Null Reference Exception in SarifLogger when Extensions are specified.

[derigel23]

Here is an extract from the code:

            // Map existing Rules to ensure duplicates aren't created
            if (_run.Tool.Extensions != null)
            {
                RecordRules(extensionIndex: null, _run.Tool.Driver);

                for (int extensionIndex = 0; extensionIndex < _run.Tool.Extensions.Count; ++extensionIndex)
                {
                    ToolComponent extension = _run.Tool.Extensions[extensionIndex];
                    ExtensionGuidToIndexMap[extension.Guid.Value] = extensionIndex;
                    RecordRules(extensionIndex, extension);
                }

            }

extension.Guid is an optional value, but here we have access to its Value without any checking and get NRE.

[derigel23]

3.19.6 guid property
A toolComponent object MAY contain a property named guid whose value is a GUID-valued string (§3.5.3) that provides a unique, stable identifier for the component. guid SHALL NOT vary between versions of a given component.