After looking into an injection code scanning alert, you notice that the input is properly sanitized with custom logic. Which of the following is the next step?

Question

Options

• ADismiss the alert with the reason "false positive."
• BIgnore the alert.
• COpen an issue in the CodeQL repository.
• DDraft a pull request to update the open source query.

• A
  73% (40)
• B
  16% (9)
• C
  7% (4)
• D
  4% (2)

Explanation

Dismissing alerts There are two ways of closing an alert. You can fix the problem in the code, or you can dismiss Dismissing an alert is a way of closing an alert that you don't think needs to be fixed. For example, an error in code that's used only for testing, or when the effort of fixing the error is greater than the potential benefit of improving the code. You can dismiss alerts from code scanning annotations in code, or from the summary list within the Security tab. If you dismiss a CodeQL alert as a false positive result, for example because the code uses a sanitization library that isn't supported, consider contributing to the CodeQL repository and improving the analysis.

No community discussion yet for this question.