search

nccgroup / sobelow

Security-focused static analysis for the Phoenix Framework
Apache License 2.0
1.67k stars 92 forks source link

Feature Request: Scan multiple apps in the same command #63

Closed aselder closed 1 year ago

aselder commented 4 years ago

Since we tend to run umbrella apps, I'd love to do something like:

mix sobelow -r apps/app1 -r apps/app2 -r apps/app3 and get a single consolidate report

GriffinMB commented 4 years ago

Hi, thanks for opening this issue! This is something that has been on the back burner for awhile now, but I haven’t found a great way to implement this in a way that is more useable/intuitive than chaining a few calls to sobelow together (ie mix sobelow -r apps/app1 && mix sobelow -r apps/app2). The main concern is how to handle additional arguments. IE adding —ignore X could be applied to each app or to only one, depending on implementation, and it isn’t clear that either choice is better.

All of this to say, I think it’s a good idea, and will continue exploring options. Feel free to add comments about ergonomics if you have any thoughts :)

lleger commented 4 years ago

@GriffinMB It would be cool if, in an umbrella app, you could iterate over each folder in apps/ and run Sobelow if a .sobelow-conf file was found. That way I can create the config files and then run mix sobelow once at the root, and it would run it for all sub-apps.

houllette commented 1 year ago

Since this issue was opened, some folks have added instructions to the README to address usage in Umbrella apps (with configuration like @lleger mentions above)!

I'm closing this issue in an effort to clean stuff up a bit, but feel free to reopen if it doesn't fully satisfy your needs!