false positive: Uncontrolled data used in OS command
- Dominant language
- CodeQL
- Stars
- 10.1k
- Forks
- 2.1k
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 141
Description
Hi,
We just started using https://github.com/firehol/netdata in LGTM. Thank you!
We found that LGTM reports `cpp/command-line-injection` false positives.
Here is a screenshot:

But the code is the other way around: We use `fgets()` after we run the command, to read the output of the program we execute, like this:
https://lgtm.com/projects/g/firehol/netdata/snapshot/2a7cf3528a14cd50a69af4d75e1441a4b035d231/files/src/cgroup-network.c?#xb0514f82e375bcb6:1

Contributor guide
Assessment
This issue has not been assessed yet.