Skip to content

--severity cannot select CRITICAL rules #11881

Description

@chisa22

Semgrep 1.174.0 accepts rules with severity: CRITICAL and reports their
findings as CRITICAL, but the --severity command-line option rejects that
value. Explicitly selecting every documented severity also excludes the
critical rule.

Reproducer

Save this rule as CriticalRule.yml:

rules:
  - id: critical-test
    languages: [rust]
    severity: CRITICAL
    message: critical test finding
    pattern: dangerous()

Save this source as SeverityCriticalRepro.rs:

fn dangerous() {}

fn main() {
    dangerous();
}

Reproduction commands

semgrep scan --config CriticalRule.yml SeverityCriticalRepro.rs

semgrep scan --config CriticalRule.yml \
  --severity ERROR --severity WARNING --severity INFO \
  SeverityCriticalRepro.rs

semgrep scan --config CriticalRule.yml \
  --severity CRITICAL \
  SeverityCriticalRepro.rs

Actual result

The default command reports one finding with severity CRITICAL.

The command that explicitly selects INFO, WARNING, and ERROR reports no
finding. Passing --severity CRITICAL exits with status 2:

option '--severity': invalid value 'CRITICAL', expected one of
'INFO', 'WARNING' or 'ERROR'

The result was reproduced in three independent runs.

Expected result

Every severity that can be assigned to and reported for a rule should be
selectable with --severity. Explicitly selecting all supported severities
should preserve the default finding set.

Version

Semgrep 1.174.0

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions