jeemok/better-npm-audit

Option to save ignored vulnerabilities.

dimitrisfasoulas opened this issue · 3 comments

dimitrisfasoulas commented

Right now if we are using a package that has a vulnerability in a method that we don't use, we can choose to ignore the specific vulnerability with -i flag. If we want to make this permanent (to pass CI/CD pipelines for example) then we can add this to the npm script in package.json.

I think it would be better if there is an option to save ignored vulnerabilities to a separate file and read them each time a scan is run. An nice option would also be to have an optional comment saved per ignored vulnerability ie

{
  "1337": "Ignored since we don't use xxx method"
}
jeemok commented

That's a good idea, NSP had it last time. We could reimplement that depreciated feature to read into .nsprc file that looked like this:

{
  "exceptions": [
    // Ignored since we don't use xxx method
    "https://nodesecurity.io/advisories/1337"
  ]
}
lachlan-harris commented

Thanks for your consideration on this one.
I would also suggest adding the addition timestamp into the structure, allowing for extension to features like "ignoring until", etc.

{
    "1337": {
        "ignore": true,
        "reason": "Ignored since we don't use xxx method",
        "timestamp": 1615416734
    }
}

Also suggesting an object to allow extensibility in the future.

  • 👍1
jeemok commented

Hi @dimitrisfasoulas @lachlan-harris I have added the file support to v1.8.0, please read the documentation for the available feature :)

  • 👍1