osv-scanner
osv-scanner copied to clipboard
No warnings when `ignoreUntil` and `effectiveUntil` have typos
Great addition with [[PackageOverrides]] in the latest release :+1: But why is the way to set an expiry time on the ignore named differently? ignoreUntil != effectiveUntil. We almost merged a bunch of [[PackageOverrides]] with an ignoreUntil set... And here comes the problem: If you do this mistake, or you simply have a typo in the key name, everything looks fine, but the vulnerability ignore is forever.
[[IgnoredVulns]]
id = "GHSA-jgvc-jfgh-rjvv"
ignoreUntiI = 2024-08-02
reason = "..."
The above ignores GHSA-jgvc-jfgh-rjvv forever, which is clearly not the intention of the author here (typo is that the last letter is an I not an l).
My preference would be for osv-scanner to exit with an error on any configuration entry/key it does not recognize.