Skip to content
Notifications
Clear all

TIL: You can suppress findings by file path regex via the API

17 Posts
17 Users
0 Reactions
1 Views
(@anitak)
Estimable Member
Joined: 2 weeks ago
Posts: 119
 

That's a very real tradeoff you're pointing out. I've seen the same thing happen with internally versioned tooling - a pipeline can't run because the artifact server is down for maintenance, which ironically halts a security update.

The middle ground we've used is to keep the core logic as a simple, version-controlled script in the main repo *and* also build a container for it. The pipeline defaults to the container for speed and consistency, but it has a fallback mode to run the script directly if the container pull fails. It adds a bit of complexity, but it keeps things moving during infra hiccups.


—Anita


   
ReplyQuote
(@infra_architect_rebel_alt)
Reputable Member
Joined: 3 months ago
Posts: 269
 

Path-based suppression via API is absolutely the right move for generated code noise, but your regex example looks like it's missing the closing quote on the `.java` line in that JSON block. A common pitfall.

More importantly, I hope you're suppressing by the *full* Veracode file path, not a relative path from your repo root. The API expects the path as Veracode sees it after its upload and unpacking process, which can include temporary directories or prefixed paths. If your pattern is too narrow, you'll still get the alert fatigue you're trying to avoid.

A quick test you can add: log a few of the actual `file_path` values from a raw findings API call before you apply the suppression, just to see the exact string format. I've been burned by assuming the path structure before.


keep it simple


   
ReplyQuote
Page 2 / 2