diff --git a/analyzer.go b/analyzer.go index f605d58bac..e140170069 100644 --- a/analyzer.go +++ b/analyzer.go @@ -394,10 +394,13 @@ func (gosec *Analyzer) Visit(n ast.Node) ast.Visitor { for _, rule := range gosec.ruleset.RegisteredFor(n) { // Check if all rules are ignored. - suppressions, ignored := ignores[aliasOfAllRules] - if !ignored { - suppressions, ignored = ignores[rule.ID()] - } + generalSuppressions, generalIgnored := ignores[aliasOfAllRules] + // Check if the specific rule is ignored + ruleSuppressions, ruleIgnored := ignores[rule.ID()] + + ignored := generalIgnored || ruleIgnored + suppressions := append(generalSuppressions, ruleSuppressions...) + // Track external suppressions. if gosec.ruleset.IsRuleSuppressed(rule.ID()) { ignored = true diff --git a/analyzer_test.go b/analyzer_test.go index 5a035709ca..daa0363c99 100644 --- a/analyzer_test.go +++ b/analyzer_test.go @@ -620,7 +620,7 @@ var _ = Describe("Analyzer", func() { err = analyzer.Process(buildTags, nosecPackage.Path) Expect(err).ShouldNot(HaveOccurred()) issues, _, _ := analyzer.Report() - Expect(issues).To(HaveLen(1)) + Expect(issues).To(HaveLen(sample.Errors)) Expect(issues[0].Suppressions).To(HaveLen(1)) Expect(issues[0].Suppressions[0].Kind).To(Equal("inSource")) Expect(issues[0].Suppressions[0].Justification).To(Equal("Justification")) @@ -640,12 +640,31 @@ var _ = Describe("Analyzer", func() { err = analyzer.Process(buildTags, nosecPackage.Path) Expect(err).ShouldNot(HaveOccurred()) issues, _, _ := analyzer.Report() - Expect(issues).To(HaveLen(1)) + Expect(issues).To(HaveLen(sample.Errors)) Expect(issues[0].Suppressions).To(HaveLen(1)) Expect(issues[0].Suppressions[0].Kind).To(Equal("inSource")) Expect(issues[0].Suppressions[0].Justification).To(Equal("")) }) + It("should track multiple suppressions if the violation is suppressed by both #nosec and #nosec RuleList", func() { + sample := testutils.SampleCodeG101[0] + source := sample.Code[0] + analyzer.LoadRules(rules.Generate(false, rules.NewRuleFilter(false, "G101")).RulesInfo()) + + nosecPackage := testutils.NewTestPackage() + defer nosecPackage.Close() + nosecSource := strings.Replace(source, "}", "} //#nosec G101 -- Justification", 1) + nosecSource = strings.Replace(nosecSource, "func", "//#nosec\nfunc", 1) + nosecPackage.AddFile("pwd.go", nosecSource) + err := nosecPackage.Build() + Expect(err).ShouldNot(HaveOccurred()) + err = analyzer.Process(buildTags, nosecPackage.Path) + Expect(err).ShouldNot(HaveOccurred()) + issues, _, _ := analyzer.Report() + Expect(issues).To(HaveLen(sample.Errors)) + Expect(issues[0].Suppressions).To(HaveLen(2)) + }) + It("should not report an error if the rule is not included", func() { sample := testutils.SampleCodeG101[0] source := sample.Code[0]