{"record":{"id":"3841fa0176e55ab8","repo":"can1357/oh-my-pi","slug":"sarif-artifact-uses-an-unknown-uri-base-artifac","errorCode":null,"errorMessage":"SARIF artifact uses an unknown URI base: ${artifact.uriBaseId}","messagePattern":"SARIF artifact uses an unknown URI base: (.+?)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/coding-agent/src/security/importers/sarif.ts","lineNumber":111,"sourceCode":"}\n\nfunction pathIsWithin(candidate: string, root: string): boolean {\n\treturn candidate === root || candidate.startsWith(`${root}${path.sep}`);\n}\n\nasync function resolveSarifArtifactPath(\n\tartifact: SarifArtifactLocation,\n\trun: SarifRun,\n\trepositoryRoot: string,\n): Promise<string> {\n\tconst uri = artifact.uri;\n\tif (!uri) throw new Error(\"SARIF artifact location is missing its URI\");\n\tconst rootUrl = pathToFileURL(`${repositoryRoot}${path.sep}`);\n\tlet baseUrl = rootUrl;\n\tif (artifact.uriBaseId) {\n\t\tconst declaredBase = run.originalUriBaseIds?.[artifact.uriBaseId]?.uri;\n\t\tif (!declaredBase && artifact.uriBaseId !== \"%SRCROOT%\") {\n\t\t\tthrow new Error(`SARIF artifact uses an unknown URI base: ${artifact.uriBaseId}`);\n\t\t}\n\t\tbaseUrl = declaredBase ? new URL(declaredBase, rootUrl) : rootUrl;\n\t}\n\tconst resolvedUrl = new URL(uri.replaceAll(\"\\\\\", \"/\"), baseUrl);\n\tif (resolvedUrl.protocol !== \"file:\") {\n\t\tthrow new Error(`SARIF artifact URI must resolve to a repository file: ${uri}`);\n\t}\n\tconst absolute = path.resolve(fileURLToPath(resolvedUrl));\n\tif (!pathIsWithin(absolute, repositoryRoot)) {\n\t\tthrow new Error(`SARIF artifact resolves outside the repository: ${uri}`);\n\t}\n\tconst canonical = await fs.realpath(absolute).catch(error => {\n\t\tif (error instanceof Error && \"code\" in error && error.code === \"ENOENT\") return absolute;\n\t\tthrow error;\n\t});\n\tif (!pathIsWithin(canonical, repositoryRoot)) {\n\t\tthrow new Error(`SARIF artifact resolves outside the repository through a symbolic link: ${uri}`);\n\t}","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/coding-agent/src/security/importers/sarif.ts#L93-L129","documentation":"SARIF artifacts can qualify their uri with a uriBaseId that must map to an entry in run.originalUriBaseIds (the built-in \"%SRCROOT%\" is always accepted, resolving to the repository root). When the id is not declared and is not \"%SRCROOT%\", the importer cannot know the base URL and throws.","triggerScenarios":"resolveSarifArtifactPath sees artifact.uriBaseId set, run.originalUriBaseIds has no entry for that id, and the id is not the literal \"%SRCROOT%\".","commonSituations":"Scanner invents custom uriBaseIds (e.g. \"PROJECT_ROOT\") without declaring them; SARIF files concatenated from runs with different base declarations; typo in the uriBaseId vs the originalUriBaseIds key.","solutions":["Add the missing key to run.originalUriBaseIds in the SARIF (e.g. { \"PROJECT_ROOT\": { \"uri\": \"file:///repo/root/\" } })","Use the standard \"%SRCROOT%\" uriBaseId for repository-root-relative URIs","Fix the typo so uriBaseId matches an existing originalUriBaseIds entry"],"exampleFix":"// before\n\"originalUriBaseIds\": { \"%SRCROOT%\": { \"uri\": \"file:///repo/\" } }, \"uriBaseId\": \"SRCROOT\"\n// after\n\"originalUriBaseIds\": { \"%SRCROOT%\": { \"uri\": \"file:///repo/\" }, \"SRCROOT\": { \"uri\": \"file:///repo/\" } }","handlingStrategy":"validation","validationCode":"for (const run of sarif.runs) {\n  for (const result of run.results ?? []) {\n    for (const loc of result.locations ?? []) {\n      const id = loc.physicalLocation?.artifactLocation?.uriBaseId;\n      if (id && id !== \"%SRCROOT%\" && !run.originalUriBaseIds?.[id]?.uri) {\n        throw new Error(`uriBaseId \"${id}\" has no originalUriBaseIds entry`);\n      }\n    }\n  }\n}","typeGuard":"function uriBaseIdIsDeclared(run: { originalUriBaseIds?: Record<string, { uri?: string }> }, id?: string): boolean {\n  return !id || id === \"%SRCROOT%\" || Boolean(run.originalUriBaseIds?.[id]?.uri);\n}","tryCatchPattern":"try {\n  const bundle = await importSarif(sarifDir, repoRoot);\n} catch (err) {\n  if (err instanceof Error && err.message.startsWith(\"SARIF artifact uses an unknown URI base\")) {\n    console.error(err.message + \" — add the base to run.originalUriBaseIds or use %SRCROOT%\");\n  } else throw err;\n}","preventionTips":["Use the standard %SRCROOT% uriBaseId for repo-relative URIs","Ensure the scanner declares every uriBaseId it uses in run.originalUriBaseIds","Normalize SARIF after merging runs from multiple tools (bases can differ per run)","Cross-check uriBaseId keys against originalUriBaseIds keys in a pre-import lint"],"tags":["sarif","import","uribaseid"],"backgroundTag":"unknown-uri-base","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}