Synopsis

(Required) The validity of values received from external sources shall be checked.

Enabled by default

Yes

Severity/Certainty

Medium/Medium

Full description

User input is used as a value in the environment.

Coding standards

Code examples

The following code example fails the check and will give a warning:

#include <stdlib.h>

void example(void) {
  char *a = getenv("FOO");
  putenv(a);
}

The following code example passes the check and will not give a warning about this issue:

#include <stdlib.h>

void example(void) {
  char *a = getenv("FOO");
  a = "BAR";
  putenv(a);
}