{"record":{"id":"895dfaa59db52c5c","repo":"can1357/oh-my-pi","slug":"sarif-artifact-location-is-missing-its-uri","errorCode":null,"errorMessage":"SARIF artifact location is missing its URI","messagePattern":"SARIF artifact location is missing its URI","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/coding-agent/src/security/importers/sarif.ts","lineNumber":105,"sourceCode":"\t\t\treturn \"medium\";\n\t\tcase \"note\":\n\t\t\treturn \"low\";\n\t\tdefault:\n\t\t\treturn \"informational\";\n\t}\n}\n\nfunction pathIsWithin(candidate: string, root: string): boolean {\n\treturn candidate === root || candidate.startsWith(`${root}${path.sep}`);\n}\n\nasync function resolveSarifArtifactPath(\n\tartifact: SarifArtifactLocation,\n\trun: SarifRun,\n\trepositoryRoot: string,\n): Promise<string> {\n\tconst uri = artifact.uri;\n\tif (!uri) throw new Error(\"SARIF artifact location is missing its URI\");\n\tconst rootUrl = pathToFileURL(`${repositoryRoot}${path.sep}`);\n\tlet baseUrl = rootUrl;\n\tif (artifact.uriBaseId) {\n\t\tconst declaredBase = run.originalUriBaseIds?.[artifact.uriBaseId]?.uri;\n\t\tif (!declaredBase && artifact.uriBaseId !== \"%SRCROOT%\") {\n\t\t\tthrow new Error(`SARIF artifact uses an unknown URI base: ${artifact.uriBaseId}`);\n\t\t}\n\t\tbaseUrl = declaredBase ? new URL(declaredBase, rootUrl) : rootUrl;\n\t}\n\tconst resolvedUrl = new URL(uri.replaceAll(\"\\\\\", \"/\"), baseUrl);\n\tif (resolvedUrl.protocol !== \"file:\") {\n\t\tthrow new Error(`SARIF artifact URI must resolve to a repository file: ${uri}`);\n\t}\n\tconst absolute = path.resolve(fileURLToPath(resolvedUrl));\n\tif (!pathIsWithin(absolute, repositoryRoot)) {\n\t\tthrow new Error(`SARIF artifact resolves outside the repository: ${uri}`);\n\t}\n\tconst canonical = await fs.realpath(absolute).catch(error => {","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/coding-agent/src/security/importers/sarif.ts#L87-L123","documentation":"SARIF result locations reference artifacts via a location object that must carry a uri. resolveSarifArtifactPath throws when artifact.uri is missing/empty, since a path cannot be resolved against the repository root or any uriBaseId without it.","triggerScenarios":"A SARIF run contains a result whose artifactLocation has no uri field (or an empty string) — e.g. physicalLocation.artifactLocation = { uriBaseId: \"%SRCROOT%\" } with no uri.","commonSituations":"Scanners emitting relative locations only via uriBaseId conventions without a uri; malformed or minimized SARIF output; hand-written SARIF missing the uri key.","solutions":["Fix the SARIF producer so every artifactLocation includes a uri (even \"\" is rejected — use a relative path like \"src/x.ts\")","Post-process the SARIF to fill in the missing uri from physicalLocation or related fields before importing","Drop results lacking artifact URIs if they are not meaningful for the import"],"exampleFix":"// before\n\"artifactLocation\": { \"uriBaseId\": \"%SRCROOT%\" }\n// after\n\"artifactLocation\": { \"uri\": \"src/auth.ts\", \"uriBaseId\": \"%SRCROOT%\" }","handlingStrategy":"validation","validationCode":"for (const run of sarif.runs) {\n  for (const result of run.results ?? []) {\n    for (const loc of result.locations ?? []) {\n      const al = loc.physicalLocation?.artifactLocation;\n      if (!al?.uri) throw new Error(`SARIF result ${result.ruleId} has artifactLocation without uri`);\n    }\n  }\n}","typeGuard":"function hasArtifactUri(loc: unknown): loc is { uri: string; uriBaseId?: string } {\n  return typeof loc === \"object\" && loc !== null && typeof (loc as any).uri === \"string\" && (loc as any).uri.length > 0;\n}","tryCatchPattern":"try {\n  const bundle = await importSarif(sarifDir, repoRoot);\n} catch (err) {\n  if (err instanceof Error && err.message === \"SARIF artifact location is missing its URI\") {\n    console.error(\"A result lacks artifactLocation.uri — fix the scanner output or drop that result\");\n  } else throw err;\n}","preventionTips":["Validate SARIF against the official schema before import","Configure the scanner to always emit relative file URIs for result locations","Pre-process SARIF to add uri derived from related locations when missing","Prefer scanners with known-good SARIF emission"],"tags":["sarif","import","missing-uri"],"backgroundTag":"missing-uri","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}