Prune results of Ruby query from SARIF - #1344
edoardopirovano merged 1 commit into
Conversation
Sorry, something went wrong.
| run.tool?.driver?.semanticVersion === "2.11.2" | ||
| ) { | ||
| // Version 2.11.2 of the CodeQL CLI had many false positives in the | ||
| // rb/weak-cryptographic-algorithm query which we prune here. |
There was a problem hiding this comment.
Do we have a public facing issue for this? Maybe add a link to it here.
Sorry, something went wrong.
There was a problem hiding this comment.
We do indeed. Added a link.
Sorry, something went wrong.
| environment | ||
| ); | ||
|
|
||
| sarif = pruneInvalidResults(sarif, logger); |
There was a problem hiding this comment.
Do we want to gate this with an undocumented environment variable? So that individual users can turn this back on if they really, really want to?
We can consider also feature flagging this, but that feels like something too heavy-weight.
Sorry, something went wrong.
There was a problem hiding this comment.
Sure. This code is hopefully very temporary but it can't hurt to have an escape hatch if a user needs to disable it for some reason.
Sorry, something went wrong.
aeisenberg
left a comment
There was a problem hiding this comment.
Code LGTM. @aibaars, thanks for verifying this is working on code scanning.
Sorry, something went wrong.
This PR is a mitigation for the fact that the rb/weak-cryptographic-algorithm query was released in version 2.11.2 of CodeQL with a large number of false positives relating to hashing algorithms. This was tweaked in github/codeql#11119 for 2.11.3, but we'd like to filter the false positives out while we wait for that to be released.
Merge / deployment checklist