Skip to content

Feat: Reclassify Confidence level as Severity

Lucas Charles requested to merge reclassify-confidence-as-severity into master

What does this MR do?

We previously reported the flawfinder level as confidence, however according to the docs this is a "risk level" and would be better classified as severity.

Quoting from the docs:

Flawfinder will produce a list of ‘hits’ (potential security flaws, also called findings), sorted by risk; the riskiest hits are shown first. The risk level is shown inside square brackets and varies from 0, very little risk, to 5, great risk. This risk level depends not only on the function, but on the values of the parameters of the function. For example, constant strings are often less risky than fully variable strings in many contexts, and in those contexts the hit will have a lower risk level.

IMO this was incorrectly classified as confidence previously and we should be reporting this as severity. We also no longer display confidence so this is additionally more useful to our users.

NOTE: While we do not need to rename the CI variable, we should likely update our docs with a better description. This can be done as a follow-up to this work.

What are the relevant issue numbers?

gitlab-org&4004 (closed)

Does this MR meet the acceptance criteria?

Edited by Daniel Paul Searles

Merge request reports