anupamme commented on PR #16390: URL: https://github.com/apache/dubbo/pull/16390#issuecomment-5030134474
Fair point, and you're right to push back. This was generated in response to a semgrep finding that flags any string passed into `ProcessBuilder` via a method call/format as a potential command-injection pattern. Moving the canonical path computation from `toString()` into the constructor doesn't change what value flows into `ProcessBuilder`, `executablePath` is still derived from `JAVA_HOME` / `findInJavaHome`, not from user input — so this doesn't actually reduce any attack surface; it just dodges the scanner's pattern match. This looks like a false positive rather than a real vulnerability. I'll mark it as such on our end rather than push a code change to satisfy the linter. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
