Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security: Check Github's Code scanning warnings #1428

Open
hoffie opened this issue Apr 2, 2021 · 2 comments
Open

Security: Check Github's Code scanning warnings #1428

hoffie opened this issue Apr 2, 2021 · 2 comments
Labels
bug Something isn't working

Comments

@hoffie
Copy link
Member

hoffie commented Apr 2, 2021

Describe the bug
https://github.com/jamulussoftware/jamulus/security/code-scanning is non-empty

To Reproduce

Expected behavior

Clear out false positives, fix any genuine issues.

Screenshots

Additional context
I think most of them might be non-issues. Some are found in the bundled libopus.

cc @pljones as you asked whether this is tracked somewhere. Now it is. :)
cc @softins As one of your recent PRs is related to a specific instance of those warnings.

@hoffie hoffie added the bug Something isn't working label Apr 2, 2021
@softins
Copy link
Member

softins commented Apr 2, 2021

Most of these are in array indices, where we are multiplying ints, but the default type for an array index is size_type, which is long. With the size of data that Jamulus deals with, a 32-bit int is more than plenty, and casting the first item in the expression to static_cast<long> in every affected location would just make the code verbose and less readable.

I would favour finding a way to switch off this particular CodeQL warning for the Jamulus repo.

@hoffie
Copy link
Member Author

hoffie commented Apr 2, 2021

Looks like we can "Dismiss" these alerts at the above URL. I've just done that for everything in libs/ (opus and oboe). You can choose a reason. I chose WONTFIX (as we don't maintain these ourselves). Unless those alerts re-appear at some point, I'd say that this is the best way to solve them?

I don't feel confident about judging about the others myself, but I guess @softins does? :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
Status: Triage
Development

No branches or pull requests

2 participants