suppress

package
v3.102.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 3, 2026 License: AGPL-3.0 Imports: 3 Imported by: 0

Documentation

Overview

Package suppress holds the shared "ignore rule" matching logic used by every scanner pipeline (SAST family, SCA, license, malscan) to drop findings that an org-level or local Suppression covers, before report output is generated.

A rule is anchored by one or more of: rego rule id (the rego file id), a finding id (CVE/vuln id), a component value (an inventory component's SPDX id / purl / model name), or a file path — optionally narrowed to a line range. A finding is suppressed when every anchor the rule specifies matches the finding and the rule is active and unexpired.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func RepoFullName

func RepoFullName(remotes []string) string

RepoFullName derives "owner/repo" from the first parseable git remote URL. Supports scp-style (git@github.com:owner/repo.git) and URL-style (https://host/owner/repo.git) remotes. Returns "" when none parse.

Types

type Finding

type Finding struct {
	Category  string
	RuleID    string
	FindingID string
	// Value is the component identity an inventory rule's TargetValue is
	// compared against. Empty for the scanner families, which have no such id.
	Value    string
	FilePath string
	// Line is the 1-based line the finding sits on, when known. Zero means
	// "unknown", which makes a rule's line range non-binding — see ruleMatches.
	Line int
}

Finding is the subset of any scanner result the matcher inspects.

type Rule

type Rule struct {
	UUID      string
	RuleID    string
	Category  string
	Type      string
	Reason    string
	FindingID string
	// TargetValue anchors an inventory rule to a component identity: an
	// algorithm SPDX id, a certificate subject, a purl or a model name. Crypto
	// and AI components have no rego rule id and no CVE, so this is the only
	// anchor that names them.
	TargetValue        string
	FilePath           string
	LineNumber         int
	LineRange          string
	RepositoryFullName string
	Branch             string
	ExpiresAt          int64
	IsActive           bool
}

Rule is the normalized form a Set matches against. It is produced from a memory.SuppressionRecord (local) or a backend Suppression (remote).

func FromMemory

func FromMemory(recs []memory.SuppressionRecord) []Rule

FromMemory converts local suppression records to matcher rules.

type Set

type Set struct {
	// contains filtered or unexported fields
}

Set is a matchable collection of rules.

func NewSet

func NewSet(rules []Rule, now int64) *Set

NewSet builds a Set from rules, keeping only those active and unexpired at now.

func (*Set) Empty

func (s *Set) Empty() bool

Empty reports whether the set has no active rules.

func (*Set) Match

func (s *Set) Match(f Finding) (Rule, bool)

Match returns the first rule that suppresses f, and whether one was found.

func (*Set) Suppresses

func (s *Set) Suppresses(f Finding) bool

Suppresses is Match without the matched rule.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL