Suppress CredScan error from legitimate unit test PFX file with priva…

…te key (#9477) Fixes https://devdiv.visualstudio.com/DevDiv/_workitems/edit/1922736 Context CredentialScanner detected .\src\Tasks.UnitTests\TestResources\mycert.pfx that had certificate keys. Since it's legitimate unit test PFX file, this is false positive. Changes Made Suppress the CredScan error from the UT PFX file. Testing Verified the run with this experimental branch. The CredScan error was eliminated. Co-authored-by: Rainer Sigwald <raines@microsoft.com>
dotnet · Dec 1, 2023 · 67916dc · 67916dc
1 parent d8283be
commit 67916dc
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 0 deletions.
diff --git a/.vsts-dotnet.yml b/.vsts-dotnet.yml
@@ -311,4 +311,5 @@ stages:
         -TsaRepositoryName "dotnet-msbuild"
         -TsaCodebaseName "dotnet-msbuild"
         -TsaPublish $True
+        -CrScanAdditionalRunConfigParams @("SuppressionsPath < $(Build.SourcesDirectory)\eng\CredScanSuppressions.json")
         -PoliCheckAdditionalRunConfigParams @("UserExclusionPath < $(Build.SourcesDirectory)\eng\policheck_exclusions.xml")'
diff --git a/eng/CredScanSuppressions.json b/eng/CredScanSuppressions.json
@@ -0,0 +1,9 @@
+{
+    "tool": "Credential Scanner",
+    "suppressions": [
+      {
+        "file": "\\src\\Tasks.UnitTests\\TestResources\\mycert.pfx",
+        "_justification": "New certificate file with private key used only for testing"
+      }
+    ]
+ }