Closed t-lipingma closed 3 years ago
Hi @t-lipingma , the idea of the baseline is to generate the difference between run1 vs run2. It's different from a suppression mechanism.
So, if you see the sarif that you generated, you will see one property called "baselineState". That's going to show results that are new, unchanged, updated, and absent.
With that, we can observe that the new run didn't generate any new result, so, all results will have baselineState = unchanged.
Ok, I see. So now how can we consume suppressions from sarif files? Or it's undergoing?
Hi @t-lipingma , with the baseline, we have the same idea of the suppression. It will always generate the result, but instead of having the suppression properties, it will have the baselineState. With that, you will be able to filter out things that aren't new, for example, baselineState = unchanged => it was in the baseline and in your current run.
I want to use baseline to output suppressions. (generate SARIF file and then manually enter justifications in it) , pass it as an input to BinSkim and write suppressions to sarif.
So,first(generate baseline.sarif):
.\BinSkim.exe analyze C:\MLP\projects\ConsoleApplication1\Debug\ConsoleApplication1.exe --output C:\MLP\projects\result\baseline.sarif
Then,manually enter the suppression to the first BA2004 for example. baseline.sarif's result are :
Last,pass baseline.sarif as an input to BinSkim and write suppressions to sarif:
.\BinSkim.exe analyze C:\MLP\projects\ConsoleApplication1\Debug\ConsoleApplication1.exe --baseline C:\MLP\projects\result\baseline.sarif --output C:\MLP\projects\result\mylog.sarif
However, the mylog.sarif's result don't include
suppressions
info:ConsoleApplication1.cpp :
Is this a bug or am I using it wrong? Thanks!