github / github/codeql

General issue - suppress warnings from codepath

Open
#3,252 2 comments 3 reactions 0 assignees View on GitHub
Java question
Dominant language
CodeQL
Stars
10.1k
Forks
2.1k
Avg merge
2d 15h
Merged PRs (30d)
141

Description

**Description of the issue**

I have. a warning that I want to suppress as a false positive.

https://lgtm.com/projects/g/apache/druid/snapshot/ce88d8bc22c39005aa95b1fbb4c8ac6db7cd3a2d/files/indexing-service/src/main/java/org/apache/druid/indexing/common/tasklogs/FileTaskLogs.java?sort=name&dir=ASC&mode=heatmap#xe70f4b4d42e835a0:1

LGTM provides a way for me to do this where the warning is detected. However, this code is called from many endpoints, so it's possible that the warning may be valid in the future. I'd like to disable the warnings from further up in the stack.

For example, in the link above, it talks about 8 paths to get to this exploit. I'd like to mark the path as safe at the point where I sanitized the input. In my example, the path is sanitized at the entry point, which lgtm does not detect.

Is there a way for me to mark the entry point as "trusted" user input?

See #3251 for more context

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.