Loading…
1
Spent 3 hours on a false positive from Semgrep last Tuesday before I checked the rule
Our CI pipeline flagged 47 SQL injection hits on a legacy repo, and I panicked and started patching before realizing the rule was matching string concatenation in our test fixtures. Cost me most of a day and a pointless Slack thread with the platform team. Anyone got a good way to tune Semgrep rules so test files get skipped automatically?
1 comments
Log in to join the discussion
Log In1 Comment
dakotawood7d ago
Small correction, Semgrep won't skip test files automatically just because you want it to. There's no built in "ignore tests" switch. What you actually do is write a paths exclude block in your .semgrep.yml or pass - exclude on the command line. Something like exclude: - "/test/" or - "_test.go". That's the real fix, not a rule tuning thing.
The rule itself has no idea what a test fixture is. It just pattern matches. So the 47 hits were working as designed, which is the annoying part.
I'd set up the exclude paths first, then rerun and see what's actually left. Half the time the number drops to zero and the whole panic was for nothing.
0