SAST analyzers with `AnalyzeAll` set must implement `SEARCH_IGNORED_DIRS` / `--ignored-dirs`

The code that provides the --ignore-dirs flag and corresponding SEARCH_IGNORED_DIRS environment variable is in the common module and is easily skipped when the AnalyzeAll option, from the command modules, is set to true.

The ignore-dirs flag is defined in common/flags.go, used while walking directories, when called e.g. as search.New(...).Run(...).

Which is the only way that the run subcommand, defined in command, invokes it.

But notice that the returned matchPath is not used if AnalyzeAll is true.

If AnalyzeAll is true, the root is analyzed, where root comes from target-dir / ANALYZER_TARGET_DIR / CI_PROJECT_DIR. If the analyzer should ignore directories, the Analyze callback must implement it.

Related Issues

Duplicate issues with a different solution

The proposal in this issue was abandoned in the previous discussion because, at the time, there were more analyzers and the change would have been intensive. Rather than filter beforehand, SAST_EXCLUDED_PATHS was introduced to filter results after analysis.

Having consolidated analyzers, it now seems possible to filter before scanning.

Supported analyzers potentially affected (as of 17.0)

Implementation Plan

Edited by Adam Cohen