github / github/codeql

General issue - suppress warnings from codepath

Offen
#3,252 2 Kommentare 3 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Java question
Vorherrschende Sprache
CodeQL
Sterne
10.1k
Forks
2.1k
Ø Merge
2 T. 15 Std.
Gemergte PRs (30 T.)
141

Beschreibung

**Description of the issue**

I have. a warning that I want to suppress as a false positive.

https://lgtm.com/projects/g/apache/druid/snapshot/ce88d8bc22c39005aa95b1fbb4c8ac6db7cd3a2d/files/indexing-service/src/main/java/org/apache/druid/indexing/common/tasklogs/FileTaskLogs.java?sort=name&dir=ASC&mode=heatmap#xe70f4b4d42e835a0:1

LGTM provides a way for me to do this where the warning is detected. However, this code is called from many endpoints, so it's possible that the warning may be valid in the future. I'd like to disable the warnings from further up in the stack.

For example, in the link above, it talks about 8 paths to get to this exploit. I'd like to mark the path as safe at the point where I sanitized the input. In my example, the path is sanitized at the entry point, which lgtm does not detect.

Is there a way for me to mark the entry point as "trusted" user input?

See #3251 for more context

Beitragsleitfaden

Beitragsleitfaden öffnen

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.