veracode error CWE-454: external initialization

Question

I receive this error from the following c code.

if (system("clear") == -1)
{
   fprintf(stderr, "system() failed");
}

Answer 1

Don't use system(). If caller of your program can manipulate the search path for command then any command named clear can be executed instead of the one you intended. Implement the feature in C instead:

#include <stdio.h>

void clear() {
   // Move cursor to top-left corner and clear the erase entire screen
   fputs("\e[;1H\e[2J", stdout);
}