'access' false positive

[marzojr]

CodeFactor is incorrectly diagnosing code as using access POSIX function when it is actually not:

Use of access() (CWE-362, CWE-367)             lines of code = 1
			if (flag.access() == FlagData::GETFLAG)

source

In this line of code, member function access of the class is being used, but CodeFactor is incorrectly misidentifying this as being POSIX syscall access.

The expectation would be to not get a warning in this case, as this is a clear false-positive and a waste of triage time.

[marzojr]

For what is worth, I just noticed that it even flags the declaration of a function called access as being in violation of those CVEs -- see this.

[cordis-dev]

@marzojr thanks for reporting. We've now disabled access() security rule until there's a fix for false positives.