Bearer / bearer

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.
https://docs.bearer.com
Other
1.98k stars 99 forks source link

Bearer Scan takes very long time #1682

Open toteto opened 1 month ago

toteto commented 1 month ago

I am working on monorepo wit fairly small-medium sized project. The scan on CI takes few seconds. However the scan ran locally takes very long time. For initial ran it took ~15 minutes just on Analyzing codebase without any timer, then it scanned ~10M files. After that it was taking 2-3m for Analyzing codebase.

Expected Behavior

Runs fast

Actual Behavior

Runs slow 🤷‍♂️

Possible Fix

I am suspecting that the skip-path is not working as expected

Your Environment

This is my config:

disable-version-check: false
log-level: info
report:
    fail-on-severity: critical,high,medium,low
    format: ""
    no-color: false
    output: ""
    report: security
    severity: critical,high,medium,low,warning
rule:
    disable-default-rules: false
    only-rule: []
    skip-rule: []
scan:
    context: ""
    data_subject_mapping: ""
    disable-domain-resolution: true
    domain-resolution-timeout: 3s
    exit-code: -1
    external-rule-dir: []
    force: false
    hide_progress_bar: false
    internal-domains: []
    parallel: 0
    quiet: false
    scanner:
        - sast
    skip-path: ['.nx','.local','.output','*/node_modules','*/dist','.github','tools','applications/services/issuer']
    skip-test: true

I am running bearer scan .

gotbadger commented 2 weeks ago

@toteto I did a quick test with node_modules ignored using the patten in your example config and it seemed to work for me.

If you try doing a scan with --debug this will show paths being evaluated and ignored this might help us understand what pattern is working and which isnt.