nccgroup / sobelow

Security-focused static analysis for the Phoenix Framework
Apache License 2.0
1.66k stars 92 forks source link

Too much info in --details / -d output #137

Closed houllette closed 1 year ago

houllette commented 1 year ago

When you run sobelow with the -d argument and the parent vulnerability type without specifying which child you want more details on (e.g. mix sobelow -d Config vs mix sobelow -d Config.CSWH) it will print out the moduledocs for ALL child vulnerabilities.

We should consider only printing out the moduledoc for the parent vulnerability type or at the very least, cleaning up the output of all child moduledocs (since they just kinda get crammed together in the the output).

houllette commented 1 year ago

Oh wait - this is only applicable to some of the vulnerability types, as the suggested behavior is indeed what is happening on parent modules that specify a details function.

Fix is just to add the missing function to the parent modules that need it:

While I'm at it though, it may make sense to add to all parent moduledocs with the suggestion to the user that if they wish to receive more info on a submodule, to be sure to add the modifier to the CLI argument.

houllette commented 1 year ago

While working on the fix for this issue I uncovered that some submodules simply call back to their parent module's moduledoc rather than display their own unique, more specific moduledoc. This is probably leftover from before each submodule had it's own documentation, my fix will address this as well.