Design: Support custom rulesets in the SAST Configuration UI
Problem to solve
Currently, users need to go to the docs to learn how to set custom rulesets for SAST, and then make the configurations via the WebIDE.
Solution
Add a custom rulesets field in the SAST Configuration UI
More info
Ruleset customization supports two capabilities:
-
Disabling predefined rules (available for all analyzers).
-
Modifying the default behavior of a given analyzer (only available for nodejs-scan and gosec).
Proposal
WIP Design:
Question
-
Should we offer custom ruleset block for each analyzer? This makes the design and technical implementation more complicated.
-
Should we offer examples to populate in for separate analyzers?
Feedback please!
cc @nmccorrison @tmccaslin @theoretick @rossfuhrman @ssarka @markrian @jannik_lehmann @twoodham @zrice