microsoft / microsoft/sarif-web-component
Suppressions are not respected
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 108
- Forks
- 36
- Avg merge
- 5d 15h
- Merged PRs (30d)
- 3
Description
We're using the Sarif Viewer Build Tab within our Azure DevOps build pipeline.
In our SARIF file, we have some errors that we suppressed as they only exist in unit tests and are not true vulnerabilities. This leads to the following output in the SARIF file:
"suppressions" : [ {
"kind" : "inSource"
} ]
However, the issue still shows up on the Scans tab, which indicates that the suppression isn't being respected.
Please let me know if this issue should instead be filed under the Sarif Viewer Build Tab GitHub project or elsewhere.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the Scans tab with the SARIF example containing an inSource suppression, then trace how suppressed results are handled in the component. Done means suppressed findings no longer appear on the Scans tab while unsuppressed findings remain visible.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- react, typescript
- Domain
- frontend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100