SonarCloud does not detect command injection problems

[Herschdorfer]

Make sure to read this post before raising a thread here:

How to Report a False-positive / False-negative

Hey SonarSource Community! False-positives happen, as do false-negatives, and we’re eager to fix them. We are thrilled when our users report problems, so we can make our products better. What is a false-positive (FP)? A false-positive is when an issue is raised unexpectedly on code that should not trigger an issue, or where the suggested action doesn’t make any sense for the code. What is a false-negative (FN)? A false-negative is when an issue should be raised on a piece of code, but isn’t…

Then tell us:

• What language is this for?
  C/CPP

• Which rule?
  unknown

• Why do you believe it’s a false-positive/false-negative?
  Command injection is a common issue. It might be trivial but is still seen from time to time.

• Are you using

  • SonarCloud

• How can we reproduce the problem? Give us a self-contained snippet of code (formatted text, no screenshots)

https://sonarcloud.io/code?id=Herschdorfer_snyk-test&selected=Herschdorfer_snyk-test%3Acommand_injection.cpp

[necto (Arseniy Zaostrovnykh)]

Hi @Herschdorfer and welcome to the community!

Indeed, Sonar C and C++ analyzer offers only a limited set of security rules. So far we have maintained our focus on the quality of the code rather than its security. Yet, as you might know, quality and security are correlated.

In particular, we have not invested in the detection of injection vulnerabilities, including the command injection.

We do have it on our radar, however. I have recorded your interest in CPP-4903.