false positive: Uncontrolled data used in OS command
- Vorherrschende Sprache
- CodeQL
- Sterne
- 10.1k
- Forks
- 2.1k
- Ø Merge
- 2 T. 15 Std.
- Gemergte PRs (30 T.)
- 141
Beschreibung
Hi,
We just started using https://github.com/firehol/netdata in LGTM. Thank you!
We found that LGTM reports `cpp/command-line-injection` false positives.
Here is a screenshot:

But the code is the other way around: We use `fgets()` after we run the command, to read the output of the program we execute, like this:
https://lgtm.com/projects/g/firehol/netdata/snapshot/2a7cf3528a14cd50a69af4d75e1441a4b035d231/files/src/cgroup-network.c?#xb0514f82e375bcb6:1

Beitragsleitfaden
Bewertung
Dieses Issue wurde noch nicht bewertet.