search

presidentbeef / brakeman

A static analysis security vulnerability scanner for Ruby on Rails applications
https://brakemanscanner.org/
Other
6.97k stars 726 forks source link

Ability to include multiple brakeman.ignore files via cmd #1856

Open Karl-H opened 2 months ago

Karl-H commented 2 months ago

Is your feature request related to a problem? Please describe. Currently when running brakeman to generate a report to upload to our vulnerability management system we use --add-engines-path=../additional_stuff/ to scan another area of our app, however because this directory has a separate brakeman ignore file and the build will only look in the current directory for a brakeman ignore file, the ignore warnings are ignored and subsequently false positives make it to the report.

Describe the solution you'd like Ability to pass multiple ignore file paths via command line

Describe alternatives you've considered Manually merging the changes across, this isn't idea as we have a large amount of dev's working on the project and the manually created file risks becoming stale

presidentbeef commented 1 month ago

Hi Karl, I think I understand your issue. Specifying multiple ignore configurations is probably not too hard to add.

But the trouble begins when someone wants to edit the ignored warnings and uses --interactive-ignore/-I. Now there's complexity in which file(s) gets edited. Enough complexity (in poorly tested code) that I'm probably not going to attempt adding this feature myself.