Skip to content
This repository has been archived by the owner on Apr 9, 2024. It is now read-only.

False positives management #322

Open
javixeneize opened this issue Jun 30, 2021 · 1 comment
Open

False positives management #322

javixeneize opened this issue Jun 30, 2021 · 1 comment
Assignees

Comments

@javixeneize
Copy link

Is your feature request related to a problem? Please describe.
Maybe its something that is already built but i have not seen t documented anywhere. I would like to have the ability to ignore a specific false positive.
I dont want to ignore a rule completely as there might be a scenario where it is a valid finding in a file, but not in another in the same project
Also, i dont think it is a good idea to have that control in the source code as it opens a big door to abuse this feature. Any developer might flag as false positive anything they want https://semgrep.dev/docs/ignoring-findings/

Describe the solution you'd like
Have the ability to exclude a specific false positive in a file and a line of code

Describe alternatives you've considered
Findsecuritybugs do exclusion at class level and sonar do it at line of code+file level

@sabrinabrogren sabrinabrogren transferred this issue from semgrep/semgrep Jul 2, 2021
@sabrinabrogren sabrinabrogren linked a pull request Jul 2, 2021 that will close this issue
@emwalker
Copy link

emwalker commented May 14, 2022

In this connection, I'm seeing a false positive with this line:

if Redis.current.eval(LUA_ACQUIRE, [key, ttl.to_i]) == 1

Semgrep thinks that this is a Ruby #eval, but really it's just a normal Redis EVAL with no user input. It would be nice to disable this warning in a comment in the same way that this is done with Rubocop.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Development

Successfully merging a pull request may close this issue.

3 participants