You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Description:
Semgrep recently removed the "Fingerprint" field from its reports. If you do not log in to Semgrep Cloud, the value for this field is set to "requires login". This causes all findings to be closed immediately after upload, except for one. This issue should be handled similarly to cases where the "Fingerprint" field is absent in the uploaded report.
Steps to Reproduce:
Upload the provided sample file for a product in Defectdojo.
Observe that the "Fingerprint" field in the findings is set to "requires login" due to not logging into Semgrep Cloud within our DevSecOps framework.
Notice that all findings, except one, are closed immediately after the upload completes.
Expected Behavior:
The system should handle the "requires login" value in the "Fingerprint" field in the same way it handles the absence of this field, preventing the premature closure of findings, i.e., falling back to the Legacy deduplication algorithm for Semgrep JSON Report.
Looking at the Semgrep CLI this is indeed a valid use-case, running a scan without logging in. Would you be able to make a PR to detect this "requires login" string? I notice it's also present in the lines field, where it should be ignored as well even though it doesn't affect deduplication / reimport.
Same is happening in #11470 indeed.
Description:
Semgrep recently removed the "Fingerprint" field from its reports. If you do not log in to Semgrep Cloud, the value for this field is set to "requires login". This causes all findings to be closed immediately after upload, except for one. This issue should be handled similarly to cases where the "Fingerprint" field is absent in the uploaded report.
Steps to Reproduce:
Expected Behavior:
The system should handle the "requires login" value in the "Fingerprint" field in the same way it handles the absence of this field, preventing the premature closure of findings, i.e., falling back to the Legacy deduplication algorithm for Semgrep JSON Report.
i suspect this can be similar to #11470, however, I am not sure.
Semgrep_w-o_Fingerprints.json
The text was updated successfully, but these errors were encountered: