nccgroup/sobelow

sobelow should not accept `# sobelow_skip` that are not needed

Open

#159 opened on Apr 3, 2024

View on GitHub
 (4 comments) (0 reactions) (0 assignees)Elixir (119 forks)batch import
backlogfeaturegood first issue

Repository metrics

Stars
 (1,780 stars)
PR merge metrics
 (No merged PRs in 30d)

Description

I notice in our code an instance of

  # sobelow_skip ["XSS.Raw"]
  def a_function(arg) do
    that_does_not_call_raw()
  end

I believe sobelow should raise an error on these. They do not reflect the code / current intention. Although unlikely, they could allow someone to add raw without it being super apparent in the diff of the resulting PR.

Thanks for sobelow

Contributor guide

Research direction
Investigate how sobelow processes skip comments and implement a warning or error when a skip directive is unnecessary (e.g., the function does not call the flagged function).
Tech stack
elixir
Domain
securitytooling
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
Elixir
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
75