Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ability to include multiple brakeman.ignore files via cmd #1856

Open
Karl-H opened this issue Jul 8, 2024 · 1 comment
Open

Ability to include multiple brakeman.ignore files via cmd #1856

Karl-H opened this issue Jul 8, 2024 · 1 comment

Comments

@Karl-H
Copy link

Karl-H commented Jul 8, 2024

Is your feature request related to a problem? Please describe.
Currently when running brakeman to generate a report to upload to our vulnerability management system we use --add-engines-path=../additional_stuff/ to scan another area of our app, however because this directory has a separate brakeman ignore file and the build will only look in the current directory for a brakeman ignore file, the ignore warnings are ignored and subsequently false positives make it to the report.

Describe the solution you'd like
Ability to pass multiple ignore file paths via command line

Describe alternatives you've considered
Manually merging the changes across, this isn't idea as we have a large amount of dev's working on the project and the manually created file risks becoming stale

@Karl-H Karl-H changed the title Ability to include multiple brakrman.ignore files via cmd Ability to include multiple brakeman.ignore files via cmd Jul 8, 2024
@presidentbeef
Copy link
Owner

Hi Karl, I think I understand your issue. Specifying multiple ignore configurations is probably not too hard to add.

But the trouble begins when someone wants to edit the ignored warnings and uses --interactive-ignore/-I. Now there's complexity in which file(s) gets edited. Enough complexity (in poorly tested code) that I'm probably not going to attempt adding this feature myself.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants