Comment Re:Caveat... (Score 1) 59
I have seen the same thing with every tool that scans code for security problems. Inevitably it raises a potential issue but in practice it can't be exploited because there are barriers at the edges where user input comes into the system that stop the exploit, which is the entire point of parsing all user input and limiting what it can do. These reports aren't coming with an active exploit of the system, they are theoretical problem and are leaving all the work to the project to figure out if its real or not. Its potential CVE slop.