false positive: Uncontrolled data used in OS command
- Ngôn ngữ chính
- CodeQL
- Star
- 10.1k
- Fork
- 2.1k
- Merge trung bình
- 2 ngày 15 giờ
- Pull request đã merge (30 ngày)
- 141
Mô tả
Hi,
We just started using https://github.com/firehol/netdata in LGTM. Thank you!
We found that LGTM reports `cpp/command-line-injection` false positives.
Here is a screenshot:

But the code is the other way around: We use `fgets()` after we run the command, to read the output of the program we execute, like this:
https://lgtm.com/projects/g/firehol/netdata/snapshot/2a7cf3528a14cd50a69af4d75e1441a4b035d231/files/src/cgroup-network.c?#xb0514f82e375bcb6:1

Hướng dẫn đóng góp
Đánh giá
Issue này chưa được đánh giá.