cockpit-328-1.fc42

List of Findings

Error: SHELLCHECK_WARNING (CWE-563): [#def1]
/usr/libexec/cockpit-certificate-helper:6:1: warning[SC2034]: prefix appears unused. Verify use (or export if used externally).
#    4|   
#    5|   # prefix= is set because the default /etc contains "${prefix}"
#    6|-> prefix="/usr"
#    7|   COCKPIT_CONFIG="/etc/cockpit"
#    8|   COCKPIT_WS_CERTS_D="${COCKPIT_CONFIG}/ws-certs.d"

Error: SHELLCHECK_WARNING (CWE-563): [#def2]
/usr/libexec/cockpit-desktop:40:1: warning[SC2034]: exec_prefix appears unused. Verify use (or export if used externally).
#   38|   
#   39|   # exec_prefix= is set because the default /usr/libexec contains "${exec_prefix}"
#   40|-> exec_prefix="/usr"
#   41|   libexecdir="/usr/libexec"
#   42|   

Error: SHELLCHECK_WARNING (CWE-563): [#def3]
/usr/libexec/cockpit-desktop:41:1: warning[SC2034]: libexecdir appears unused. Verify use (or export if used externally).
#   39|   # exec_prefix= is set because the default /usr/libexec contains "${exec_prefix}"
#   40|   exec_prefix="/usr"
#   41|-> libexecdir="/usr/libexec"
#   42|   
#   43|   # start browser in a temporary home dir, so that it does not interfere with your real one

Error: SHELLCHECK_WARNING (CWE-569): [#def4]
/usr/libexec/cockpit-desktop:123:12: warning[SC2064]: Use single quotes, otherwise this expands now rather than when signalled.
#  121|   # start the bridge; this needs to run in the normal user session/namespace
#  122|   coproc ${2:+ssh "$2"} cockpit-bridge
#  123|-> trap "kill $COPROC_PID; wait $COPROC_PID || true" EXIT INT QUIT PIPE
#  124|   
#  125|   # start ws and browser in a detached network namespace

Error: SHELLCHECK_WARNING (CWE-569): [#def5]
/usr/libexec/cockpit-desktop:123:30: warning[SC2064]: Use single quotes, otherwise this expands now rather than when signalled.
#  121|   # start the bridge; this needs to run in the normal user session/namespace
#  122|   coproc ${2:+ssh "$2"} cockpit-bridge
#  123|-> trap "kill $COPROC_PID; wait $COPROC_PID || true" EXIT INT QUIT PIPE
#  124|   
#  125|   # start ws and browser in a detached network namespace

Error: GCC_ANALYZER_WARNING (CWE-775): [#def6]
cockpit-328-build/cockpit-328/src/common/cockpitpipe.c: scope_hint: In function ‘spawn_setup’
cockpit-328-build/cockpit-328/src/common/cockpitpipe.c:1279:1: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘r’
/usr/lib64/glib-2.0/include/glibconfig.h:9: included_from: Included from here.
/usr/include/glib-2.0/glib/gtypes.h:34: included_from: Included from here.
/usr/include/glib-2.0/glib/galloca.h:34: included_from: Included from here.
/usr/include/glib-2.0/glib.h:32: included_from: Included from here.
/usr/include/glib-2.0/gobject/gbinding.h:30: included_from: Included from here.
/usr/include/glib-2.0/glib-object.h:24: included_from: Included from here.
/usr/include/glib-2.0/gio/gioenums.h:30: included_from: Included from here.
/usr/include/glib-2.0/gio/giotypes.h:30: included_from: Included from here.
/usr/include/glib-2.0/gio/gio.h:28: included_from: Included from here.
cockpit-328-build/cockpit-328/src/common/cockpitpipe.h:23: included_from: Included from here.
cockpit-328-build/cockpit-328/src/common/cockpitpipe.c:22: included_from: Included from here.
/usr/include/glib-2.0/glib/gmacros.h:1249:31: note: in expansion of macro ‘_G_BOOLEAN_EXPR_IMPL’
/usr/include/glib-2.0/glib/gmacros.h:1250:43: note: in expansion of macro ‘_G_BOOLEAN_EXPR’
/usr/include/glib-2.0/glib/gtestutils.h:276:49: note: in expansion of macro ‘G_LIKELY’
cockpit-328-build/cockpit-328/src/common/cockpitpipe.c:1277:5: note: in expansion of macro ‘g_assert’
# 1277|       g_assert (r == 2); /* that should really never fail */
# 1278|     }
# 1279|-> }
# 1280|   
# 1281|   /**

