Skip to content

Fix SARIF handling of unknown source paths - #4296

Merged
hazendaz merged 2 commits into
spotbugs:masterfrom
aoto-tech:fix/sarif-unknown-source-1412
Sep 8, 2026
Merged

hazendaz merged 2 commits into
spotbugs:masterfrom
aoto-tech:fix/sarif-unknown-source-1412

Conversation

@aoto-tech

Copy link
Copy Markdown
Contributor

Summary

  • skip invalid SARIF physical locations when a source filename is unknown
  • avoid writing URISyntaxException stack traces directly to stderr during SARIF generation
  • preserve logical locations and add regression coverage for unknown and known source filenames
  • add a changelog entry for the fix

Testing

  • JAVA_HOME=/home/ubuntu/.local/jdks/jdk-17.0.20.1+1 PATH=/home/ubuntu/.local/jdks/jdk-17.0.20.1+1/bin:$PATH ./gradlew :spotbugs-tests:test --tests edu.umd.cs.findbugs.sarif.SarifBugReporterTest
  • JAVA_HOME=/home/ubuntu/.local/jdks/jdk-17.0.20.1+1 PATH=/home/ubuntu/.local/jdks/jdk-17.0.20.1+1/bin:$PATH ./gradlew :spotbugs:spotlessJavaCheck :spotbugs-tests:spotlessJavaCheck
  • git diff --check

Notes: ./gradlew spotlessApply build smoketest was attempted locally, but this aarch64 environment fails resolving the Eclipse SWT artifact for :eclipsePlugin:compileJava, unrelated to this SARIF change.

Fixes #1412

@hazendaz hazendaz added this to the Spotbugs 4.10.5 milestone Sep 7, 2026
@hazendaz hazendaz self-assigned this Sep 7, 2026
@hazendaz
hazendaz merged commit f585f98 into spotbugs:master Sep 8, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SARIF output + unknown source filenames writes exceptions to stderr

2 participants