Skip to content

eslint secondary IDs should include security

What does this MR do?

The eslint rules defined in semgrep include security/ in the secondary identifiers name and value.

If the secondary identifiers of existing rules are changed, when those rules are detected again, they will be shown as a new finding, rather than being dismissed as an already existing finding.

This MR brings the secondary identifiers for the eslint semgrep rules and the sast rules into line.

Note: This change brings all secondary identifier naming inline except eslint.detect-new-buffer added in gitlab-org/security-products/analyzers/semgrep!204 (merged). This rule's secondary identifier names and values are inconsistent with the other semgrep eslint rules, therefore the changes made in this MR mean that when gitlab-org/security-products/analyzers/semgrep!230 (closed) is merged, all findings for that rule will get duplicate findings.

What are the relevant issue numbers?

gitlab-org/gitlab#390908 (closed)

Edited by Craig Smith

Merge request reports