[ENGPROD-6507] filter secrets and licenses based on rego policy #4
Conversation
| func applyPolicy(ctx context.Context, vulns []types.DetectedVulnerability, misconfs []types.DetectedMisconfiguration, | ||
| policyFile string) ([]types.DetectedVulnerability, []types.DetectedMisconfiguration, int, error) { | ||
| func applyPolicy(ctx context.Context, vulns []types.DetectedVulnerability, misconfs []types.DetectedMisconfiguration, scrts []ftypes.SecretFinding, lics []types.DetectedLicense, | ||
| policyFile string) ([]types.DetectedVulnerability, []types.DetectedMisconfiguration, int, []ftypes.SecretFinding, []types.DetectedLicense, error) { |
There was a problem hiding this comment.
I think you'll probably want to move these to before the int return. Or at least it makes the most logical sense to me that we should return the count of ignored things right before the error
There was a problem hiding this comment.
I retract this...it is not what I thought it was 😢
pkg/result/filter_test.go
Outdated
| Secrets: []ftypes.SecretFinding{ | ||
| { | ||
| RuleID: "generic-wanted-rule", | ||
| Severity: dbTypes.SeverityHigh.String(), | ||
| Title: "Secret that should pass filter on rule id", | ||
| StartLine: 1, | ||
| EndLine: 2, | ||
| Match: "*****", | ||
| }, | ||
| { | ||
| RuleID: "generic-critical-rule", | ||
| Severity: dbTypes.SeverityHigh.String(), | ||
| Title: "Critical Secret shouldn't pass filter", | ||
| StartLine: 1, | ||
| EndLine: 2, | ||
| Match: "*****", | ||
| }, | ||
| }, | ||
| Licenses: []types.DetectedLicense{ | ||
| { | ||
| Name: "GPL-3.0", | ||
| Severity: dbTypes.SeverityHigh.String(), | ||
| FilePath: "usr/share/gcc/python/libstdcxx/v6/printers.py", | ||
| Category: "restricted", | ||
| Confidence: 1, | ||
| }, |
There was a problem hiding this comment.
Some classic tabs vs. spaces indent problems here
| filteredLics = append(filteredLics, lic) | ||
| } | ||
|
|
||
| return filteredVulns, filteredMisconfs, ignoredMisconfs, filteredSecrets, filteredLics, nil |
There was a problem hiding this comment.
So, maybe I'm wrong. It seems really weird that we're using a blind int to "only" return the count of ignored misconfigurations. Probably a follow-up change, but it seems like it would be useful to make a struct with counts of all the ignores
There was a problem hiding this comment.
@carsongee I just pushed a commit with a fix for the indentation issue. Should I open a follow-up ticket for the structure for ignores?
There was a problem hiding this comment.
Let's start a "discussion" per their procedures and see if it is of interest for them
Description
Filter out Secrets and Licenses based on repo ignore policy just like Misconfigurations and Vulnerabilities.
Related issues
Related PRs
Remove this section if you don't have related PRs.
Checklist