cli: allow ignoring specific vulnerability IDs #275
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Elkasitu
force-pushed
the
ignore-specific-vulns
branch
from
87033a0
to
43d3821
Compare
woodruffw
reviewed
May 10, 2022
woodruffw
reviewed
May 10, 2022
| @@ -442,7 +455,8 @@ def audit() -> None: | |||
| if vuln_count > 0: | |||
| summary_msg = ( | |||
| f"Found {vuln_count} known " | |||
| f"{'vulnerability' if vuln_count == 1 else 'vulnerabilities'} " | |||
| f"{'vulnerability' if vuln_count == 1 else 'vulnerabilities'}" | |||
| f"{(vuln_ignore_count and ', ignored %d ' % vuln_ignore_count) or ' '}" | |||
There was a problem hiding this comment.
This is pretty hard to read. IMO it's okay if we render , ignored 0 by default, but cc @di for opinions.
There was a problem hiding this comment.
I agree, if , ignored 0 is ok then I'm all up for it
woodruffw
reviewed
May 10, 2022
|
|
|
|
woodruffw
reviewed
May 10, 2022
Elkasitu
force-pushed
the
ignore-specific-vulns
branch
from
43d3821
to
05680f8
Compare
Elkasitu
changed the title
woodruffw
reviewed
May 10, 2022
Elkasitu
force-pushed
the
ignore-specific-vulns
branch
from
05680f8
to
27c2574
Compare
di
reviewed
May 12, 2022
Elkasitu
force-pushed
the
ignore-specific-vulns
branch
2 times, most recently
from
4690869
to
d1e1782
Compare
added 2 commits
May 12, 2022 22:24
This API allows developers to query whether a VulnerabilityResult contains at least one of the vulnerability IDs passed in as argument either as its ID or as one of the aliases. This method will return True if the vulnerability IDs passed in as argument intersect with the VulnerabilityResult's aliases + ID, False otherwise.
This commit introduces a new flag to pip-audit's CLI (--ignore-vuln) that takes a string representing a vulnerability id, if any of the packages scanned detect said vulnerability, it will be ignored in the final report. This allows users of pip-audit to ignore certain vulnerabilities that they may deem not exploitable for whatever reason. The flag can be used multiple times to ignore multiple vulnerabilities. Closes pypa#245
Elkasitu
force-pushed
the
ignore-specific-vulns
branch
from
d1e1782
to
38ef697
Compare
di
approved these changes
May 12, 2022
|
Thanks a ton @Elkasitu! |
netbsd-srcmastr
pushed a commit
to NetBSD/pkgsrc
that referenced
this pull request
May 28, 2022
## [2.3.0] - 2022-05-18 ### Added * CLI: The `--ignore-vuln` option has been added, allowing users to specify vulnerability IDs to ignore during the final report ([#275](pypa/pip-audit#275)) * CLI: The `--no-deps` flag has been added, allowing users to skip dependency resolution entirely when `pip-audit` is used in requirements mode ([#255](pypa/pip-audit#255))
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This commit introduces a new flag to pip-audit's CLI (--ignore-vuln)
that takes a string representing a vulnerability id, if any of the
packages scanned detect said vulnerability, it will be ignored in the
final report.
This allows users of pip-audit to ignore certain vulnerabilities that
they may deem not exploitable for whatever reason.
The flag can be used multiple times to ignore multiple vulnerabilities.
Closes #245