Our website uses cookies to enhance your browsing experience.
Contents
The Go, JavaScript, and TypeScript analyzers, as well as the PVS-Studio plugins for Visual Studio Code, WebStorm, and GoLand, use a TOML file to store the configuration file. The configuration can be stored at either the user level or the project level. The configuration is described using TOML v1.1.0.
Configuration files can be used implicitly or explicitly passed to tools using a special flag.
Here is a path to the user-level configuration file:
%APPDATA%/PVS-Studio LLC/PVS-Studio/pvs-settings.toml.$XDG_CONFIG_HOME/PVS-Studio LLC/PVS-Studio/pvs-settings.toml.Note. On Linux and macOS, if the XDG_CONFIG_HOME environment variable is unset, the configuration file will be located at ~/.config/PVS-Studio LLC/PVS-Studio/pvs-settings.toml by default.
Settings from the configuration file are applied automatically when the analysis starts.
The minimal analysis configuration file may look like this:
version = 1
[analyzers.all]
analysis-paths = [ "skip-analysis=*/tests/*" ]
rules = [ "ALL=on" ]
[analyzers.javascript]
analysis-paths.append = [ "skip-analysis=*/third-party/*" ]
rules.override = [ "ALL=off", "OWASP=on" ]In this example, all analyzers have:
*/tests/* excluded from analysis;*/third-party/* excluded from analysis (for the JS/TS analyzer);Configuration files allow creating hierarchies of settings. More specific settings override more general ones. The configuration hierarchy, from general to specific, is as follows:
The user-level configuration file is located at the following path:
%APPDATA%/PVS-Studio LLC/PVS-Studio/pvs-settings.toml. $XDG_CONFIG_HOME/PVS-Studio LLC/PVS-Studio/pvs-settings.toml. Note. On Linux and macOS, if the XDG_CONFIG_HOME environment variable is unset, the configuration file will be located at ~/.config/PVS-Studio LLC/PVS-Studio/pvs-settings.toml by default.
The configuration file is located in the project's root directory:
project/
├── src/
├── tests/
├── README.md
└── pvs-settings.tomlConfigurations can be passed directly via the analyzer's CLI. In this case, they will take precedence and override the settings in the configuration files:
pvs-js analyze --analysis-paths skip-analysis=*/test/* \
--rules ALL=off \
--rules GA=on \
/path/to/projectThe settings within the configuration file are divided into three types: general settings, plugin settings ([plugins]), and analyzer settings ([analyzers]).
Plugin and analyzer settings are divided into general settings ([plugins.all] and [analyzers.all]) and specific settings.
The following settings are considered specific:
[analyzers.javascript][analyzers.golang][plugins.VSCode][plugins.WebStorm][plugins.GoLand]The example of a user-level file structure:
# Common settings
version = 1
[analyzers.all]
# Common settings for all analyzers
rules = [ "ALL=off", "OWASP=on" ]
[analyzers.golang]
# Settings specific to the Go analyzer
rules.append = [ "GA=on" ]
[analyzers.javascript]
# Settings specific to the JavaScript/TypeScript analyzer
analysis-paths.override = [ "skip-analysis=*/third-party/*" ]
[plugins.VSCode]
# Settings specific to the Visual Studio Code plugin
show-false-alarms = true
show-best-warnings-button = false
[plugins.WebStorm]
# Settings specific to the WebStorm plugin
show-false-alarms = false
show-best-warnings-button = true
[plugins.GoLand]
# Settings specific to the GoLand plugin
show-false-alarms = false
show-best-warnings-button = trueExample of a project-level file structure:
# Common settings
version = 1
# Convert relative paths via the 'src' directory,
# which is located in the same directory as the project settings file
working-directory = 'src'
# Ignore user settings for the project
ignore-user-settings = true
[analyzers.all]
# Common settings for all analyzers
# Disable all rules, then enable the GA and OWASP groups
rules.override = [ "ALL=off", "GA=on", "OWASP=on" ]
# Exclude the 'src/third-party' directory from the analysis
analysis-paths = [ "skip-analysis=third-party" ]
[analyzers.golang]
# Settings specific to the Go analyzer
# Additionally, disable V8018 (for the Go analyzer)
# All other rules from the GA and OWASP groups are active
rules.append = [ "V8018=off" ]
[analyzers.javascript]
# Settings specific to the JavaScript and TypeScript analyzer
# Additionally, disable V7008 (for the JavaScript/TypeScript analyzer)
# All other rules from the GA and OWASP groups are active
rules.append = [ "V7008=off" ]The user-level configuration requires that each setting that represents the path should be specified as an absolute path (starting from the / root directory).
A path can also be represented as an absolute glob pattern (starting with the / root directory or a wildcard character (* or ?)).
The project-level configuration requires that each setting that represents the path should be specified as a relative path or any glob pattern. It ensures the portability of the configuration file across machines.
For some array-type configuration, it is important to keep the order of passed values. For example, if first enable general-purpose diagnostic rules in the rules field and then disable all rules, none of the diagnostic rules will be enabled.
rules = ["GA=on", "ALL=off"]Starting with specific user-level configuration, all array-type settings become tables with two possible values:
override completely overrides the lower-level settingsappend adds new values to the default settings.Example. The user-level configuration file specifies the files to be excluded from analysis by all analyzers. For the JavaScript and TypeScript analyzers, these files and one additional path are excluded from analysis. For the Go analyzer, on the contrary, these paths are included in the analysis, while other paths are excluded.
