github / github/codeql

General issue - suppress warnings from codepath

未關閉
#3,252 2 則留言 3 個 reaction 已指派 0 人 在 GitHub 檢視
Java question
主要語言
CodeQL
星號
10.1k
分支
2.1k
平均合併
2 天 15 小時
30 天內合併 PR
141

描述

**Description of the issue**

I have. a warning that I want to suppress as a false positive.

https://lgtm.com/projects/g/apache/druid/snapshot/ce88d8bc22c39005aa95b1fbb4c8ac6db7cd3a2d/files/indexing-service/src/main/java/org/apache/druid/indexing/common/tasklogs/FileTaskLogs.java?sort=name&dir=ASC&mode=heatmap#xe70f4b4d42e835a0:1

LGTM provides a way for me to do this where the warning is detected. However, this code is called from many endpoints, so it's possible that the warning may be valid in the future. I'd like to disable the warnings from further up in the stack.

For example, in the link above, it talks about 8 paths to get to this exploit. I'd like to mark the path as safe at the point where I sanitized the input. In my example, the path is sanitized at the entry point, which lgtm does not detect.

Is there a way for me to mark the entry point as "trusted" user input?

See #3251 for more context

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。