github / github/codeql

LGTM.com - false positive: not all domains are in URLs

未关闭
#3,153 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
false-positive Python
主要语言
CodeQL
星标
10.1k
派生
2.1k
平均合并
2 天 15 小时
30 天内合并 PR
141

描述

**Description of the false positive**

It says "'kopf.zalando.org/' may be at an arbitrary position in the sanitized URL."

Code snippet (a part of https://github.com/zalando-incubator/kopf/pull/331):

```python
annotations = essence.get('metadata', {}).get('annotations', {})
for annotation in list(annotations):
if annotation == LAST_SEEN_ANNOTATION:
del annotations[annotation]
elif annotation.startswith('kopf.zalando.org/'):
del annotations[annotation]
elif annotation == 'kubectl.kubernetes.io/last-applied-configuration':
del annotations[annotation]
```

Here, `kopf.zalando.org/` is NOT a URL, not is a namespace according to Kubernetes's (and not only) convention to use domains as namespaces.

**URL to the alert on the project page on LGTM.com**

* https://lgtm.com/projects/g/zalando-incubator/kopf/snapshot/4f667550c166a7746f07520c4c382ce124617eb4/files/kopf/storage/diffbase.py?sort=name&dir=ASC&mode=heatmap#x8ea36093c73ed5c5:1

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。