Windows file system path rule too noisy

Azure / appcat-rulesets

Repository for maintaining Rulesets for Windup

Eclipse Public License 2.0

5 stars 7 forks source link

Windows file system path rule too noisy #187

Closed mnriem closed 3 months ago

mnriem commented 8 months ago

The rule also matches regular expressions.

showpune commented 4 months ago

@mnriem , do we have sample for it? I want to understand is it a noisy, or it is a bug?

mnriem commented 3 months ago

Any regular expression in the code that currently has "\" or a variation of it seems to get matches by this rule. Obviously, that is not the intent. Consider changing it look for something like "..\" or an absolute path or a some other way so it does not pick up regular expressions in the code by accident.

mnriem commented 3 months ago

Screenshot 2024-03-11 at 3 08 13 PM

agoncal commented 3 months ago

@KaiqianYang @showpune if you run the sample that we bundle with AppCAT (AirSonic), you will see that this rule is triggered several times. It would be good to check the fault positives and see if we can improve the rule.

Screenshot 2024-03-12 at 14 32 01

KaiqianYang commented 3 months ago

Thanks @agoncal @mnriem https://github.com/Azure/appcat-rulesets/pull/204 I have improved the matching pattern for windows file system path. Verified by running against Airsonic, it fixed all false positives in the app.