SAST scanner configuration file

General configuration file keys

Here is a simple and recommended overview of the general configuration file keys. Remember that this applies to all of Fluid Attacks’ scanners .

namespace: myappoutput:  file_path: ./Fluid-Attacks-Results.csv  format: CSVworking_dir: .language: EN

Specific configuration file keys

The following keys are available only for the SAST scanner.

file_size_limit

By default, there is a file size limit to prevent long analysis times. Set file_size_limit to false to remove the limit if crucial files are omitted because of it:

file_size_limit: false

sast

This key has three configuration options:

1. include (mandatory): Paths to files or directories to analyze
2. exclude (optional): Files or directories to exclude from the analysis
3. recursion-limit (optional): An integer limit for recursion depth, which is useful if SAST execution takes too long (over 1 hour) or encounters memory/recursion errors (the recommended and default value for this option is 1000)

For example:

sast:  include:    - relative/path/to/file    - relative/path/to/directory/  # Optional keys  exclude:    - glob(**/node_modules/)  recursion-limit: 1000

Specify paths in the include/exclude subsections

You can specify your paths in two different ways:

1. Using a path relative to the working directory (if the [working_dir](https://help.fluidattacks.com/portal/en/kb/articles/use-standalone-scanners#working_dir) key is not defined, the working directory is automatically set to the same directory you called the scanner execution), for example:

namespace: namespaceworking_dir: /test/directorysast:  include:    - src/main/java/org/test/Test.java

1. Using Unix-style globs , relative to working_dir, for example:

namespace: namespaceworking_dir: /test/directorysast:  include:    - glob(*)  exclude:    - glob(**.java)    - glob(src/**/test*.py)

The recommended configuration is to scan all paths of working_dir by using . in the include option:

sast:  include:    - .

Configuration file example

Below is an example of a highly personalized configuration file:

namespace: my_appworking_dir: ./commit: e59607b9de3ef4c13d292705fg3da1ff0c67eb38language: ENoutput:  file_path: /fluid-attacks-results.csv  format: CSVchecks:  - F052strict: falsefile_size_limit: falsesast:  include:    - src/main/java/org/test/Test.java    - glob(**.py)

  exclude:    - glob(src/**/test*.py)