In this case, the configuration file will look like this:
version = 1
[analyzers.all]
analysis-paths = [
"skip-analysis=*/excluded/path/*",
"skip-analysis=*/one/more/*",
]
[analyzers.javascript]
analysis-paths.append = [
"skip-analysis=*/additional/path*"
]
[analyzers.golang]
analysis-paths.override = [
"skip-analysis=*/only/this/path/*"
]It defines the configuration file format.
This setting is required.
It accepts the integer value 1.
It allows specifying a different working directory, from which relative paths will be converted to absolute paths. Available only at the project-level configuration.
This settings accepts a string containing a relative path. The current directory symbol . and the parent directory symbol .. are supported.
The default value: ".".
It allows ignoring the user-level configuration and apply only the settings specified at the project level. Available only at the project-level configuration.
The default value: false.
It sets the number of analysis thread.
It accepts values of the integer type.
If the value 0 is specified, the analyzer will distribute the analysis across all available logical cores. If this setting is omitted, the analyzer will automatically select the optimal number of analysis threads.
The example:
[analyzers.all]
analysis-threads = 8It defines the behavior of diagnostic rules.
It is a non-empty array of strings in the following format:
Group=on|off: to configure diagnostic rule groups;Vxxxx=on|off: to configure individual diagnostic rules;Vxxxx-Vyyyy=on|off: to configure the range of diagnostic rules. The value of xxxx must be less than yyyy.There are groups available for configuration:
ALL: all diagnostic rules;GA: general-purpose diagnostic rules;OWASP: diagnostic rules that look for deviations from OWASP ASVS.The example:
[analyzers.javascript]
rules.override = [
"ALL=off",
"GA=off",
"V7001-V7005=on",
"V7008=on"
]With the specified configuration, the analyzers implicitly add the general-purpose rule group ("GA=on") to the top of the list.
Default value: [ "ALL=off", "GA=on" ].
It defines the behavior of warnings regarding issues with the analyzer's operation.
It is a non-empty array of strings in the following format:
ALL=on|off: to configure the entire group;Vxxx=on|off: to configure individual warnings;Vxxx-Vyyy=on|off: to configure warning ranges. The value of xxx must be less than yyy.The example:
[analyzers.javascript]
fails.override = [
"ALL=off",
"V071-V072=on",
"V074=on"
]With this setting, the analyzers implicitly add the option to enable all problem warnings ("ALL=on") to the top of the list.
The default value: [ "ALL=on" ].
It defines the analyzer's behavior on the specified path.
It is a non-empty array of strings in the following format:
analyze=path|glob: enables analysis at the specified value;skip-analysis=path|glob: disables analysis at the specified value.The example:
[analyzers.javascript]
analysis-paths.override = [
"skip-analysis=*/excluded/path/*",
"analyze=/path/to/project/excluded/path/file.js"
]With this setting, the analyzers implicitly add an entry at the beginning of the list to include all files in the analysis ("analyze=*").
The default value: [ "analyze=*" ].
Analyzers can replace user-specified path prefixes with the sequence |?| (source tree root). This makes it possible to generate analysis reports that can be transferred between machines.
The configuration consists of a table with the following keys:
path: uses the specified path (as a string) as the source tree root;use-project-directory: uses the parent directory of the project configuration file as the source tree root. It accepts values of the boolean type. The default value: false.The source-tree-root.path and source-tree-root.use-project-directory settings can be specified at the same time. If both settings are provided, the last specified setting takes precedence when selecting the path prefix to replace.
The example:
[analyzers.javascript]
source-tree-root = { path = "/path/to/projects/js",
use-project-directory = true }
[analyzers.golang]
source-tree-root.path = "/path/to/projects/golang"
source-tree-root.use-project-directory = falseIt specifies the time limit after which the analysis of a single file is stopped. It accepts strings in the XXhYYmZZs format.
The example:
[analyzers.javascript]
file-analysis-timeout = "1h10m15s"The default value: "10m".
It allows you to disable the generation of low-confidence warnings and accepts values of the boolean type.
The default value: false.
It enables adding SEC tags to the sastId field in the analyzer report and accepts values of the boolean type.
The default value: false.
It specifies the paths to the analyzer's suppression files. Learn more.
Available only at the project-level configuration.
It is a non-empty array of strings containing file paths.
Example:
[analyzers.all]
suppress-files = [ "./suppress_base.suppress.json" ]It allows saving temporary files after analysis and accepts values of the boolean type.
Default value: false.
It is a configuration for the JavaScript analyzer. This settings specifies the path to Node.js, which will be used to run the TypeScript server.
It accepts a string.
The default value: node.
It controls the display of the Best Warnings button, which shows the top 10 warnings from the analyzer report.
It accepts values of the boolean type.
Available only in the user-level settings.
The default value: true.
It determines whether warnings marked as false positives are displayed.
It accepts values of the boolean type.
Available only in the user-level settings.
The default value: false.
It allows the plugin to save changes to the file after inserting a False Alarm marker into a line.
It accepts values of the boolean type.
Available only in the user-level settings.
The default value: true.
Was this page helpful?
