[media-types] Notice of request for media-type registration: application/sarif+json

Chet Ensign <chet.ensign@oasis-open.org> Thu, 09 April 2020 18:34 UTC

MIME-Version: 1.0
From: Chet Ensign <chet.ensign@oasis-open.org>
Date: Thu, 09 Apr 2020 14:33:42 -0400
Message-ID: <CAAwgnnPTwLaJo8fBYZQKOc+7hK-mDWKedEauW5SeYfvGuGWNZw@mail.gmail.com>
To: media-types@iana.org
Cc: mikefan@microsoft.com, "Larry Golding (Myriad Consulting Inc)" <v-lgold@microsoft.com>
Content-Type: multipart/alternative; boundary="000000000000d37dbe05a2dfdbd0"
Archived-At: <https://mailarchive.ietf.org/arch/msg/media-types/dYcLl3hit3UIfVxyvmSBROq_o0A>
Subject: [media-types] Notice of request for media-type registration: application/sarif+json
Precedence: list

Members of the OASIS Static Analysis Results Interchange Format (SARIF)
Technical Committee wish to register a media type associated with the
recently-approved SARIF Version 2.1.0 OASIS Standard. We post the
registration request form here for review before submitting it to IANA.

I am the administrative contact for OASIS for IANA registration requests.
The technical contacts for this request are Michael Fanning (
mikefan@microsoft.com) and Laurence Golding (v-lgold@microsoft.com). They
are tasked by the OASIS SARIF TC to provide any additional information or
answers to questions that you may have.

Thank you in advance for your comments and feedback.

/chet ensign
OASIS Open, Inc.

IETF RFC6838 Section 5.6. Registration Template
https://tools.ietf.org/html/rfc6838#section-5.6

---

Type name: application

Subtype name: sarif+json

Required parameters: N/A

Optional parameters: N/A

Encoding considerations: UTF8 only

Security considerations:

- The use of absolute paths in analysis result location URIs might reveal
sensitive information about the machine on which the scan was performed.
- The use of the hostname component in analysis result location URI might
reveal the network location of the machine on which the scan was performed.
- The use of raw HTML in message strings expressed in Markdown might allow
arbitrary code execution (for example, through javascript: links).
- The use of deeply nested constructs in Markdown message strings might
lead to stack overflow in some Markdown implementations.
- Certain properties of the SARIF object model might reveal information
about the machine on which a scan was run. (The specification allows such
properties to be omitted or "redacted".)
- Certain properties of the SARIF object model (such as the command line
that invoked the analysis tool) can contain arbitrary commands which might
damage a machine on which they are run.

Interoperability considerations: N/A

Published specification:

Static Analysis Results Interchange Format (SARIF) Version 2.1.0. Edited by
Michael C. Fanning and Laurence J. Golding. 27 March 2020. OASIS Standard.
https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html.
Latest stage:
https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html.

Applications that use this media type:

The following list is not exhaustive:

- Static analysis tools
- Static analysis results visualization tools (viewers)
- Bug filing tools
- Defect databases
- Compliance systems

Fragment identifier considerations: N/A

Additional information:

  Deprecated alias names for this type: N/A
  Magic number(s): N/A
  File extension(s): .sarif, .sarif.json
  Macintosh file type code(s): N/A

Person & email address to contact for further information:

Michael C. Fanning (mikefan@microsoft.com), Laurence J. Golding (
v-lgold@microsoft.com), and Chet Ensign (chet.ensign@oasis-open.org)

Intended usage: LIMITED USE

Restrictions on usage: N/A

Author:

OASIS Static Analysis Results Interchange Format (SARIF) TC (
https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=sarif)

Change controller:

OASIS Open (https://www.oasis-open.org/)

Provisional registration? (standards tree only): No

-- 

/chet
----------------
Chet Ensign
Chief Technical Community Steward
OASIS: Advancing open source & open standards for the information society
http://www.oasis-open.org

Mobile: +1 201-341-1393

[media-types] Notice of request for media-type re… Chet Ensign