Merge branch 'improve_sast' into 'master'

Improve a bit our SAST

See merge request OpenMW/openmw!1876

.gitlab-ci.yml

@@ -15,7 +15,7 @@ variables:
   ARTIFACT_COMPRESSION_LEVEL: "fast"
   CACHE_COMPRESSION_LEVEL: "fast"
   SAST_EXCLUDED_ANALYZERS: "bandit"
-  SAST_EXCLUDED_PATHS: spec,test,tests,tmp,extern
+  SAST_EXCLUDED_PATHS: "extern"
 
 .Ubuntu_Image:
   tags:

.gitlab/sast-ruleset.toml

@@ -69,3 +69,8 @@
 		[flawfinder.ruleset.identifier]
 			type = "flawfinder_func_name"
 			value = "printf"  # only false positives, sigh
+	[[flawfinder.ruleset]]
+		disable = true
+		[flawfinder.ruleset.identifier]
+			type = "flawfinder_func_name"
+			value = "system"  # only false positives, sigh