GitHub (pinned to 184c821202)

Solutions

  1. Open the report and find the offending numeric field named in the Jackson message; correct or cap it to the range of the corresponding Java type (int: -2147483648..2147483647)
  2. Fix the producing tool's configuration so it emits valid line/column/offset values, or upgrade SonarQube / sonar.sarif pojos to a version that widens the field type
  3. Validate the report against the SARIF 2.1.0 JSON schema before import; schema range constraints usually catch out-of-range values
  4. Pre-process the file with a script that clamps/remaps the oversized values, then re-run the import

Example fix

// before
"region": { "startLine": 99999999999 }  // overflows int -> VALUE category
// after
"region": { "startLine": 1 }  // valid 1-based line within int range
Defensive patterns

Strategy: validation

Validate before calling

void checkNumericRanges(Path sarif) throws IOException {
  JsonNode root = new ObjectMapper().readTree(sarif.toFile());
  for (JsonNode run : root.path("runs")) {
    for (JsonNode result : run.path("results")) {
      JsonNode region = result.path("region");
      long line = region.path("startLine").asLong(-1);
      if (line < 0 || line > Integer.MAX_VALUE)
        throw new IllegalArgumentException("startLine out of int range: " + line);
    }
  }
}

Try / catch

try {
  SarifSchema210 sarif = serializer.deserialize(reportPath);
} catch (SarifDeserializationException e) {
  if (e.getCategory() == Category.VALUE) {
    LOG.error("Numeric value out of range in {}: {}", reportPath, e.getMessage());
  } else throw e;
}

Prevention

When it happens

Trigger: SarifSerializerImpl.deserialize(Path) binds a SARIF JSON document in which some numeric property (e.g. region.startLine/startColumn, version fields, or any int/long-typed field in SarifSchema210) holds a literal too large or too small for the declared Java type, producing a JsonMappingException whose message contains 'out of range' or 'overflow' (typically wrapping JsonMappingException via InvalidFormatException/NumberFormatException during binding).

Common situations: A third-party SARIF producer emits startLine/startColumn values beyond Integer.MAX_VALUE (or negative/absurd sentinels like -1 vs 2^32-1 offsets); tools writing artifactLocation offsets as unsigned 64-bit; corrupted or hand-edited reports with huge numeric values; newer producer versions writing values SonarQube's SARIF POJOs (int) cannot hold.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/ea16de20858a74c3. Report an issue: GitHub.