Summary
A suppression entry with a newline character in its reason field passes ash config validate with no warning, but breaks rendering in the generated ash.summary.md and ash.unused-suppressions.md reports (the reason is placed into a markdown table cell, which doesn't allow embedded newlines).
Reproduction
- Add a suppression with a multi-line reason to
.ash/.ash.yaml:
global_settings:
suppressions:
- path: "src/foo.py"
rule_id: "B201"
reason: |
Multi-line reason
with a newline.
- Run
ash config validate → reports ✅ Configuration is valid!
- Run a scan and inspect
.ash/ash_output/reports/ash.summary.md — the suppression row in the table is broken / split across lines.
Expected
ash config validate (and/or ash config lint) should emit a warning when a suppression reason contains a newline, since this is reliably a downstream rendering hazard. Auto-fix could collapse newlines to spaces.
Notes
- The
AshSuppression model in automated_security_helper/models/core.py declares reason: str (inherited from IgnorePathWithReason) with no content validation.
ConfigValidator.validate_config_file in automated_security_helper/config/config_validator.py only validates structural concerns (top-level fields, internal-only fields, path patterns) and does not inspect suppression reason content.
- Suggested fix location: add a check in
ConfigLinter._check_suppression_issues (automated_security_helper/config/config_linter.py) emitting a WARNING (e.g. a new SUPPRESSION_REASON category), and consider an auto-fix that replaces \n with a single space.
Summary
A suppression entry with a newline character in its
reasonfield passesash config validatewith no warning, but breaks rendering in the generatedash.summary.mdandash.unused-suppressions.mdreports (the reason is placed into a markdown table cell, which doesn't allow embedded newlines).Reproduction
.ash/.ash.yaml:ash config validate→ reports✅ Configuration is valid!.ash/ash_output/reports/ash.summary.md— the suppression row in the table is broken / split across lines.Expected
ash config validate(and/orash config lint) should emit a warning when a suppressionreasoncontains a newline, since this is reliably a downstream rendering hazard. Auto-fix could collapse newlines to spaces.Notes
AshSuppressionmodel inautomated_security_helper/models/core.pydeclaresreason: str(inherited fromIgnorePathWithReason) with no content validation.ConfigValidator.validate_config_fileinautomated_security_helper/config/config_validator.pyonly validates structural concerns (top-level fields, internal-only fields, path patterns) and does not inspect suppressionreasoncontent.ConfigLinter._check_suppression_issues(automated_security_helper/config/config_linter.py) emitting aWARNING(e.g. a newSUPPRESSION_REASONcategory), and consider an auto-fix that replaces\nwith a single space.