cpp/potential-system-data-exposure: Does printing a username from getpwuid() count as potential exposure of sensitive system data?

https://github.com/ryao/zfs/security/code-scanning/824

https://github.com/ryao/zfs/blob/3881dd42bbfb7297f08e796c38b35d54e11ac500/cmd/zpool/zpool_main.c#L9431-L9431

Does telling a user his own username really count as potential exposure of sensitive information?

I guess this could be dependent on your threat model since a threat model for an IoT device is certainly different from a threat model for a standard multi-user system. However, I wonder if a username, which is public information in most threat models for C/C++ software, really should be counted as sensitive information by `cpp/potential-system-data-exposure`.

从 cpp/potential-system-data-exposure 查询以及 zpool_main.c 中第 9431 行所引用的位置开始，然后查看链接的 CodeQL 警报。确定报告 getpwuid() 返回的用户名是否是针对所述威胁模型的预期行为；完成标准是记录该决定以及对查询或测试所需的任何更改。

由索引模型根据 Issue 内容生成。