[go: up one dir, main page]

Skip to content

Spike diff based scanning for advanced SAST

Summary

This issue aims to address questions raised in Faster Advanced SAST: Diff-based scanning in MRs (&16790 - closed) to support planning breakdown.

Spike tasks

  • Identify code changes required to scan specific files in GLAS.
  • Build a prototype and benchmark performance against a full scan
  • Investigate if the selective_scan_neighborhood_depth flag is able to accurately detect a cross file vuln that spans the depth specified by the flag.
  • Changes needed for the scanner report
  • Investigate how scans for MRs targeting non-default branches are currently handled, and assess whether we should support this use case alongside default branch MRs.
  • Evaluate the SECRET_DETECTION_LOG_OPTIONS variable to determine if a similar variable is needed
    • Discussed in diff customization section of this thread
  • Determine the logic for Diff calculation
  • Identify code changes required to display diff based scan results in the UI
Edited by Shao Ming Tan