Suppress credscan warnings in X.509 test files #91041
Conversation
|
Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones Issue DetailsRecent updates to the unit test files are triggering credscan violations (AzDO 1840538). Our usage on line 56 is safe since there's no private key data present, and our usage on line 3063 is safe since it's a self-signed cert we generated specifically for unit test inclusion. No real creds (either prod or test) are present in these files. After consulting with the Guardian team via email, the consensus suggestion was not to update the existing CredScanSuppressions.json file to recognize this secret, but instead to suppress the credscan checks at the two field definitions themselves. CredScan requires a suppression either on the same line or on the line immediately preceding where the cred starts. Using the
|
|
/backport to release/8.0 |
|
Started backporting to release/8.0: https://github.com/dotnet/runtime/actions/runs/5967094123 |
ghost
locked as resolved and limited conversation to collaborators
Recent updates to the unit test files are triggering credscan violations (AzDO 1840538). Our usage on line 56 is safe since there's no private key data present, and our usage on line 3063 is safe since it's a self-signed cert we generated specifically for unit test inclusion. No real creds (either prod or test) are present in these files.
After consulting with the Guardian team via email, the consensus suggestion was not to update the existing CredScanSuppressions.json file to recognize this secret, but instead to suppress the credscan checks at the two field definitions themselves.
CredScan requires a suppression either on the same line or on the line immediately preceding where the cred starts. Using the
/* ... */pattern here seemed cleaner than other alternatives which would have required me to shift whitespace and other code blocks around. I opted for the smallest possible code change here.