OWASP/glue

--exclude not working with SFL?

Opened this issue · 4 comments

arthurakay commented

I'm running the following command, attempting to ignore node_modules but I can't quite seem to make it work. Can someone please offer advice?

	docker run --rm --name=Glue \
		-v $(PWD):/tmp/triage owasp/glue \
		-t sfl \
		-t retirejs \
		-t nodesecurityproject \
		-f teamcity \
		--teamcity-min-level 1 \
		--exclude node_modules \
		--finding-file-path /tmp/triage/glue_ignore.json  \
		--debug \
		/tmp/triage

Glue runs normally, and my --finding-file-path correctly ignores results... but I'd like to always ignore anything found in node_modules since I don't control everything my dependencies drag in. Currently SFL is flagging like 30+ files from that directory.

omerlh commented

Looking at the SFL task code, I think the --exclude flag is not honored. Looking on other tasks, look like some tasks do hard-coded exclude (Snyk, NSP) - ignoring folders like node_modules.
I'll recommend you to try using the new dynamic task instead of fixing the task. Or, if you prefer, I can help you out adding a PR to fix this bug.

arthurakay commented

I think generally speaking if there's a --exclude option it should work consistently across all tasks that are out-of-the-box.

I tried for about 2 hours tonight to put together a PR myself, but I'm terrible at Ruby and I'm just going to throw in the towel. Is this something you could put together quickly? I'd really appreciate it.

omerlh commented

I agree, we should move on and remove this option globally.
While I try to look into that (not promise anything, but hope to have sometime later this week) - have you looked into the dynamic task? This will be much faster.

stale commented

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.