Can anyone tell how primaryLocationLineHash be generated?

[ZH3FENG]

I have read part of SARIF https://docs.oasis-open.org/sarif/sarif/v2.1.0/cs01/sarif-v2.1.0-cs01.html, particularly partialFingerprints property.
Also, SARIF results file from https://lgtm.com/help/lgtm/sarif-results-file.

This will contain, at a minimum, a value for the primaryLocationLineHash, which provides a fingerprint based on the context of the primary location.

Can anyone tell me how primaryLocationLineHash be generated. What algorithm ？
I have noticed the result contains codeflow property. Does codeflow affect generation of primaryLocationLineHash ?

[RasmusWL]

Hi @ZH3FENG, can you please elaborate on why you want to know how primaryLocationLineHash is generated? As I see it, this is just some unique hash value produced by CodeQL to help determine whether two results are logically identical.

[ZH3FENG]

I knew it's purpose.
I'am thinking whether a customized sanitization would change it, especially when the sanitization is valid.
Will a new result reported?

[RasmusWL]

I'm not too familiar with the specific logic. Can you please elaborate on why you want to know how primaryLocationLineHash is generated? (have you experienced any specific problems?)

[ZH3FENG]

Not yet.
I'm worrying about customized sanitization will change it, then another new vulnerability will be reported.
Maybe i should do some test.
Thanks.

[chris121262]

👌

[aibaars]

An implementation of the algorithm used by CodeQL can be found at https://github.com/github/codeql-action/blob/216127f34aa309c5876c25b8ea6bda90f4f559fe/src/fingerprints.ts#L30-L41