github / github/codeql

False positive: Java: Uncontrolled data used in path expression

未關閉
#15,686 1 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
false-positive Java
主要語言
CodeQL
星號
10.1k
分支
2.1k
平均合併
2 天 15 小時
30 天內合併 PR
141

描述

**Description of the false positive**

This shouldn't be included because there is an adequate guard protecting against a path traversal payload.

**Code samples or links to source code**
```java
private Path indexRootPath(final String name) {
final Path result = rootDir.resolve(name);
if (result.startsWith(rootDir)) {
return result;
}
throw new WebApplicationException(name + " attempts to escape from index root directory", Status.BAD_REQUEST);
}
```

https://github.com/apache/couchdb/blob/43ab37ba6115851297de0804c563c1f0d23bf52a/nouveau/src/main/java/org/apache/couchdb/nouveau/core/IndexManager.java#L267-L273

**URL to the alert on GitHub code scanning (optional)**

https://github.com/Wolfi-Chainguard-Demo/apache__couchdb/security/code-scanning/6

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。