**Description of the false positive** <!-- Please explain briefly why you think it shouldn't be included. --> **Code samples or links to source code** <!-- For open source code: file links with line numbers on GitHub, for example: https://github.com/github/codeql/blob/dc440aaee6695deb0d9676b87e06ea984e1b4ae5/javascript/ql/test/query-tests/Security/CWE-078/CommandInjection/exec-sh2.js#L10 For closed source code: (redacted) code samples that illustrate the problem, for example: ``` function execSh(command, options) { return cp.spawn(getShell(), ["-c", command], options) // <- command line injection }; ``` --> **URL to the alert on GitHub code scanning (optional)** <!-- 1. Open the project on GitHub.com. 2. Switch to the `Security` tab. 3. Browse to the alert that you would like to report. 4. Copy and paste the page URL here. -->
Description of the false positive
Code samples or links to source code
URL to the alert on GitHub code scanning (optional)