C++: Raise cpp/tainted-format-string* precisions to high#3727
Conversation
|
Did I miss something? |
I think these queries have excellent results on lgtm.com. Many of the results come from projects that use `sprintf` like it's a templating engine, trusting that values from `argv` or `getenv` contain the correct number of `%s`. I think we want to flag that. The structure of the change note is modeled after 91af51c.
jbj
force-pushed
the
tainted-format-string-high
branch
from
562959f to
e0ba23d
Compare
jbj
changed the title
|
Thanks for flagging that. I had indeed put the wrong query id in the commit+PR title. Fixed. |
geoffw0
left a comment
geoffw0
left a comment
There was a problem hiding this comment.
I don't know why there are two queries
Likely due to either performance or accuracy tradeoffs many years ago. We have a better optimizer and much better data now - we should judge based on what we can see on LGTM now.
Speaking of which, I checked a sample of results currently on LGTM (https://lgtm.com/rules/2155960669/alerts/ and https://lgtm.com/rules/2159571090/alerts/) and all looked good to me (the global vars ones are generally harder to verify). So I'm in favour of this change.
4 participants
From the commit:
You can see the alerts on LGTM for the global-taint query and for the local-taint query.
I don't know why there are two queries, but at least it allows us to lower the precision for only one of them if it doesn't work out.