{"record":{"id":"9619c74c792ea11c","repo":"SonarSource/sonarqube","slug":"unable-to-serialize-sarif","errorCode":null,"errorMessage":"Unable to serialize SARIF","messagePattern":"Unable to serialize SARIF","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"sonar-core/src/main/java/org/sonar/core/sarif/SarifSerializerImpl.java","lineNumber":66,"sourceCode":"\n  @Inject\n  public SarifSerializerImpl() {\n    this(new ObjectMapper());\n  }\n\n  @VisibleForTesting\n  SarifSerializerImpl(ObjectMapper mapper) {\n    this.mapper = mapper;\n  }\n\n  @Override\n  public String serialize(SarifSchema210 sarif210) {\n    try {\n      return mapper\n        .writerWithDefaultPrettyPrinter()\n        .writeValueAsString(sarif210);\n    } catch (JsonProcessingException e) {\n      throw new IllegalStateException(\"Unable to serialize SARIF\", e);\n    }\n  }\n\n  @Override\n  public SarifSchema210 deserialize(Path reportPath) {\n    try {\n      return mapper\n        .enable(JsonParser.Feature.INCLUDE_SOURCE_IN_LOCATION)\n        .addHandler(new DeserializationProblemHandler() {\n          @Override\n          public Object handleInstantiationProblem(DeserializationContext ctxt, Class<?> instClass, Object argument, Throwable t) throws IOException {\n            if (!instClass.equals(SarifSchema210.Version.class)) {\n              return NOT_HANDLED;\n            }\n            throw new UnsupportedSarifVersionException(format(UNSUPPORTED_VERSION_MESSAGE_TEMPLATE, argument), t);\n          }\n        })\n        .readValue(reportPath.toFile(), SarifSchema210.class);","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/sonar-core/src/main/java/org/sonar/core/sarif/SarifSerializerImpl.java#L48-L84","documentation":"SarifSerializerImpl.serialize() wraps JsonProcessingException in an IllegalStateException with this message when Jackson cannot serialize a SarifSchema210 object to JSON. Since the SARIF model should always be serializable, failure indicates the in-memory object graph violates the expected model (null where a value is required, an unserializable type, or an invalid value Jackson refuses to write).","triggerScenarios":"Calling serialize(SarifSchema210) with a model containing fields Jackson cannot write (unwrapped/absent required structures, an incompatible object type, or a misconfigured value triggering a JsonMappingException).","commonSituations":"Programmatically building a SARIF report with null required nodes or custom objects placed where strings/objects are expected; upgrading the SARIF model classes so a constructed object no longer matches the mapper's expectations.","solutions":["Inspect the cause (JsonProcessingException) message to find the field that failed to serialize.","Build the SarifSchema210 through the provided model builders/APIs, ensuring required nodes (version, schema, runs) are set.","Check for custom or third-party objects inserted into the model that Jackson cannot serialize.","Verify no code path mutates the model to null after construction."],"exampleFix":"// before\nrun.setResults(null); // missing required node\n// after\nrun.setResults(results == null ? List.of() : results);","handlingStrategy":"try-catch","validationCode":"if (sarif == null || sarif.getRuns() == null || sarif.getRuns().isEmpty()) {\n  throw new IllegalArgumentException(\"SARIF must contain at least one run\");\n}","typeGuard":"boolean isSerializableSarif(SarifSchema210 sarif) {\n  return sarif != null && sarif.getVersion() != null && sarif.getRuns() != null;\n}","tryCatchPattern":"try {\n  String json = serializer.serialize(sarif);\n} catch (IllegalStateException e) {\n  // e.getCause() is the JsonProcessingException — inspect its path/message\n  throw new IllegalStateException(\"Report generation failed: \" + e.getCause().getMessage(), e);\n}","preventionTips":["Build SARIF objects only through their builders; never leave required nodes null.","Round-trip serialize/deserialize in unit tests to catch model violations early.","Avoid inserting raw third-party objects into the SARIF model."],"tags":["sarif","jackson","serialization"],"backgroundTag":"json-marshal-failed","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}