Skip to content

Fix disabling and overriding rules with a remote custom ruleset

Ahmed Hemdan requested to merge fix-disabling-overriding-rules-with-remote-custom-ruleset into master

What does this MR do?

This fix is based on the work from @eurie in:

To allow using a remote custom ruleset when disabling or overriding rules similar to kics!102 (merged).

The fix works by ensuring to set the correct ruleset and path when generating the gl-secret-detection-report.json file.

Resolves gitlab-org/gitlab#425251 (closed).

Testing

Testing this locally requires to create a go workspace as outlined below.

  1. Check out the fix-disabling-overriding-rules-with-remote-custom-ruleset branch for secrets.
  2. Clone the test project into qa/fixtures: git@gitlab.com:gitlab-org/secure/tests/test-issue-425251/secret-detection.git.
  3. Run analyzer-build && analyzer-debug qa/fixtures/secret-detection.
  4. In the debug container, export the following environment variables:
    • export GITLAB_FEATURES=sast_custom_rulesets
    • export SECRET_DETECTION_RULESET_GIT_REFERENCE=gitlab.com/gitlab-org/secure/tests/test-issue-425251/ruleset
  5. Run the analyzer: /analyzer run.
  6. Verify that there are no results in the resulting /tmp/app/gl-secret-detection-report.json file.

Demo

Demo was created with only ruleset module updated to v3, but should still be applicable now.

demo

What are the relevant issue numbers?

Does this MR meet the acceptance criteria?

Edited by Lucas Charles

Merge request reports