Diff-aware doesn't report new findings if the new finding has the same (rule_id, path, line_of_code) as the one before about semgrep-action

[Isaac0616]

Thinking it a bit more.
I think there are cases that even the Counter is not ideal.
For example:

- @web(skip_csrf_check=True)
def safe_endpoint(...):

+ @web(skip_csrf_check=True)
def sensitive_endpoint(...):

is bad but won't be flagged.
To solve it, I guess we have to check the actual changed lines between commits?

[nbrahms]

I think we'd likely solve the 90% case by just incorporating the finding index on the file into the syntactic context.

Certainly to your point @Isaac0616 , we'd like to catch your case in the future, but we also want to avoid falsely flagging on simple refactors that touch unrelated code.

One idea we've bandied about in the past is to treat the previous and next lines as part of the syntactic context, although there are still possible false negatives in this case.

Another option would just be to make whether or not to include the line number as part of the syntactic context a configurable option, so you could choose your own noise.