Brakeman

We use brakeman to check the Open Build Service Frontend codebase for security vulnerabilities.

Silence False Positives

From time to time it can happen that brakeman detects vulnerabilities in our CI, which turn out to be False Positives. In order to ignore those warnings, they need to be listed in the brakeman config file located in...

src/api/config/brakeman.ignore

Doing this manually is a lot of work, so brakeman offers an interactive way to get it done. Just run brakeman with...

docker compose run --rm frontend brakeman -I

Choose the default config file as suggested (Input file: |/obs/src/api/config/brakeman.ignore|) and continue with option number two (Hide previously ignored warnings), to only display new warnings. Double check if it is really a 'false positive', and ignore it by choosing 'i' when brakeman asks you to select an action.

For more details checkout https://brakemanscanner.org/docs/ignoring_false_positives/