Thanks a bunch @griffinbyatt for the prompt help. The latest update works perfectly !! 
Also, there was an issue with my setup as well ( 
). Look forward to investigating the results !!
raags90
2
griffinbyatt
griffinbyatt
Just pushed a new update! Install with mix archive.install hex sobelow.
This is a pretty big one. There are bug fixes and additional checks that should flag more XSS, and SQL injection. You can also now suppress false-positives on a per-function basis. For example:
@sobelow_skip ["Traversal"]
def vuln_func(...) do
...
end
Sobelow will now stop flagging this function for traversal findings.
As always, feedback and error reports are very appreciated.
1
OvermindDL1
griffinbyatt
The config checks are a bit different, since they are one-offs already. You’ll still need to use the --ignore flag for those.
$ mix sobelow -i Config.HTTPS
I should’ve included that in the initial comment 
0
OvermindDL1
Aww, no way to decorate the config files themselves with @sobelow_skip things?
Or have a config file just for sobelow for global ignores like that?
2
griffinbyatt
Not yet 
By 1.0.0 there will be some sort of config! For now, I’m prioritizing getting all the options figured out and security checks in place, so that even if it’s not always the most convenient, it’s still the most usable.
3
griffinbyatt
I’ve released a couple updates over the last week.
Sobelow will now do a better job of handling non-standard Phoenix applications. For the most part, if you say something is a Phoenix app, Sobelow will do it’s best to scan it, but will print helpful error messages in case you made a mistake. This makes it easier to scan each part of an umbrella application.
For people integrating with CI pipelines, there is a new exit flag. The exit option accepts a confidence threshold (low, medium, or high), and will return a non-zero exit status for findings above that threshold.
For example: mix sobelow --exit Medium will have a non-zero exit status for medium and high confidence findings.
Other than that, bug fixes should continue to improve the quality of reports
1
brightball
The way that Brakeman handles that is to provide you with an interactive mode that will let you determine whether or not to ignore a particular warning signature. That creates a brakeman.ignore file that can be loaded as part of your build process (with a note on why it can be ignored).
Once you audit and either fix / ignore items from the initial round of issues than a CI process will only let you know about the new vulnerabilities and that’s the real goal I think.
0
griffinbyatt
You can ignore findings in Sobelow on a per-function basis now! You can also use the ignore flag to ignore classes of vulnerabilities, which has been around since the beginning.
2