microsoft / sarif-sdk

.NET code and supporting files for working with the 'Static Analysis Results Interchange Format' (SARIF, see https://github.com/oasis-tcs/sarif-spec)
Other
192 stars 90 forks source link

Validating Visitor should not break on name changes #2685

Open marmegh opened 1 year ago

marmegh commented 1 year ago

RuleId should be the source of truth for identifying a rule instead of RuleName, as only the RuleId should be guaranteed to not change. The ValidatingVisitor uses a RuleNameToValidationMethods mapping to lookup and subsequently validate/revalidate a given rule. If/when a RuleName is changed, revalidating of previous results breaks due to this name change and instead a NoMatch is returned. To support tool backwards compatibility, switching to a RuleIdToValidationMethods mapping would be a more stable implementation. I would highly recommend supporting both approaches in the ValidatingVisitor to prevent additional backward compatibility issues.

cc: @rwoll, @alisonmaclellan, @Jeremiah-Johnson, @AmyFeld