Ignore snyk code quality issue with .snyk file

Question

Snyk finds some code quality issue that should be ignored. I'm using Snyk CLI: "snyk code test"

 ✗ [High] Server-Side Request Forgery (SSRF) 
   Path: project/src/main/java/com/MyClass.java, line 140 
   Info: Unsanitized input from an HTTP parameter flows into org.apache.http.client.methods.HttpPost, where it is used as an URL to perform a request. This may result in a Server-Side Request Forgery vulnerability.

That's example.

I know to ignore something I need to put this in .snyk file. I had trouble doing that so I've put 4 times same thing:

ignore:
  'java/Ssrf':
    - '*':
        reason: None Given
        expires: 2023-02-17T14:43:55.203Z
        created: 2023-01-18T14:43:55.205Z
  'CWE-918':
    - '*':
        reason: None Given
        expires: 2023-02-17T14:43:55.203Z
        created: 2023-01-18T14:43:55.205Z
  java/Ssrf:
    - '*':
        reason: None Given
        expires: 2023-02-17T14:43:55.203Z
        created: 2023-01-18T14:43:55.205Z
  CWE-918:
    - '*':
        reason: None Given
        expires: 2023-02-17T14:43:55.203Z
        created: 2023-01-18T14:43:55.205Z

But it still throws that problem.
I've added to 'snyk code test' --policy-path=.snyk - no help.
I've tried to use in the id 'Server-Side Request Forgery (SSRF)' <- no success.
All I see is ingoring dependency vulnerabilites in documentation. Is it possible to use that for code check?

I got CWE-918 and 'java/Ssrf' by calling that test to json:

          "rules": [
            {
              "id": "java/Ssrf",
              "name": "Ssrf",
              "shortDescription": {
                "text": "Server-Side Request Forgery (SSRF)"
              },
              "defaultConfiguration": {
                "level": "error"
              },
                "precision": "very-high",
                "repoDatasetSize": 233,
                "cwe": [
                  "CWE-918"
                ]
              }

Is it anyhow possible to do that?

Answer 1

At the moment, the .snyk file can only be used to exclude files and folders completely. Please see the documentation at https://docs.snyk.io/scan-application-code/snyk-code/cli-for-snyk-code/excluding-directories-and-files-from-the-snyk-code-cli-test.