Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Missing "Fingerprint" Field in Semgrep JSON Report Due to Login Requirement, Causes Immediate Closure of Uploaded Findings #11480

Open
farsheedify opened this issue Dec 30, 2024 · 2 comments
Labels

Comments

@farsheedify
Copy link

farsheedify commented Dec 30, 2024

Description:
Semgrep recently removed the "Fingerprint" field from its reports. If you do not log in to Semgrep Cloud, the value for this field is set to "requires login". This causes all findings to be closed immediately after upload, except for one. This issue should be handled similarly to cases where the "Fingerprint" field is absent in the uploaded report.

Steps to Reproduce:

  1. Upload the provided sample file for a product in Defectdojo.
  2. Observe that the "Fingerprint" field in the findings is set to "requires login" due to not logging into Semgrep Cloud within our DevSecOps framework.
  3. Notice that all findings, except one, are closed immediately after the upload completes.

Expected Behavior:
The system should handle the "requires login" value in the "Fingerprint" field in the same way it handles the absence of this field, preventing the premature closure of findings, i.e., falling back to the Legacy deduplication algorithm for Semgrep JSON Report.

i suspect this can be similar to #11470, however, I am not sure.
Semgrep_w-o_Fingerprints.json

@valentijnscholten
Copy link
Member

valentijnscholten commented Dec 30, 2024

Looking at the Semgrep CLI this is indeed a valid use-case, running a scan without logging in. Would you be able to make a PR to detect this "requires login" string? I notice it's also present in the lines field, where it should be ignored as well even though it doesn't affect deduplication / reimport.
Same is happening in #11470 indeed.

@farsheedify
Copy link
Author

@valentijnscholten I made the following PR:
#11495

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants