{"record":{"id":"ea16de20858a74c3","repo":"SonarSource/sonarqube","slug":"value","errorCode":"VALUE","errorMessage":"Failed to read SARIF report at '%s': %s","messagePattern":"Failed to read SARIF report at '(.+?)': (.+?)","errorType":"exception","errorClass":"SarifDeserializationException","httpStatus":null,"severity":"error","filePath":"sonar-core/src/main/java/org/sonar/core/sarif/SarifSerializerImpl.java","lineNumber":91,"sourceCode":"      return mapper\n        .enable(JsonParser.Feature.INCLUDE_SOURCE_IN_LOCATION)\n        .addHandler(new DeserializationProblemHandler() {\n          @Override\n          public Object handleInstantiationProblem(DeserializationContext ctxt, Class<?> instClass, Object argument, Throwable t) throws IOException {\n            if (!instClass.equals(SarifSchema210.Version.class)) {\n              return NOT_HANDLED;\n            }\n            throw new UnsupportedSarifVersionException(format(UNSUPPORTED_VERSION_MESSAGE_TEMPLATE, argument), t);\n          }\n        })\n        .readValue(reportPath.toFile(), SarifSchema210.class);\n    } catch (UnsupportedSarifVersionException e) {\n      throw new SarifDeserializationException(Category.MAPPING, e.getMessage(), e);\n    } catch (JsonParseException e) {\n      throw new SarifDeserializationException(Category.SYNTAX, format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);\n    } catch (JsonMappingException e) {\n      if (e.getMessage() != null && (e.getMessage().contains(\"out of range\") || e.getMessage().contains(\"overflow\"))) {\n        throw new SarifDeserializationException(Category.VALUE, format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);\n      }\n      throw new SarifDeserializationException(Category.MAPPING, format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);\n    } catch (FileNotFoundException e) {\n      throw new SarifDeserializationException(Category.FILE_NOT_FOUND, format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);\n    } catch (IOException e) {\n      throw new IllegalStateException(format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);\n    }\n  }\n\n  private static class UnsupportedSarifVersionException extends IOException {\n\n    public UnsupportedSarifVersionException(String message, Throwable t) {\n      super(message, t);\n    }\n  }\n}\n","sourceCodeStart":73,"sourceCodeEnd":108,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/sonar-core/src/main/java/org/sonar/core/sarif/SarifSerializerImpl.java#L73-L108","documentation":"When Jackson raises JsonMappingException whose message contains 'out of range' or 'overflow', the importer classifies the failure as Category.VALUE: the JSON is syntactically valid but a numeric value in the report cannot fit the target Java type during binding (e.g. a rule id index, result column, or timestamp field exceeding int/long range). The generic message 'Failed to read SARIF report at %s: %s' carries the path and Jackson's out-of-range/overflow description. This branch deliberately separates numeric-binding problems from generic mapping problems.","triggerScenarios":"SarifSerializerImpl.deserialize(Path) binds a SARIF JSON document in which some numeric property (e.g. region.startLine/startColumn, version fields, or any int/long-typed field in SarifSchema210) holds a literal too large or too small for the declared Java type, producing a JsonMappingException whose message contains 'out of range' or 'overflow' (typically wrapping JsonMappingException via InvalidFormatException/NumberFormatException during binding).","commonSituations":"A third-party SARIF producer emits startLine/startColumn values beyond Integer.MAX_VALUE (or negative/absurd sentinels like -1 vs 2^32-1 offsets); tools writing artifactLocation offsets as unsigned 64-bit; corrupted or hand-edited reports with huge numeric values; newer producer versions writing values SonarQube's SARIF POJOs (int) cannot hold.","solutions":["Open the report and find the offending numeric field named in the Jackson message; correct or cap it to the range of the corresponding Java type (int: -2147483648..2147483647)","Fix the producing tool's configuration so it emits valid line/column/offset values, or upgrade SonarQube / sonar.sarif pojos to a version that widens the field type","Validate the report against the SARIF 2.1.0 JSON schema before import; schema range constraints usually catch out-of-range values","Pre-process the file with a script that clamps/remaps the oversized values, then re-run the import"],"exampleFix":"// before\n\"region\": { \"startLine\": 99999999999 }  // overflows int -> VALUE category\n// after\n\"region\": { \"startLine\": 1 }  // valid 1-based line within int range","handlingStrategy":"validation","validationCode":"void checkNumericRanges(Path sarif) throws IOException {\n  JsonNode root = new ObjectMapper().readTree(sarif.toFile());\n  for (JsonNode run : root.path(\"runs\")) {\n    for (JsonNode result : run.path(\"results\")) {\n      JsonNode region = result.path(\"region\");\n      long line = region.path(\"startLine\").asLong(-1);\n      if (line < 0 || line > Integer.MAX_VALUE)\n        throw new IllegalArgumentException(\"startLine out of int range: \" + line);\n    }\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  SarifSchema210 sarif = serializer.deserialize(reportPath);\n} catch (SarifDeserializationException e) {\n  if (e.getCategory() == Category.VALUE) {\n    LOG.error(\"Numeric value out of range in {}: {}\", reportPath, e.getMessage());\n  } else throw e;\n}","preventionTips":["Validate reports against the SARIF 2.1.0 schema, which constrains numeric fields","Check the producing tool for known bugs emitting out-of-range line/column values; upgrade it","Never emit sentinel values like -1 or 2^32-style unsigned values in SARIF numeric fields","Keep sonar.sarif pojos / SonarQube up to date so field types match the spec"],"tags":["sarif","jackson","numeric-overflow","binding"],"backgroundTag":"value-out-of-range","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}