ericcornelissen/js-regex-security-scanner

Ignore patterns

Closed this issue · 1 comments

ericcornelissen commented

Relates to #12, #55

Summary

Add support for specifying (custom) file patterns that should be ignored by the scanner.

Example

When scanning ericcornelissen/svgo-action (with v0.3.1) the output will contain violations only for lib/index.cjs. While somewhat helpful, most of the code in that file is from external vendors and so is not directly relevant. In this case, it should be possible to scan the project's own source code separately from vendored code.

ericcornelissen commented

Adjusting the example from the README to use the --ignore-pattern option as

- docker run --rm -v $(pwd):/project ericornelissen/js-re-scan:latest
+ docker run --rm -v $(pwd):/project ericornelissen/js-re-scan:latest --ignore-pattern index.cjs

has the desired result on the ericcornelissen/svgo-action project at 604ff487295a5a3a7f21660e78877c10aa132bca (with v0.4.0).

This pattern should be sufficient for the goals of this issue. To close this out, documentation should be added for how to use the --ignore-pattern option to ignore files/folders.