Veracode is reporting a security issue on a piece of code which seems pretty innocuous to me. The code is built with python/Django and the line in question is:
return render(request, 'core/create-user.html', context)
The render shortcut for django is pretty standard and it expects a request object, name of template and context to be passed to template. I am not sure why Veracode is complaining for this.
It seems it is picking up the word "create-user" from the template name and assuming it be a OS/library method being called for creating a user based on some user input and which is why it is complaining but this sounds pretty dumb to me on behalf of Veracode.
Is it really a security issue, if so why? Or is it a false positive?