false positive: Uncontrolled data used in OS command

未關閉

#199 建立於 2018年9月17日 3 則留言 0 個 reaction 已指派 0 人在 GitHub 檢視

C++ false-positive

描述

Hi,

We just started using https://github.com/firehol/netdata in LGTM. Thank you!

We found that LGTM reports `cpp/command-line-injection` false positives.

Here is a screenshot:

![image](https://user-images.githubusercontent.com/2662304/45617070-e0324480-ba79-11e8-930a-b7bd9d894c95.png)

But the code is the other way around: We use `fgets()` after we run the command, to read the output of the program we execute, like this:

https://lgtm.com/projects/g/firehol/netdata/snapshot/2a7cf3528a14cd50a69af4d75e1441a4b035d231/files/src/cgroup-network.c?#xb0514f82e375bcb6:1

![image](https://user-images.githubusercontent.com/2662304/45617254-677fb800-ba7a-11e8-900a-c43c37a7ff66.png)

這個 Issue 還沒有評估資料。