Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
The test teardown constructs a shell command using string concatenation and executes it with system(), which is unsafe because shell execution expands metacharacters and trusts the composed command string. Although testDir_ is derived from getpid() in this example and appears low-risk in normal use, invoking rm -rf through a shell is a dangerous pattern that can become destructive if the path is influenced, malformed, or unexpectedly empty.
- Content
text void TearDown() override { // 测试后清理 std::string cmd = "rm -rf " + testDir_; system(cmd.c_str()); }