Semgrep: the check id is the full rule name

The id is the whole string

A finding’s check id is the rule that matched, often a dotted path or a namespaced id. The last segment can be shared by two rules in two packs. The finding is the full string, plus the file and line. A shortened id in a ticket can point at the wrong rule.

The message is still the rule author’s text. It does not replace the id. If the message is clearer than the id, quote both, and do not drop the id.

The pack is not a second finding

The config you passed, such as a language pack plus a local folder, explains where the rule came from. It is not a second match. Write the full check id, and write the config if you need to say which pack was loaded. Two findings with two full ids are two rules even when the messages sound alike.

What to file

File the full check id, the path, the line, and the scan root if the path is relative. If the id in the note was shortened, write “full id not copied” and do not pick a rule by the suffix. A suppression comment has to name the same full id, or it is a different exception.

Worked case: a suffix that matched two rules

A lab finding’s check id is python.lang.security.audit.example-timeout.example-timeout. Another local rule ends in example-timeout and checks a different function. A draft files the local rule and says that function was the match. The path and line are the first rule’s.

The note quotes the full id, the path, and the line. The local rule is not this finding. A comment that suppresses only the short suffix does not document this match. The exception, if any, has to name the full id.

check id: python.lang.security.audit.example-timeout.example-timeout
path: services/api/app/health.py  line: 12
other rule ending in example-timeout: not this finding
suppression: must name the full id
not: the local rule’s function