search

microsoft / infersharp

Infer# is an interprocedural and scalable static code analyzer for C#. Via the capabilities of Facebook's Infer, this tool detects null dereferences, resource leaks, and thread-safety violations. It also performs taint flow tracking to detect critical security vulnerabilities like SQL injections.
MIT License
727 stars 28 forks source link

Configure suppressions #188

Open centreboard opened 1 year ago

centreboard commented 1 year ago

Is there a way to 1) Configure not analysing some .dlls (e.g. by name or pattern)? and/or 2) Configure some suppressions of specific warnings (e.g. by file)?

Problem

Infer# copies and analyses any .dll with a .pdb. This results in it copying and analysing some upstream .dlls from Nuget Packages, e.g. NUnit3.TestAdapter.dll

D:/repos/NUnit/nunit3-vs-adapter/src/NUnitTestAdapter/NavigationDataProvider.cs:42: error: Pulse Resource Leak Resource dynamically allocated by constructor NUnit.VisualStudio.TestAdapter.Metadata.DirectReflectionMetadataProvider() on line 42 is not closed after the last access at line 42, column 15.

And warnings in Visual Studio (#183) image

From the Error list window in VS there is an option suppress this in the sarif file, but this seems to be lost when the Infer# analysis is rerun.

matjin commented 1 year ago

For suppression by file or directory, I think this should work:

https://github.com/facebook/infer/issues/935

If you have a custom blacklist regex you'd like to add, you can add it to the .inferconfig in the WSL distro located at ~/infersharp/.inferconfig

Alternatively, you can apply a regex to your directory to copy a subset of the files to be analyzed..

raoganeshr commented 1 year ago

For suppression by file or directory, I think this should work:

facebook/infer#935

If you have a custom blacklist regex you'd like to add, you can add it to the .inferconfig in the WSL distro located at ~/infersharp/.inferconfig

Alternatively, you can apply a regex to your directory to copy a subset of the files to be analyzed..

Will @SuppressLint("") work for C# code too?

matjin commented 1 year ago

Not yet. It should probably be fairly straightforward to add in the next release though.