--exclude not working with SFL?

[arthurakay]

I'm running the following command, attempting to ignore node_modules but I can't quite seem to make it work. Can someone please offer advice?

    docker run --rm --name=Glue \
        -v $(PWD):/tmp/triage owasp/glue \
        -t sfl \
        -t retirejs \
        -t nodesecurityproject \
        -f teamcity \
        --teamcity-min-level 1 \
        --exclude node_modules \
        --finding-file-path /tmp/triage/glue_ignore.json  \
        --debug \
        /tmp/triage

Glue runs normally, and my --finding-file-path correctly ignores results... but I'd like to always ignore anything found in node_modules since I don't control everything my dependencies drag in. Currently SFL is flagging like 30+ files from that directory.

[omerlh]

Looking at the SFL task code, I think the --exclude flag is not honored. Looking on other tasks, look like some tasks do hard-coded exclude (Snyk, NSP) - ignoring folders like node_modules. I'll recommend you to try using the new dynamic task instead of fixing the task. Or, if you prefer, I can help you out adding a PR to fix this bug.

[arthurakay]

I think generally speaking if there's a --exclude option it should work consistently across all tasks that are out-of-the-box.

I tried for about 2 hours tonight to put together a PR myself, but I'm terrible at Ruby and I'm just going to throw in the towel. Is this something you could put together quickly? I'd really appreciate it.

[omerlh]

I agree, we should move on and remove this option globally. While I try to look into that (not promise anything, but hope to have sometime later this week) - have you looked into the dynamic task? This will be much faster.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.