Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ignore Gemfile.lock for some rules #84

Merged
merged 1 commit into from
Dec 6, 2023
Merged

Conversation

markdboyd
Copy link
Contributor

Changes proposed in this pull request:

Gemfile.lock is an auto-generated file for Ruby dependency management via bundler. It's the Ruby equivalent of package-lock.json in Node

Since it's an auto-generated file that we don't control the contents of, I don't think we need to scan it, at least for certain rules.

For example, without these changes I'm getting a lot of exceptions for the IPv4 addresses rule, but the contents aren't IP addresess, they're package versions such as:

      parser (>= 3.2.2.3)

So this PR adds Gemfile.lock to be ignored for those rules, which I can confirm allowed me to commit my Gemfile.lock file locally with these changes.

security considerations

We are updating the ignore patterns for GitLeaks, so we should agree that we are not ignoring potentially dangerous changes in Gemfile.lock files. However, since this file is auto-generated and not edited manually, I don't think that such concerns apply here.

@markdboyd markdboyd requested a review from pburkholder August 14, 2023 21:49
@markdboyd markdboyd force-pushed the ignore-gemfile-lock branch from 3dc2244 to b4a8db1 Compare December 5, 2023 22:09
Copy link

@JasonTheMain JasonTheMain left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good

@markdboyd markdboyd merged commit f410c9e into main Dec 6, 2023
1 check passed
@markdboyd markdboyd deleted the ignore-gemfile-lock branch December 6, 2023 13:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants