Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Future.md #622

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update Future.md #622

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions Future.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,3 +65,11 @@ Software doesn't exist in a vacuum. Modern software often runs in a complex ecos
One way to tackle this problem is to identify a way to link SARIF into a model of that ecosystem, such as what is generated by "observability" tools that leverage OpenTelemetry. Linking of this nature has benefits in both directions. People looking at the entire ecosystem can drill into SARIF details from the global picture. People more focused on individual software components can enrich SARIF results with an understanding of context.

For example, imagine that SARIF identifies a "critical" SQL injection problem in an application. Adding global context would enable adding risk factors that temper that result. The application might only contain read-only, public data. Or it might only be accessible by administrators. Or it might be protected by a runtime protection module. The contextual risk calculation may be only "low".

## Provide Domain-specific Schema Subsets

In order to reduce the overhead of working with the complete SARIF schema and also accommodate the diverse needs of automated software pipelines, domain-specific schema subsets would be created. These would be strict subsets in that they would conform to the master SARIF schema.

Schema subsetting would also allow for the adoption of SARIF in these new domains as the weight of the current schema acts as a barrier to entry.

Additionally, these schema subsets should accelerate the creation of SARIF data manipulation within the build pipeline.