[
https://issues.apache.org/jira/browse/CXF-8449?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17315749#comment-17315749
]
Alan Mehio commented on CXF-8449:
---------------------------------
It seems the codeQL and LGTM site is using the same query. The security error
which exist at LGTM for
[AttachmentUtil.java|https://lgtm.com/projects/g/apache/cxf/alerts/?mode=list&result_filter=0e00f5fa7b93849767c1677dc71d9400f85c6a54]
is the same one which broke the build for my
[PR|https://github.com/apache/cxf/pull/768]
When the AttachmentUtil got refactored, the codeQL gave the same error as the
one on LGTM.
Also the [forked repository
|https://github.com/alanmehio/cxf/security/code-scanning]has the list of error.
from this
[https://github.com/apache/cxf/blob/master/.github/workflows/codeql-analysis.yml|https://github.com/apache/cxf/blob/master/.github/workflows/codeql-analysis.yml#]
The codeQL schedule scanning is disabled
In summary, the CodeQL is disturbing
> CodeQL errors on LGTM.com has a list of 38 including security errors
> ----------------------------------------------------------------------
>
> Key: CXF-8449
> URL: https://issues.apache.org/jira/browse/CXF-8449
> Project: CXF
> Issue Type: Bug
> Reporter: Alan Mehio
> Priority: Minor
>
> The CXF project has been scanned continuously by [CodeQL
> |https://lgtm.com/projects/g/apache/cxf/alerts/?mode=list&result_filter=0e00f5fa7b93849767c1677dc71d9400f85c6a54]
> These errors comes up if somebody makes PR and does change to one of
> affected java classes or file.
> It would be nice to try to sort the issue otherwise it is disturbing to the
> community.
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
