René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"upload-sarif@v2 Doesn't support `suppressions` property in Sarif files.","articleBody":"I've recently noticed, when running `semgrep`, that findings that are suppressed in code with `#nosemgrep` flag the results with a `suppressions` property. This seems to be [valid sarif formatting](https://docs.oasis-open.org/sarif/sarif/v2.1.0/csprd01/sarif-v2.1.0-csprd01.html#_Toc10541099).\r\n\r\nExample of a result:\r\n```\r\n{\r\n    \"$schema\": \"https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/schemas/sarif-schema-2.1.0.json\",\r\n    \"runs\": [\r\n        {\r\n            \"invocations\": [\r\n                {\r\n                    \"executionSuccessful\": true,\r\n                    \"toolExecutionNotifications\": []\r\n                }\r\n            ],\r\n            \"results\": [\r\n                {\r\n                    \"locations\": [\r\n                        {\r\n                            \"physicalLocation\": {\r\n                                \"artifactLocation\": {\r\n                                    \"uri\": \"backend/opre_ops/django_config/settings/common.py\",\r\n                                    \"uriBaseId\": \"%SRCROOT%\"\r\n                                },\r\n                                \"region\": {\r\n                                    \"endColumn\": 15,\r\n                                    \"endLine\": 91,\r\n                                    \"snippet\": {\r\n                                        \"text\": \"REST_FRAMEWORK = {  # nosemgrep: python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config\"\r\n                                    },\r\n                                    \"startColumn\": 1,\r\n                                    \"startLine\": 91\r\n                                }\r\n                            }\r\n                        }\r\n                    ],\r\n                    \"message\": {\r\n                        \"text\": \"Django REST framework configuration is missing default rate- limiting options. This could inadvertently allow resource starvation or Denial of Service (DoS) attacks. Add 'DEFAULT_THROTTLE_CLASSES' and 'DEFAULT_THROTTLE_RATES' to add rate-limiting to your application.\"\r\n                    },\r\n                    \"ruleId\": \"python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config\",\r\n                    \"suppressions\": [\r\n                        {\r\n                            \"kind\": \"inSource\"\r\n                        }\r\n                    ]\r\n                }\r\n            ],\r\n            \"tool\": {\r\n                \"driver\": {\r\n                    \"name\": \"semgrep\",\r\n                    \"rules\": [\r\n                        {\r\n                            \"defaultConfiguration\": {\r\n                                \"level\": \"error\"\r\n                            },\r\n                           ...\r\n                    \"semanticVersion\": \"0.111.1\"\r\n                }\r\n            }\r\n        }\r\n    ],\r\n    \"version\": \"2.1.0\"\r\n}\r\n```\r\n\r\nWhen results like this are uploaded via the `github/codeql-action/upload-sarif@v2` the results are still propagated as-if valid findings.\r\n\r\nShouldn't these be ignored, or flagged in some other way? ","author":{"url":"https://github.com/tdonaworth","@type":"Person","name":"tdonaworth"},"datePublished":"2022-09-02T01:09:04.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":12},"url":"https://github.com/1230/codeql-action/issues/1230"}