false positive: Uncontrolled data used in OS command
- Lingua principale
- CodeQL
- Stelle
- 10.1k
- Fork
- 2.1k
- Merge medio
- 2g 15h
- PR unite (30g)
- 141
Descrizione
Hi,
We just started using https://github.com/firehol/netdata in LGTM. Thank you!
We found that LGTM reports `cpp/command-line-injection` false positives.
Here is a screenshot:

But the code is the other way around: We use `fgets()` after we run the command, to read the output of the program we execute, like this:
https://lgtm.com/projects/g/firehol/netdata/snapshot/2a7cf3528a14cd50a69af4d75e1441a4b035d231/files/src/cgroup-network.c?#xb0514f82e375bcb6:1

Guida per i contributori
Apri la guida per i contributori
Valutazione
Questa issue non è ancora stata valutata.