False positive - when json.Marshal output is used - cant result in "Potentially unsafe quoting"
Đang mở
acknowledged
false-positive
Go
- Ngôn ngữ chính
- CodeQL
- Star
- 10.1k
- Fork
- 2.1k
- Merge trung bình
- 2 ngày 15 giờ
- Pull request đã merge (30 ngày)
- 141
Mô tả
**Description of the false positive**
An output of golang json.Marshal is apparently not at risk for `unsafe quoting`
**Code samples or links to source code**
```
...
learned, errMarshal := json.Marshal(guardianSpec.Learned)
...
str := fmt.Sprintf(`[{"op":"replace","path":"/spec/learned","value":%s},{"op":"replace","path":"/spec/samples","value":%d}]`, learned, guardianSpec.NumSamples)
...
```
**URL to the alert on GitHub code scanning (optional)**
https://github.com/knative-extensions/security-guard/pull/236
Hướng dẫn đóng góp
Đánh giá
Issue này chưa được đánh giá.