False positive: Branch creation treated as a checkout

[johnbillion]

I'm getting an error for a shell command in a run step that creates a new branch during a deployment process:

git checkout -b "release-${VERSION}"

The error is:

Use of "git checkout" in a bash script with a potentially dangerous reference.

What are your thoughts? Is there cause for concern when creating a branch with a potentially user-controlled name?

[johnbillion]

This could potentially be dangerous because it creates a branch from another user-controlled ref:

git checkout -b "release-${VERSION}" "${ANOTHER_REF}"

[hugo-syn]

I think it's a false positive here, the tool search for something that is not a character like $, I don't think it's exploitable in your case