diff --git a/README.md b/README.md index d5280fb..a7369de 100644 --- a/README.md +++ b/README.md @@ -149,6 +149,9 @@ A `.njsscan` file in the root of the source code directory allows you to configu - regex_injection_dos - pug_jade_template + severity-filter: + - WARNING + - ERROR ``` ## Suppress Findings diff --git a/njsscan/njsscan.py b/njsscan/njsscan.py index cc52ea0..dcf41ed 100644 --- a/njsscan/njsscan.py +++ b/njsscan/njsscan.py @@ -27,6 +27,7 @@ def __init__(self, paths, json, check_controls, config=False) -> None: 'ignore_extensions': conf['ignore_extensions'], 'ignore_paths': conf['ignore_paths'], 'ignore_rules': conf['ignore_rules'], + 'severity_filter': conf['severity_filter'], 'show_progress': not json, } self.paths = paths @@ -50,6 +51,8 @@ def format_output(self, results) -> dict: self.format_sgrep(results['semantic_grep']) self.format_matches(results['pattern_matcher']) self.post_ignore_rules() + self.post_ignore_rules_by_severity('nodejs') + self.post_ignore_rules_by_severity('template') self.post_ignore_files() def missing_controls(self, result): @@ -101,6 +104,19 @@ def post_ignore_rules(self): if rule_id in self.result['templates']: del self.result['templates'][rule_id] + def post_ignore_rules_by_severity(self, key): + """Filter findings by rule severity.""" + del_keys = set() + if key not in self.result: + return + for rule_id, details in self.result[key].items(): + issue_severity = details.get('metadata').get('severity') + if issue_severity not in self.options['severity_filter']: + del_keys.add(rule_id) + for rid in del_keys: + if rid in self.result[key]: + del self.result[key][rid] + def suppress_pm_comments(self, obj, rule_id): """Suppress pattern matcher.""" file_path = obj['file_path'] diff --git a/njsscan/settings.py b/njsscan/settings.py index f718da8..95db55b 100644 --- a/njsscan/settings.py +++ b/njsscan/settings.py @@ -64,3 +64,9 @@ 'helmet_header_xss_filter', 'helmet_header_check_crossdomain', } + +SEVERITY_FILTER = ( + 'INFO', + 'WARNING', + 'ERROR', +) diff --git a/njsscan/utils.py b/njsscan/utils.py index d878969..49dce6c 100644 --- a/njsscan/utils.py +++ b/njsscan/utils.py @@ -19,6 +19,7 @@ def get_config(base_path, config_file): 'ignore_extensions': config.IGNORE_EXTENSIONS, 'ignore_paths': config.IGNORE_PATHS, 'ignore_rules': set(), + 'severity_filter': config.SEVERITY_FILTER, } if config_file: cfile = Path(config_file) @@ -36,6 +37,7 @@ def get_config(base_path, config_file): usr_igonre_paths = root.get('ignore-paths') usr_ignore_exts = root.get('ignore-extensions') usr_ignore_rules = root.get('ignore-rules') + usr_severity_filter = root.get('severity-filter') if usr_njs_ext: options['nodejs_extensions'].update(usr_njs_ext) if usr_tmpl_ext: @@ -48,6 +50,8 @@ def get_config(base_path, config_file): options['ignore_extensions'].update(usr_ignore_exts) if usr_ignore_rules: options['ignore_rules'].update(usr_ignore_rules) + if usr_severity_filter: + options['severity_filter'] = usr_severity_filter return options