Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[java-source-utils] Fix lgtm java/path-injection-local (#1079)
Context: e11d024 Commit e11d024 attempted to fix LGTM-reported [`java/path-injection-local`][0] warnings by using the comment `// lgtm [java/path-injection-local]`. Unfortunately, this is insufficient: the comment *also* needs to provide a 25+ character justification for why the offending statement can be ignored. This justification was not provided. Update the `// lgtm [java/path-injection-local]` comments to provide a justification, as required by tooling. Copying the longer justification from e11d024: > LGTM is complaining that `tools/java-source-utils` (69e1b80) accepts > user-controlled data. These warnings will be *ignored* because the > app is *unusable* without "user-controlled data" > … > These are all user-controlled, and they are necessary to allow > `java-source-utils` to *work*. > … > LGTM complains that `--output-javadoc FILE` accepts a user-controlled > path which may [contain] directory separator chars, and > *this is intentional*; using it would be annoying if that weren't true! See also [`JavaSourceUtils.cs`][1], which passes [a value][2] located within `$(IntermediateOutputPath)` to `java-source-utils.jar --output-javadoc`. Allowing `--output-javadoc` to contain directory separator chars is what makes this possible! [0]: https://github.com/github/codeql/blob/f192191e8c4c14d70a86342de47c8882516c7c25/java/ql/src/Security/CWE/CWE-022/TaintedPath.qhelp [1]: https://github.com/xamarin/xamarin-android/blob/b00185c485287c2c5f0350a067ebc178aec2382c/src/Xamarin.Android.Build.Tasks/Tasks/JavaSourceUtils.cs#L134-L135 [2]: https://github.com/xamarin/xamarin-android/blob/b00185c485287c2c5f0350a067ebc178aec2382c/src/Xamarin.Android.Build.Tasks/MSBuild/Xamarin/Android/Xamarin.Android.Bindings.ClassParse.targets#L69
- Loading branch information