Skip to content

Potential fix for code scanning alert no. 23: Use of potentially dangerous function#328

Merged
cwlacewe merged 8 commits intodevelopfrom
alert-autofix-23
Apr 8, 2026
Merged

Potential fix for code scanning alert no. 23: Use of potentially dangerous function#328
cwlacewe merged 8 commits intodevelopfrom
alert-autofix-23

Conversation

@cwlacewe
Copy link
Copy Markdown
Contributor

@cwlacewe cwlacewe commented Apr 7, 2026

Potential fix for https://github.com/IntelLabs/vdms/security/code-scanning/23

In general, the fix is to avoid asctime and other non‑reentrant time formatting functions, and instead use thread‑safe, caller‑supplied buffers or C++ iostream formatting (for example, std::put_time) to convert struct tm to a string.

For this specific code in QueryHandlerPMGD::regular_run_autoreplicate, the simplest non‑disruptive change is:

  • Keep using std::time and std::localtime to populate a std::tm.
  • Replace oss << asctime(&tm); with oss << std::put_time(&tm, "%c"); (or another suitable format), which formats the time directly into the ostringstream without any static internal buffer.
  • Add the required include <iomanip> at the top of the file so that std::put_time is available.

This preserves the existing behavior of generating a human‑readable timestamp (still containing spaces and possibly newlines, which are then stripped by the following erase calls) while eliminating the dangerous asctime call. All other logic (sanitizing the name string, building the command, etc.) remains unchanged.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

…erous function

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 7, 2026

Target CPP Coverage: 68.113%
Source CPP Coverage: 68.105%

Target Python Coverage: 97.94%
Source Python Coverage: 97.94%

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 7, 2026

Target CPP Coverage: 68.1076%
Source CPP Coverage: 68.1076%

Target Python Coverage: 97.94%
Source Python Coverage: 97.94%

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 8, 2026

Target CPP Coverage: 68.0916%
Source CPP Coverage: 68.1156%

Target Python Coverage: 97.94%
Source Python Coverage: 97.94%

@cwlacewe cwlacewe marked this pull request as ready for review April 8, 2026 00:59
@cwlacewe cwlacewe merged commit d9167bc into develop Apr 8, 2026
@cwlacewe cwlacewe deleted the alert-autofix-23 branch April 8, 2026 01:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants