--exclude not working with SFL?

[arthurakay]

I'm running the following command, attempting to ignore node_modules but I can't quite seem to make it work. Can someone please offer advice?

	docker run --rm --name=Glue \
		-v $(PWD):/tmp/triage owasp/glue \
		-t sfl \
		-t retirejs \
		-t nodesecurityproject \
		-f teamcity \
		--teamcity-min-level 1 \
		--exclude node_modules \
		--finding-file-path /tmp/triage/glue_ignore.json  \
		--debug \
		/tmp/triage

Glue runs normally, and my --finding-file-path correctly ignores results... but I'd like to always ignore anything found in node_modules since I don't control everything my dependencies drag in. Currently SFL is flagging like 30+ files from that directory.

[omerlh]

Looking at the SFL task code, I think the --exclude flag is not honored. Looking on other tasks, look like some tasks do hard-coded exclude (Snyk, NSP) - ignoring folders like node_modules.
I'll recommend you to try using the new dynamic task instead of fixing the task. Or, if you prefer, I can help you out adding a PR to fix this bug.

[arthurakay]

I think generally speaking if there's a --exclude option it should work consistently across all tasks that are out-of-the-box.

I tried for about 2 hours tonight to put together a PR myself, but I'm terrible at Ruby and I'm just going to throw in the towel. Is this something you could put together quickly? I'd really appreciate it.

[omerlh]

I agree, we should move on and remove this option globally.
While I try to look into that (not promise anything, but hope to have sometime later this week) - have you looked into the dynamic task? This will be much faster.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.