During the revalidations of a project, we observed that a vulnerability reported in the first scan on one parameter is now appearing on a different parameter in a subsequent scan, even though the file has not changed for the highlighted parameter in the latest scan.
Can anyone help me understand why the first scan hasn’t detected issues across all parameters at once?
Hey @Jasmin.shaikh16, welcome to the Community!
Could you let us know a few more details:
Hi Team,
Please find my inline comments.
What rule and language is it? Powershell
Could you share a snipped of code or a screenshot? Feel free to redact any sensitive code/names. Yes, please refer to the below screenshot (refer to the line number 62 and 75, which is having same code and not detecting one of the instances)
Is this reproducible? Meaning: can you create a new project/file/function which triggers the same behavior as this other one, and scan it subsequent times to show the behavior in action? Yes, we have created a new project and trigger the scan multiple time and attached the screenshot for the reference.
Hey @Jasmin.shaikh16, thanks for sharing, just a few more things:
azurepipelines:S8263?Hi Andres,
Hey @Jasmin.shaikh16, what I meant is if you could share the code that contains the parameter for which the issue is not raised (this is what I meant by “flagged”, sorry, maybe that wasn’t a very clear term…). You shared a screenshot of it but I’m asking if you could share the full file or at least the code for that pipeline step.
Hi Andres,
I have attached the file for your reference, renamed the file to .txt the actual file extension was .yml
refer to the line number 62 and 75, which is having same code and not detecting one of the instances
Vuln_Code.txt (3.0 KB)
Thanks, I will flag this for the team. I also took the liberty to move this thread to the “false positive/false negative” category, because essentially what you’re reporting is a false negative (an issue not detected).