github / github/codeql

General issue - suppress warnings from codepath

Đang mở
#3,252 2 bình luận 3 reaction 0 người được giao Xem trên GitHub
Java question
Ngôn ngữ chính
CodeQL
Star
10.1k
Fork
2.1k
Merge trung bình
2 ngày 15 giờ
Pull request đã merge (30 ngày)
141

Mô tả

**Description of the issue**

I have. a warning that I want to suppress as a false positive.

https://lgtm.com/projects/g/apache/druid/snapshot/ce88d8bc22c39005aa95b1fbb4c8ac6db7cd3a2d/files/indexing-service/src/main/java/org/apache/druid/indexing/common/tasklogs/FileTaskLogs.java?sort=name&dir=ASC&mode=heatmap#xe70f4b4d42e835a0:1

LGTM provides a way for me to do this where the warning is detected. However, this code is called from many endpoints, so it's possible that the warning may be valid in the future. I'd like to disable the warnings from further up in the stack.

For example, in the link above, it talks about 8 paths to get to this exploit. I'd like to mark the path as safe at the point where I sanitized the input. In my example, the path is sanitized at the entry point, which lgtm does not detect.

Is there a way for me to mark the entry point as "trusted" user input?

See #3251 for more context

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.