Error: GCC_ANALYZER_WARNING (CWE-688): [#def7]
cockpit-328-build/cockpit-328/src/common/cockpitwebresponse.c: scope_hint: In function ‘find_extension’
cockpit-328-build/cockpit-328/src/common/cockpitwebresponse.c:1598:9: warning[-Wanalyzer-null-argument]: use of NULL ‘path’ where non-null expected
/usr/include/glib-2.0/glib/gstring.h:37: included_from: Included from here.
/usr/include/glib-2.0/glib/giochannel.h:36: included_from: Included from here.
/usr/include/glib-2.0/glib.h:56: included_from: Included from here.
/usr/include/glib-2.0/gobject/gbinding.h:30: included_from: Included from here.
/usr/include/glib-2.0/glib-object.h:24: included_from: Included from here.
/usr/include/glib-2.0/gio/gioenums.h:30: included_from: Included from here.
/usr/include/glib-2.0/gio/giotypes.h:30: included_from: Included from here.
/usr/include/glib-2.0/gio/gio.h:28: included_from: Included from here.
cockpit-328-build/cockpit-328/src/common/cockpitwebresponse.h:23: included_from: Included from here.
cockpit-328-build/cockpit-328/src/common/cockpitwebresponse.c:28: included_from: Included from here.
cockpit-328-build/cockpit-328/src/common/cockpitwebresponse.c:1692:14: note: in expansion of macro ‘g_strdup’
/usr/lib64/glib-2.0/include/glibconfig.h:9: included_from: Included from here.
/usr/include/glib-2.0/glib/gtypes.h:34: included_from: Included from here.
/usr/include/glib-2.0/glib/galloca.h:34: included_from: Included from here.
/usr/include/glib-2.0/glib.h:32: included_from: Included from here.
/usr/include/glib-2.0/glib/gmacros.h:1365:7: note: in expansion of macro ‘_GLIB_AUTOPTR_CLEAR_FUNC_NAME’
/usr/include/glib-2.0/glib/gmacros.h:1381:3: note: in expansion of macro ‘_GLIB_DEFINE_AUTOPTR_CLEANUP_FUNCS’
/usr/include/glib-2.0/glib/glib-autocleanups.h:69:1: note: in expansion of macro ‘G_DEFINE_AUTOPTR_CLEANUP_FUNC’
/usr/include/glib-2.0/glib/gmacros.h:1381:3: note: in expansion of macro ‘_GLIB_DEFINE_AUTOPTR_CLEANUP_FUNCS’
/usr/include/glib-2.0/glib/glib-autocleanups.h:69:1: note: in expansion of macro ‘G_DEFINE_AUTOPTR_CLEANUP_FUNC’
/usr/include/glib-2.0/glib/gmacros.h:1381:3: note: in expansion of macro ‘_GLIB_DEFINE_AUTOPTR_CLEANUP_FUNCS’
/usr/include/glib-2.0/glib/glib-autocleanups.h:69:1: note: in expansion of macro ‘G_DEFINE_AUTOPTR_CLEANUP_FUNC’
cockpit-328-build/cockpit-328/src/common/cockpitwebresponse.c: scope_hint: In function ‘find_extension’
/usr/include/glib-2.0/glib/galloca.h:35: included_from: Included from here.
/usr/include/string.h:273:14: note: argument 1 of ‘strrchr’ must be non-null
# 1596|     const gchar *slash;
# 1597|   
# 1598|->   dot = strrchr (path, '.');
# 1599|     slash = strrchr (path, '/');
# 1600|   

Error: GCC_ANALYZER_WARNING (CWE-688): [#def8]
cockpit-328-build/cockpit-328/src/common/cockpitwebserver.c:817:18: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
cockpit-328-build/cockpit-328/src/common/cockpitwebserver.c:810:33: note: in expansion of macro ‘g_strdup’
cockpit-328-build/cockpit-328/src/common/cockpitwebserver.c: scope_hint: In function ‘cockpit_web_request_process’
<built-in>: note: argument 1 of ‘__builtin_strchr’ must be non-null
#  815|     self->host = host;
#  816|   
#  817|->   gchar *query = strchr (path_copy, '?');
#  818|     if (query)
#  819|       {

