- Notifications
You must be signed in to change notification settings - Fork1.7k
Rust: Make rust/summary/query-sinks less noisy#20042
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Uh oh!
There was an error while loading.Please reload this page.
Conversation
…This is the one in the DCA meta queries output, not the grand total used in metrics.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Pull Request Overview
This PR reduces noise in therust/summary/query-sinks query by filtering out ubiquitous sink types that typically clutter the results. The query is used in DCA meta queries output and for ad-hoc database analysis, where dereference and logging sinks often obscure more interesting security-relevant findings.
- Filters out
AccessInvalidPointer::SinkandCleartextLogging::Sinkfrom query results - Updates documentation to reflect the filtering of ubiquitous sink types
- Adds necessary imports for the filtered sink types
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Looks good to me.
d264fb5 intogithub:mainUh oh!
There was an error while loading.Please reload this page.
Make
rust/summary/query-sinksless noisy. This is the one used in the DCA meta queries output, and occasionally used ad-hoc to get a feel for a database - but it isnot used in metrics (the counts produced byrust/summary/query-sink-countsandrust/summary/summary-statisticsare not affected by this change). Currently for both uses results for this query are typically clogged with dereference and logging sinks, which obscures and in the case of the DCA meta queries output can completely hide other more interesting results.