github / github/codeql

LGTM.com - false positive: not all domains are in URLs

未關閉
#3,153 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
false-positive Python
主要語言
CodeQL
星號
10.1k
分支
2.1k
平均合併
2 天 15 小時
30 天內合併 PR
141

描述

**Description of the false positive**

It says "'kopf.zalando.org/' may be at an arbitrary position in the sanitized URL."

Code snippet (a part of https://github.com/zalando-incubator/kopf/pull/331):

```python
annotations = essence.get('metadata', {}).get('annotations', {})
for annotation in list(annotations):
if annotation == LAST_SEEN_ANNOTATION:
del annotations[annotation]
elif annotation.startswith('kopf.zalando.org/'):
del annotations[annotation]
elif annotation == 'kubectl.kubernetes.io/last-applied-configuration':
del annotations[annotation]
```

Here, `kopf.zalando.org/` is NOT a URL, not is a namespace according to Kubernetes's (and not only) convention to use domains as namespaces.

**URL to the alert on the project page on LGTM.com**

* https://lgtm.com/projects/g/zalando-incubator/kopf/snapshot/4f667550c166a7746f07520c4c382ce124617eb4/files/kopf/storage/diffbase.py?sort=name&dir=ASC&mode=heatmap#x8ea36093c73ed5c5:1

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。