Allow-listing False Positives

Sometimes, Soteri Scanning can flag things which are not actually of concern. Though Soteri is always working to reduce false positives, in the meantime, you can disposition these false positives in your content by using an in-line allow-list pragma. These pragmas will not hide the finding in your scanning service results, but will set the allowlisted boolean in the finding to true.

What’s required for an allowlist pragma?

An allowlisting pragma requires:

• A supported comment delimiter, such as # for Python or // for C-style comments, with a space between the rest of the comment and the comment delimiter.

• The text literal pragma: with the colon present.

• The text literal allowlist-secret or allowlist secret

• Placement on the same line as the finding. A comment on the preceding line does not allowlist it.

Optionally, one may include text after the pragma text to explain why the secret is allowlisted.

Examples of supported pragmas

• # pragma: allowlist-secret

• // pragma: allowlist-secret

• /* pragma: allowlist-secret */

• ' pragma: allowlist-secret

• <!-- pragma: allowlist-secret -->

Python allow-listing example

API_KEY = "a0b1c2d3e4f5g6h7i8j9k0lMnOpQrStUvW" # pragma: allowlist-secret

Java allow-listing example

String myApprovedSecret = "ThisIsAnExampleSecret"; // pragma: allowlist-secret not actually a secret

C++ allow-listing example

int key = theSecretCredential; /* pragma: allowlist-secret */

HTML allow-listing example

<input type='hidden' name='key' value='theSecretCredential' /> <!-- pragma: allowlist-secret -->

MySQL allow-listing example

select * from users where cred='theSecretCredential'; -- # pragma: allowlist-secret

In this example, we’re using the # approved pragma delimiter but embedding it in a single-line SQL comment delimited by --, so that this line is still functional. (Note the space between the -- and the #.)

XML example with embedded character data representing an executable MySQL command

<sometext>
    <![CDATA[
        select * from salaries where salary < theSecretCredential; -- # pragma: allowlist-secret
    ]]>
</sometext>