Apply in-source suppressions through an issue's related locations

オープン
  • 何か問題がありますか？
#155 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
18/100
issue の種類
機能追加
明瞭さ
おおむね明確
活発さ
活発
技術スタック
java
領域
devtools

調査の方向性

Start with the suppression engine's matching logic, which currently checks only the issue's own location against the annotated construct, and with SecretChecker, which reports ballerina:13 and ballerina:14. The work depends on #154 adding related locations to issues, and the spec proposal in ballerina-spec#1496 needs updating first. Done means a @scan:Suppress on a declaration matches issues at its related locations, while the innermost-construct rule, unmatched diagnostics and requireReason/requireRuleId behave as before.

索引モデルが issue の本文から書いたものです。

説明

Area/Configuration Type/New Feature
Problem

@scan:Suppress only matches a finding whose own location is inside the annotated construct. ballerina:13 and ballerina:14 report a value where it is used, not where it is declared, so a suppression on the declaration is reported as unmatched and the findings stay:

@scan:Suppress {rules: ["ballerina:14"], reason: "Fixed test fixture value"}
string fixture = "fixed-secret";      // warning: suppression of 'ballerina:14' did not match any issue
connect(password = fixture);          // ballerina:14 is still reported here
login(secret = fixture);              // and here

The same happens for a configurable's literal default, which is reported as ballerina:13 at every use:

@scan:Suppress {rules: ["ballerina:13"], reason: "Local development default"}
configurable string dbConfig = "fallback-secret";
connect(password = dbConfig);         // still reported

Users have to suppress each use separately, even though the value has only one place where it can be fixed.

Proposed Solution

Apply a suppression to an issue when the annotated construct covers either:

  • the issue's location, as today; or
  • any of the issue's related locations, which #154 adds for ballerina:13 and ballerina:14.
@scan:Suppress {rules: ["ballerina:14"], reason: "Fixed test fixture value"}
string fixture = "fixed-secret";
connect(password = fixture);          // suppressed through the related location

What stays the same: the innermost-construct rule, the unmatched-suppression diagnostics, and requireReason / requireRuleId. An annotation on a declaration that suppresses uses elsewhere counts as matched, and the suppressed issues appear in the JSON and SARIF reports as they do today.

Dependencies

  • #154: this issue needs the related locations that #154 adds to issues.
  • Spec: in-source suppression was specified in ballerina-platform/ballerina-spec#1496 as applying to issues "within the construct it is attached to". Applying it through related locations extends that, so the proposal needs updating before this is implemented.
Alternatives
  • Suppress inside the secret rules: have SecretChecker look for @scan:Suppress on the declarations it traces through. This duplicates the suppression engine's matching, diagnostics and report entries, and only these two rules would get it.
  • Keep the current behavior and document it: suppress at each use site.
Version

0.13.0

主要言語
Java
スター
15
フォーク
12
平均マージ
2日 19時間
マージ済み PR（30日）
20

環境構築

  • Dockerfile・Docker Compose ファイルなし
  • プルリクエストのテンプレートあり
  • コントリビューションガイドなし

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

ballerina-platform/static-code-analysis-tool のほかの issue

ballerina-platform/static-code-analysis-tool の issue をすべて見る

似ている issue

Java の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。