Skip to content

Commit

Permalink
Adding documentation for argot:ignore in taint analysis.
Browse files Browse the repository at this point in the history
  • Loading branch information
victornicolet committed Oct 28, 2024
1 parent 1d0446a commit 7dbdcfd
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 0 deletions.
1 change: 1 addition & 0 deletions analysis/annotations/annotations.go
Original file line number Diff line number Diff line change
Expand Up @@ -102,6 +102,7 @@ func (a Annotation) IsMatchingAnnotation(kind AnnotationKind, tag string) bool {
return a.Kind == kind && (tag == AnyTag || (len(a.Tags) > 0 && a.Tags[0] == AnyTag) || slices.Contains(a.Tags, tag))
}

// LinePos is a simple line-file position indicator.
type LinePos struct {
Line int
File string
Expand Down
11 changes: 11 additions & 0 deletions doc/01_taint.md
Original file line number Diff line number Diff line change
Expand Up @@ -202,6 +202,17 @@ options:
max-alarms: 2
```

#### Finding Suppression

You may encounter false positives in the taint analysis, some of which cannot be easily resolved by making the configuration more precise or by changing the code.
When you are confident the finding is a false positive, you can suppress the findings of the taint analysis on a specific line by using the `//argot:ignore problem-tag` annotation.
For example:
```go
...
callSink(notReaalyTaintedData) //argot:ignore _
```
Will suppress findings for all taint problems. Taint problems can be associated with a `tag: tagName` in the configuration, and you can suppress findings specifically for `tagName` by using `//argot:ignore tagName`.

#### Warning Suppression
The use can set the setting `warn: false` to suppress warnings during the analysis. This means that if the analysis encounters program constructs that make it unsound, those will not be reported. This setting does not affect the soundness of the analysis, but it will cause the tool to not report when your program falls beyond the soundness guarantees.

Expand Down

0 comments on commit 7dbdcfd

Please sign in to comment.