search

thesp0nge / dawnscanner

Dawn is a static analysis security scanner for ruby written web applications. It supports Sinatra, Padrino and Ruby on Rails frameworks.
MIT License
737 stars 86 forks source link

How to disable/skip individual checks #230

Closed tmaier closed 5 years ago

tmaier commented 6 years ago

I have two warnings in my dawn output. I checked them and one of them is a false positive and the other one is a conscious decision.

I run the following command within my CI pipeline

$ dawn --exit-on-warn --console .

Is there a command line argument which allows me to skip the two tests? This would allow me to have my CI job only failing if something new and relevant comes in.

thesp0nge commented 5 years ago

Hi @tmaier sorry for the horrible delay. No words to apologize. Are you still using dawnscanner? Do you still have this need?

tmaier commented 5 years ago

Hi @thesp0nge, I still have it in my pipeline. However, I allow it to fail. So the usefulness is a bit limited atm.

thesp0nge commented 5 years ago

It's close to be solved: https://asciinema.org/a/244832

tmaier commented 5 years ago

😊 Thank you!

thesp0nge commented 5 years ago

Let me know if this works for you

tmaier commented 5 years ago

Hi,

I just tried v2.0.0.rc3 I did not get it working at all.

$ dawn kb status
[2019-05-23 10:28:40] INFO  (dawn): dawn v2.0.0.rc3 is starting up
[2019-05-23 10:28:40] ERROR (dawn): Missing kb.yaml in /home/thesp0nge/src/hacking/dawnscanner/db. Giving up
[2019-05-23 10:28:40] ERROR (dawn): An invalid library it has been found. Please use --recovery flag to force fresh install from dawnscanner.org
[2019-05-23 10:28:40] INFO  (dawn): 0 security checks loaded
[2019-05-23 10:28:40] INFO  (dawn): dawn is shutting down

$ dawn scan --help
[2019-05-23 10:27:01] INFO  (dawn): dawn v2.0.0.rc3 is starting up
[2019-05-23 10:27:01] ERROR (dawn): invalid directory (--help)

$ dawn scan --skip
No value provided for option '--skip'