fix(engine): allow excluding OpenAPI queries by their override (version-specific) IDs by cx-ori-bendet · Pull Request #7977 · Checkmarx/kics

cx-ori-bendet · 2026-02-28T22:59:00Z

Summary

OpenAPI queries have version-specific variants defined via an "override" field in metadata.json (e.g. a Swagger 2.0 variant with a different ID than the OpenAPI 3.0 primary query)
These variant IDs are what get reported in scan results when scanning a Swagger 2.0 file, but checkQueryExclude only compared against the top-level metadata["id"]
Passing an override ID to --exclude-queries had no effect, making it impossible to suppress findings for those queries
Fix: extend checkQueryExclude to also iterate through metadata["override"] and check each version variant's "id" against the ByIDs exclusion list

Example — for a query with this metadata:

{
  "id": "e3f026e8-fdb4-4d5a-bcfd-bd94452073fe",
  "override": {
    "2.0": { "id": "6e96ed39-bf45-4089-99ba-f1fe7cf6966f" }
  }
}

Both e3f026e8-... and 6e96ed39-... can now be used with --exclude-queries.

Fixes #7574

Test plan

Scan a swagger.json file that triggers one of the affected queries (e.g. 6e96ed39-bf45-4089-99ba-f1fe7cf6966f)
Run with --exclude-queries 6e96ed39-bf45-4089-99ba-f1fe7cf6966f and verify the query is excluded from results
Run with the primary ID e3f026e8-fdb4-4d5a-bcfd-bd94452073fe — should still be excluded (existing behaviour preserved)
Run go test ./pkg/engine/source/... to verify existing tests pass

I submit this contribution under the Apache-2.0 license.

🤖 Generated with Claude Code

…on-specific) IDs OpenAPI queries define version-specific variants via an "override" field in metadata.json (e.g. a Swagger 2.0 variant of an OpenAPI 3.0 query). These variants have their own IDs which are reported in scan results, but checkQueryExclude only checked the primary metadata "id", so passing an override ID to --exclude-queries had no effect. Extend checkQueryExclude to also iterate the "override" map and check each variant's "id" against the ByIDs exclusion list. Fixes #7574 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>