Error: GCC_ANALYZER_WARNING (CWE-688): [#def9]
cockpit-328-build/cockpit-328/src/common/cockpitwebserver.c: scope_hint: In function ‘cockpit_web_request_process’
cockpit-328-build/cockpit-328/src/common/cockpitwebserver.c:817:18: warning[-Wanalyzer-null-argument]: use of NULL ‘*self.original_path’ where non-null expected
/usr/include/glib-2.0/glib.h:52: included_from: Included from here.
/usr/include/glib-2.0/gobject/gbinding.h:30: included_from: Included from here.
/usr/include/glib-2.0/glib-object.h:24: included_from: Included from here.
/usr/include/glib-2.0/gio/gioenums.h:30: included_from: Included from here.
/usr/include/glib-2.0/gio/giotypes.h:30: included_from: Included from here.
/usr/include/glib-2.0/gio/gio.h:28: included_from: Included from here.
cockpit-328-build/cockpit-328/src/common/cockpitwebserver.h:23: included_from: Included from here.
cockpit-328-build/cockpit-328/src/common/cockpitwebserver.c:22: included_from: Included from here.
cockpit-328-build/cockpit-328/src/common/cockpitwebserver.c:926:8: note: in expansion of macro ‘g_str_equal’
/usr/include/glib-2.0/glib/gstring.h:37: included_from: Included from here.
/usr/include/glib-2.0/glib/giochannel.h:36: included_from: Included from here.
/usr/include/glib-2.0/glib.h:56: included_from: Included from here.
cockpit-328-build/cockpit-328/src/common/cockpitwebserver.c:810:33: note: in expansion of macro ‘g_strdup’
cockpit-328-build/cockpit-328/src/common/cockpitwebserver.c: scope_hint: In function ‘cockpit_web_request_process’
<built-in>: note: argument 1 of ‘__builtin_strchr’ must be non-null
#  815|     self->host = host;
#  816|   
#  817|->   gchar *query = strchr (path_copy, '?');
#  818|     if (query)
#  819|       {

Error: GCC_ANALYZER_WARNING (CWE-775): [#def10]
cockpit-328-build/cockpit-328/src/session/session-utils.c: scope_hint: In function ‘scan_btmp’
cockpit-328-build/cockpit-328/src/session/session-utils.c:351:6: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘open("/var/log/btmp", 524288)’
cockpit-328-build/cockpit-328/src/session/session-utils.h:24: included_from: Included from here.
cockpit-328-build/cockpit-328/src/session/session-utils.c:22: included_from: Included from here.
#  349|   
#  350|   out:
#  351|->   if (fd > -1)
#  352|       close (fd);
#  353|   

Error: GCC_ANALYZER_WARNING (CWE-775): [#def11]
cockpit-328-build/cockpit-328/src/session/session-utils.c: scope_hint: In function ‘fd_remap’
cockpit-328-build/cockpit-328/src/session/session-utils.c:537:10: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘dup2(*<unknown>,  i)’
#  535|     for (int i = 0; i < n_remap_fds; i++)
#  536|       if (fds[i] != -1) /* no-op */
#  537|->       if (dup2 (fds[i], i) != i)
#  538|           abort_with_message ("dup2(%d, %d) failed: %m", fds[i], i);
#  539|   

Error: GCC_ANALYZER_WARNING (CWE-775): [#def12]
cockpit-328-build/cockpit-328/src/tls/server.c: scope_hint: In function ‘server_init’
cockpit-328-build/cockpit-328/src/tls/server.c:243:9: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘server.first_listener’
cockpit-328-build/cockpit-328/src/tls/server.c:24: included_from: Included from here.
#  241|           err (EXIT_FAILURE, "failed to bind to port %hu", port);
#  242|         if (listen (server.first_listener, 1024) < 0)
#  243|->         err (EXIT_FAILURE, "failed to listen to server port");
#  244|         debug (SERVER, "Server ready. Listening on port %hu, fd %i", port, server.first_listener);
#  245|       }

Error: GCC_ANALYZER_WARNING (CWE-775): [#def13]
cockpit-328-build/cockpit-328/src/tls/server.c:248:20: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘server.first_listener’
#  246|   
#  247|     /* epoll the listening fds */
#  248|->   server.epollfd = epoll_create1 (EPOLL_CLOEXEC);
#  249|     if (server.epollfd < 0)
#  250|       err (EXIT_FAILURE, "Failed to create epoll fd");

Error: GCC_ANALYZER_WARNING (CWE-775): [#def14]
cockpit-328-build/cockpit-328/src/ws/cockpitauth.c: scope_hint: In function ‘session_child_setup’
cockpit-328-build/cockpit-328/src/ws/cockpitauth.c:462:6: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘dup2(*(ChildData *)data.io, 0)’
#  460|     ChildData *child = data;
#  461|   
#  462|->   if (dup2 (child->io, 0) < 0 || dup2 (child->io, 1) < 0)
#  463|       {
#  464|         g_printerr ("couldn't set child stdin/stout file descriptors\n");

Error: GCC_ANALYZER_WARNING (CWE-775): [#def15]
cockpit-328-build/cockpit-328/src/ws/cockpitauth.c:462:31: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘dup2(*(ChildData *)data.io, 1)’
#  460|     ChildData *child = data;
#  461|   
#  462|->   if (dup2 (child->io, 0) < 0 || dup2 (child->io, 1) < 0)
#  463|       {
#  464|         g_printerr ("couldn't set child stdin/stout file descriptors\n");

Scan Properties