Apply in-source suppressions through an issue's related locations

Aperta
  • Qualcosa non va?
#155 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
18/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
java
Ambito
devtools

Direzione di ricerca

Start with the suppression engine's matching logic, which currently checks only the issue's own location against the annotated construct, and with SecretChecker, which reports ballerina:13 and ballerina:14. The work depends on #154 adding related locations to issues, and the spec proposal in ballerina-spec#1496 needs updating first. Done means a @scan:Suppress on a declaration matches issues at its related locations, while the innermost-construct rule, unmatched diagnostics and requireReason/requireRuleId behave as before.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Area/Configuration Type/New Feature
Problem

@scan:Suppress only matches a finding whose own location is inside the annotated construct. ballerina:13 and ballerina:14 report a value where it is used, not where it is declared, so a suppression on the declaration is reported as unmatched and the findings stay:

@scan:Suppress {rules: ["ballerina:14"], reason: "Fixed test fixture value"}
string fixture = "fixed-secret";      // warning: suppression of 'ballerina:14' did not match any issue
connect(password = fixture);          // ballerina:14 is still reported here
login(secret = fixture);              // and here

The same happens for a configurable's literal default, which is reported as ballerina:13 at every use:

@scan:Suppress {rules: ["ballerina:13"], reason: "Local development default"}
configurable string dbConfig = "fallback-secret";
connect(password = dbConfig);         // still reported

Users have to suppress each use separately, even though the value has only one place where it can be fixed.

Proposed Solution

Apply a suppression to an issue when the annotated construct covers either:

  • the issue's location, as today; or
  • any of the issue's related locations, which #154 adds for ballerina:13 and ballerina:14.
@scan:Suppress {rules: ["ballerina:14"], reason: "Fixed test fixture value"}
string fixture = "fixed-secret";
connect(password = fixture);          // suppressed through the related location

What stays the same: the innermost-construct rule, the unmatched-suppression diagnostics, and requireReason / requireRuleId. An annotation on a declaration that suppresses uses elsewhere counts as matched, and the suppressed issues appear in the JSON and SARIF reports as they do today.

Dependencies

  • #154: this issue needs the related locations that #154 adds to issues.
  • Spec: in-source suppression was specified in ballerina-platform/ballerina-spec#1496 as applying to issues "within the construct it is attached to". Applying it through related locations extends that, so the proposal needs updating before this is implemented.
Alternatives
  • Suppress inside the secret rules: have SecretChecker look for @scan:Suppress on the declarations it traces through. This duplicates the suppression engine's matching, diagnostics and report entries, and only these two rules would get it.
  • Keep the current behavior and document it: suppress at each use site.
Version

0.13.0

Lingua principale
Java
Stelle
15
Fork
12
Merge medio
2g 10h
PR unite (30g)
17

Preparare l'ambiente

  • Nessun Dockerfile né file Docker Compose
  • Ha un modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di ballerina-platform/static-code-analysis-tool

Tutte le issue di ballerina-platform/static-code-analysis-tool

Issue simili

Altre issue su Java

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.