false positive: Uncontrolled data used in OS command

オープン

#199 2018年9月17日に作成コメント 3 件リアクション 0 件担当者 0 名 GitHub で見る

C++ false-positive

説明

Hi,

We just started using https://github.com/firehol/netdata in LGTM. Thank you!

We found that LGTM reports `cpp/command-line-injection` false positives.

Here is a screenshot:

![image](https://user-images.githubusercontent.com/2662304/45617070-e0324480-ba79-11e8-930a-b7bd9d894c95.png)

But the code is the other way around: We use `fgets()` after we run the command, to read the output of the program we execute, like this:

https://lgtm.com/projects/g/firehol/netdata/snapshot/2a7cf3528a14cd50a69af4d75e1441a4b035d231/files/src/cgroup-network.c?#xb0514f82e375bcb6:1

![image](https://user-images.githubusercontent.com/2662304/45617254-677fb800-ba7a-11e8-900a-c43c37a7ff66.png)

この issue はまだ評価されていません。