[Enhancement]: Allow file exclusion rules

[cx-andre-cardoso]

Contact Details

andre.cardoso@checkmarx.com

What problem does this solve?

As you can see in the image, the extension is detecting code issues in native packages (/usr/local/go/src/...) and also dependency code (~/go/pkg/mod/...).

Proposed Solution

My suggestion comes in two ways:

1. Allow the user to customize in the settings which paths to exclude from scanning/results
   Example:

{
  "files.exclude": {
      "**/.git": true,
      "**/.svn": true,
      "**/.hg": true,
      "**/.DS_Store": true,
      "**/Thumbs.db": true
  },
  // maybe with this syntax? or something similar
  //"checkmarxOne.scanExclude" {},
}

2. Set per language exclusion defaults. In this case (golang) exclude /usr/local/go/src/* and other common paths for go src code (maybe using GOROOT env var) $GOROOT/src/*
3. In case the user WANTS the native package scanning we can have explicit inclusions as well:

  // maybe with this syntax? or something similar
  //"checkmarxOne.scanInclude" {},

Importance Level

Critical

Additional Information

I mark this enhancement as critical because in a debug session this issues tend to clutter the problems tab and cause actual issues to go unnoticed

[github-actions]

Internal Jira issue: AST-121555