Skip to main content

    How to exclude certain file types for a particular rule

    Certain filetypes can generate numerous false positives and delay your triage process. This document helps you achieve a selective middle ground:

    • Continue to include the file type to scan with other rules
    • Reduce time spent triaging false positives


    This article uses a real-life case in scanning .svg files. svg files mostly comprise a string of thousands of characters:

    <image id="image0" width="2896" height="998" xlink:href="data:image/png;

    Semgrep’s standard artifactory rule (see in Semgrep Registry), for example, reports on:

    _\# ruleid: detected-artifactory-password_


    _\# ruleid: detected-artifactory-password_



    Because .svg files are made up of thousands of characters, the substring AP6*m... in the .svg snippet creates a false positive finding due to the artifactory rule. It is a false positive because no passwords are leaked by the .svg file.

    Choosing the appropriate ignoring solution

    Semgrep offers many different ways of ignoring false positives:

    • Adding nosemgrep as a comment on the first line of code in the file. This would require having to keep track of each new file for this target .svg file type and editing each file accordingly, requiring constant maintenance.
    • Ignore the file entirely, by adding it to a .semgrepignore file. This would exclude the file from being scanned with all rules, not just the artifactory rule.

    Achieving a happy medium: creating a custom rule to exclude a file type

    You can safely assume .svg files do not intentionally contain artifactory passwords, so you can exclude this file type from being scanned. The following procedure demonstrates how to create a customized version of the rule that is generating the false positives that excludes the target file type.

    1. Download the rule generating false positives from the Registry.
    2. Modify the rule ID to something custom:
      \- id: my_detected-artifactory-password
    1. Exclude the target filetype in question from the rule through the path field:
     % cat my_custom_artifactory.yml 


    \- id: my_detected-artifactory-password



    - metavariable-analysis:
    analyzer: entropy
    metavariable: $ITEM

    - "*.svg"
    - generic
    1. Alter the scan command to still scan for the default configuration you have, with the following changes:
      1. Exclude the original noisy rule as articulated in the false positive reporting.
      2. Include the new custom rule that excludes your target paths.

    Thus, your original semgrep scan command or semgrep ci command can be similar to the following::

    % semgrep scan --config=auto --config=my_custom_artifactory.yml --exclude-rule

    Not finding what you need in this doc? Ask questions in our Community Slack group, or see Support for other ways to get help.