Subject: [media-types] Notice of request for media-type registration: application/sarif+json

From: Chet Ensign <[email-masked]>
Date: Thu, 9 Apr 2020 14:33:42 -0400

Members of the OASIS Static Analysis Results Interchange Format (SARIF)
Technical Committee wish to register a media type associated with the
recently-approved SARIF Version 2.1.0 OASIS Standard. We post the
registration request form here for review before submitting it to IANA.

I am the administrative contact for OASIS for IANA registration requests.
The technical contacts for this request are Michael Fanning (
[email-masked]) and Laurence Golding ([email-masked]). They
are tasked by the OASIS SARIF TC to provide any additional information or
answers to questions that you may have.

Thank you in advance for your comments and feedback.

/chet ensign
OASIS Open, Inc.

IETF RFC6838 Section 5.6. Registration Template
https://tools.ietf.org/html/rfc6838#section-5.6

---

Type name: application

Subtype name: sarif+json

Required parameters: N/A

Optional parameters: N/A

Encoding considerations: UTF8 only

Security considerations:

- The use of absolute paths in analysis result location URIs might reveal
sensitive information about the machine on which the scan was performed.
- The use of the hostname component in analysis result location URI might
reveal the network location of the machine on which the scan was performed.
- The use of raw HTML in message strings expressed in Markdown might allow
arbitrary code execution (for example, through javascript: links).
- The use of deeply nested constructs in Markdown message strings might
lead to stack overflow in some Markdown implementations.
- Certain properties of the SARIF object model might reveal information
about the machine on which a scan was run. (The specification allows such
properties to be omitted or "redacted".)
- Certain properties of the SARIF object model (such as the command line
that invoked the analysis tool) can contain arbitrary commands which might
damage a machine on which they are run.

Interoperability considerations: N/A

Published specification:

Static Analysis Results Interchange Format (SARIF) Version 2.1.0. Edited by
Michael C. Fanning and Laurence J. Golding. 27 March 2020. OASIS Standard.
https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html.
Latest stage:
https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html.

Applications that use this media type:

The following list is not exhaustive:

- Static analysis tools
- Static analysis results visualization tools (viewers)
- Bug filing tools
- Defect databases
- Compliance systems

Fragment identifier considerations: N/A

Additional information:

  Deprecated alias names for this type: N/A
  Magic number(s): N/A
  File extension(s): .sarif, .sarif.json
  Macintosh file type code(s): N/A

Person & email address to contact for further information:

Michael C. Fanning ([email-masked]), Laurence J. Golding (
[email-masked]), and Chet Ensign ([email-masked])

Intended usage: LIMITED USE

Restrictions on usage: N/A

Author:

OASIS Static Analysis Results Interchange Format (SARIF) TC (
https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=sarif)

Change controller:

OASIS Open (https://www.oasis-open.org/)

Provisional registration? (standards tree only): No

-- 

/chet
----------------
Chet Ensign
Chief Technical Community Steward
OASIS: Advancing open source & open standards for the information society
http://www.oasis-open.org

Mobile: +1 201-341-1393