Stricter filter rules parsing

[rh-tguittet]

Once upon a time, I made a typo in a filter rule (localtion instead of location) :

exclude:
  localtion: "test*.go"

After having spent too much time on "why is nothing ever coming out of the filter anymore?" -- because such invalid rules makes it that nothing makes it through -- I would like to put forth that stricter filter rules parsing be implemented. A warning must at the very least be printed when the filter encounters invalid configuration primitives.

From what I can tell, this would be the place to do so: https://github.com/microsoft/sarif-tools/blob/v3.0.4/sarif/filter/general_filter.py#L85 Trying to keep the "pass through" logic for FILTER_SHORTCUTS.get(), I only came up with warts-level python of patches. Thus, it might be better that actual professional developers take a look at how to make such a patch.

Cheers.

[stacknil]

I reproduced this against the current main.

There appear to be two distinct failure modes:

• Malformed include / exclude structures can reach _compile_filters() and ultimately raise an implementation-level exception.
• A path such as localtion may not exist, but it is still syntactically valid JSONPath. When used with an exclusion filter and default-include: true, it can cause all results to be excluded while preventing the warning originally generated by the filtering logic from being surfaced.

The proposed fix should preserve support for arbitrary JSONPath, along with the existing filtering and default-include semantics.

The scope could be limited to:

1. Returning a clear configuration error for malformed filter-file structures.
2. Emitting a diagnostic when a configured filter path is evaluated but matches no properties in any evaluated result.

A path that exists in only some results should remain valid and should not trigger a zero-match diagnostic.

If this scope matches the intent of the issue, a focused patch can be prepared with regression tests covering:

• include / exclude behavior;
• optional properties;
• arbitrary JSONPath;
• malformed configuration.