General issue - suppress warnings from codepath
- 主要语言
- CodeQL
- 星标
- 10.1k
- 派生
- 2.1k
- 平均合并
- 2 天 15 小时
- 30 天内合并 PR
- 141
描述
**Description of the issue**
I have. a warning that I want to suppress as a false positive.
https://lgtm.com/projects/g/apache/druid/snapshot/ce88d8bc22c39005aa95b1fbb4c8ac6db7cd3a2d/files/indexing-service/src/main/java/org/apache/druid/indexing/common/tasklogs/FileTaskLogs.java?sort=name&dir=ASC&mode=heatmap#xe70f4b4d42e835a0:1
LGTM provides a way for me to do this where the warning is detected. However, this code is called from many endpoints, so it's possible that the warning may be valid in the future. I'd like to disable the warnings from further up in the stack.
For example, in the link above, it talks about 8 paths to get to this exploit. I'd like to mark the path as safe at the point where I sanitized the input. In my example, the path is sanitized at the entry point, which lgtm does not detect.
Is there a way for me to mark the entry point as "trusted" user input?
See #3251 for more context
贡献指南
评估
这个 Issue 还没有评估数据。