github / github/codeql

false positive: Uncontrolled data used in OS command

Ouverte
#199 3 commentaires 0 réactions 0 personnes assignées Voir sur GitHub
C++ false-positive
Langage dominant
CodeQL
Étoiles
10.1k
Forks
2.1k
Merge moyen
2 j 15 h
PR mergées (30 j)
141

Description

Hi,

We just started using https://github.com/firehol/netdata in LGTM. Thank you!

We found that LGTM reports `cpp/command-line-injection` false positives.

Here is a screenshot:

![image](https://user-images.githubusercontent.com/2662304/45617070-e0324480-ba79-11e8-930a-b7bd9d894c95.png)

But the code is the other way around: We use `fgets()` after we run the command, to read the output of the program we execute, like this:

https://lgtm.com/projects/g/firehol/netdata/snapshot/2a7cf3528a14cd50a69af4d75e1441a4b035d231/files/src/cgroup-network.c?#xb0514f82e375bcb6:1

![image](https://user-images.githubusercontent.com/2662304/45617254-677fb800-ba7a-11e8-900a-c43c37a7ff66.png)

Guide de contribution

Ouvrir le guide de contribution

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.