github / github/codeql

False positive: This expression has no effect (because _function with multiple implementations_ has no external side effects [in incorrectly selected version]).

未關閉
#20,684 5 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
C++ false-positive
主要語言
CodeQL
星號
10.1k
分支
2.1k
平均合併
2 天 15 小時
30 天內合併 PR
141

描述

**Description of the false positive**

https://github.com/PowerDNS/pdns/pull/16363#discussion_r2455671092

> This expression has no effect (because sendUDPResponse has no external side effects).

codeql appears to have found https://github.com/PowerDNS/pdns/blob/dec9583d885713a0d0ecb55a74ef83cde5f8a235/pdns/dnsdistdist/test-dnsdist_cc.cc#L83 (which is indeed side effect free) instead of https://github.com/PowerDNS/pdns/blob/dec9583d885713a0d0ecb55a74ef83cde5f8a235/pdns/dnsdistdist/dnsdist.cc#L637 (which shouldn't be)

**Code samples or links to source code**

https://github.com/pieterlexis/pdns/blob/064c4c9f2ea60c59d4b0c1a95daad4e17cbe2ce4/pdns/dnsdistdist/dnsdist-udp.cc#L131

https://github.com/PowerDNS/pdns/blob/dec9583d885713a0d0ecb55a74ef83cde5f8a235/pdns/dnsdistdist/test-dnsdist_cc.cc#L83
https://github.com/PowerDNS/pdns/blob/dec9583d885713a0d0ecb55a74ef83cde5f8a235/pdns/dnsdistdist/dnsdist.cc#L637

**URL to the alert on GitHub code scanning (optional)**

I don't have access to this, but I'll see if I can get someone to provide it.

貢獻指南

開啟貢獻指南

研究方向

Start by comparing the linked call in pdns/dnsdistdist/dnsdist-udp.cc with the implementations in test-dnsdist_cc.cc and dnsdist.cc. Review the related CodeQL alert and the linked discussion to determine why the incorrect implementation is selected. Done means the cited false positive is resolved for the reported call and verified against those source locations.

由索引模型根據 Issue 內容生成。

評估

技術堆疊
cpp
領域
security
Issue 類型
缺陷
難度
4/5
預估耗時
3-5 天
活躍度
停滯
描述清晰度
需要釐清
新手友好度
35/100

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。