github / github/codeql

LGTM.com - false positive: not all domains are in URLs

Ouverte
#3,153 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub
false-positive Python
Langage dominant
CodeQL
Étoiles
10.1k
Forks
2.1k
Merge moyen
2 j 15 h
PR mergées (30 j)
141

Description

**Description of the false positive**

It says "'kopf.zalando.org/' may be at an arbitrary position in the sanitized URL."

Code snippet (a part of https://github.com/zalando-incubator/kopf/pull/331):

```python
annotations = essence.get('metadata', {}).get('annotations', {})
for annotation in list(annotations):
if annotation == LAST_SEEN_ANNOTATION:
del annotations[annotation]
elif annotation.startswith('kopf.zalando.org/'):
del annotations[annotation]
elif annotation == 'kubectl.kubernetes.io/last-applied-configuration':
del annotations[annotation]
```

Here, `kopf.zalando.org/` is NOT a URL, not is a namespace according to Kubernetes's (and not only) convention to use domains as namespaces.

**URL to the alert on the project page on LGTM.com**

* https://lgtm.com/projects/g/zalando-incubator/kopf/snapshot/4f667550c166a7746f07520c4c382ce124617eb4/files/kopf/storage/diffbase.py?sort=name&dir=ASC&mode=heatmap#x8ea36093c73ed5c5:1

Guide de contribution

Ouvrir le guide de contribution

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.