github / github/codeql

false positive: Uncontrolled data used in OS command

Aperta
#199 3 commenti 0 reazioni 0 assegnatari Vedi su GitHub
C++ false-positive
Lingua principale
CodeQL
Stelle
10.1k
Fork
2.1k
Merge medio
2g 15h
PR unite (30g)
141

Descrizione

Hi,

We just started using https://github.com/firehol/netdata in LGTM. Thank you!

We found that LGTM reports `cpp/command-line-injection` false positives.

Here is a screenshot:

![image](https://user-images.githubusercontent.com/2662304/45617070-e0324480-ba79-11e8-930a-b7bd9d894c95.png)

But the code is the other way around: We use `fgets()` after we run the command, to read the output of the program we execute, like this:

https://lgtm.com/projects/g/firehol/netdata/snapshot/2a7cf3528a14cd50a69af4d75e1441a4b035d231/files/src/cgroup-network.c?#xb0514f82e375bcb6:1

![image](https://user-images.githubusercontent.com/2662304/45617254-677fb800-ba7a-11e8-900a-c43c37a7ff66.png)

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.