Improve a bit our SAST

3 years ago · 5df9573e54
parent 12a8a6b876
commit 5df9573e54
2 changed files with 6 additions and 1 deletions
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@ -15,7 +15,7 @@ variables:
  ARTIFACT_COMPRESSION_LEVEL: "fast"
  CACHE_COMPRESSION_LEVEL: "fast"
  SAST_EXCLUDED_ANALYZERS: "bandit"
-  SAST_EXCLUDED_PATHS: spec,test,tests,tmp,extern
+  SAST_EXCLUDED_PATHS: "extern"

 .Ubuntu_Image:
  tags:
--- a/.gitlab/sast-ruleset.toml
+++ b/.gitlab/sast-ruleset.toml
@ -69,3 +69,8 @@
 		[flawfinder.ruleset.identifier]
 			type = "flawfinder_func_name"
 			value = "printf"  # only false positives, sigh
+	[[flawfinder.ruleset]]
+		disable = true
+		[flawfinder.ruleset.identifier]
+			type = "flawfinder_func_name"
+			value = "system"  # only false positives, sigh