Semgrep 1.174.0 accepts rules with severity: CRITICAL and reports their
findings as CRITICAL, but the --severity command-line option rejects that
value. Explicitly selecting every documented severity also excludes the
critical rule.
Reproducer
Save this rule as CriticalRule.yml:
rules:
- id: critical-test
languages: [rust]
severity: CRITICAL
message: critical test finding
pattern: dangerous()
Save this source as SeverityCriticalRepro.rs:
fn dangerous() {}
fn main() {
dangerous();
}
Reproduction commands
semgrep scan --config CriticalRule.yml SeverityCriticalRepro.rs
semgrep scan --config CriticalRule.yml \
--severity ERROR --severity WARNING --severity INFO \
SeverityCriticalRepro.rs
semgrep scan --config CriticalRule.yml \
--severity CRITICAL \
SeverityCriticalRepro.rs
Actual result
The default command reports one finding with severity CRITICAL.
The command that explicitly selects INFO, WARNING, and ERROR reports no
finding. Passing --severity CRITICAL exits with status 2:
option '--severity': invalid value 'CRITICAL', expected one of
'INFO', 'WARNING' or 'ERROR'
The result was reproduced in three independent runs.
Expected result
Every severity that can be assigned to and reported for a rule should be
selectable with --severity. Explicitly selecting all supported severities
should preserve the default finding set.
Version
Semgrep 1.174.0 accepts rules with
severity: CRITICALand reports theirfindings as
CRITICAL, but the--severitycommand-line option rejects thatvalue. Explicitly selecting every documented severity also excludes the
critical rule.
Reproducer
Save this rule as
CriticalRule.yml:Save this source as
SeverityCriticalRepro.rs:Reproduction commands
Actual result
The default command reports one finding with severity
CRITICAL.The command that explicitly selects INFO, WARNING, and ERROR reports no
finding. Passing
--severity CRITICALexits with status 2:The result was reproduced in three independent runs.
Expected result
Every severity that can be assigned to and reported for a rule should be
selectable with
--severity. Explicitly selecting all supported severitiesshould preserve the default finding set.
Version