Docs feedback: Please add a SAST custom ruleset example to disable certain flawfinder rules
In our "Example: Disable predefined rules of SAST analyzers" we only show the syntax for eslint
. Can the exact same structure be adapted easily to for example flawfinder
rules?
@cmutua & me tested the following, but our analyzer still reports corresponding findings. Thus, the disabling/excluding certain rules seems to work differently here (which should be documented_, or there is a bug?
$ cat .gitlab/sast-ruleset.toml
[flawfinder]
[[flawfinder.ruleset]]
disable = true
[flawfinder.ruleset.identifier]
type = "cwe" # or: flawfinder_func_name or flawfinder_rule_id
value = "120" # and: MultiByteToWideChar
$ rm gl-sast-report.json # from previous runs
$ docker run \
--interactive --tty --rm \
--volume "$PWD":/tmp/app \
--env CI_PROJECT_DIR=/tmp/app \
registry.gitlab.com/gitlab-org/security-products/analyzers/flawfinder /analyzer run
[INFO] [Flawfinder] [2022-11-09T15:32:48Z] ▶ GitLab Flawfinder analyzer v3.2.1
[INFO] [Flawfinder] [2022-11-09T15:32:48Z] ▶ Detecting project
[INFO] [Flawfinder] [2022-11-09T15:32:48Z] ▶ Analyzer will attempt to analyze all projects in the repository
[INFO] [Flawfinder] [2022-11-09T15:32:48Z] ▶ Running analyzer
[INFO] [Flawfinder] [2022-11-09T15:32:48Z] ▶ Creating report
$ rg --count 'CWE-120' gl-sast-report.json # or 'MultiByteToWideChar'
81
Triggered by this internal request.
Edited by Katrin Leinweber