static-code-analysis
Here are 357 public repositories matching this topic...
Documentation for capIsNewExceptionPattern says the following:
allows any uppercase-started function names that match the specified regex pattern to be called without the new operator.
However, the actual behaviour seems to be that entire call expression is matched against the pa
infer version v0.15.0
in my case, 0xFFFF or 0xFFFFFFFF is a common initializer and there are a lot of this semantics in our code. I would like to ignore those harmless. but if I turn off liveness checker, I worry about missing some truely harmful bugs. Does Infer provide some filtering option or method?
Feature request
I found that phpstan doesn't understand psalms numeric-string type (see https://psalm.dev/docs/annotating_code/type_syntax/scalar_types/#numeric-string)
It would be nice to support it.
here is playground link
https://phpstan.org/r/9e26dfae-706f-4e3a
-
Updated
Jul 3, 2020 - Rust
discussed in checkstyle/checkstyle#7542 (comment)
we need to extend AbstractGoogleModuleTestSupport to allow load few modules from config file.
In referenced PR we need to load together for each test:
<module name="RightCurly">
<property name="id" value="RightCurlyAlone"/>
<property name="option" value="alone"/>
<property name="tokens"
https://www.php.net/uopz_delete is incorrect (one required param, not two). It was also removed in uopz 5.0
internal/reflection_completeness_check.php will help if uopz is installed.
Summary
Get URLs that have parameters, whether http or https, leak sensitive information when they capture parameters such as API-Keys, usernames, and passwords. Browser extensions, bookmarks, history, and server log files capture these, even when operating in anonymous mode. Browser providers could share the information and log files need to mask the sensitive information. Refer: https://ww
Affects PMD Version:
All.
Rule:
ImmutableField
Description:
"Identifies private fields whose values never change once object initialization ends either in the declaration of the field or by a constructor. This helps in converting existing classes to becoming immutable ones."
Immutability, by defini
Reactor support?
Reactor is starting to gain some traction so would it be possible to get something like RxNullabilityPropagator to support it?
The in-progress dev docs have a section on developer workflow: https://google.github.io/pytype/developers/index.html. We also have https://github.com/google/pytype/blob/master/CONTRIBUTING.md. They read like standalone docs with no knowledge of each other and contain different, occasionally overlapping (but at least not contradicting, I think) information. We should coordinate them in some way so
There are several issues open that suggest that it is unclear how Bandit is meant to be executed. In fact, there are no usage instructions at all in the Bandit docs.
Describe the solution you'd like
There should be simple, crisp, usage instructions in the Bandit docs, e.g.
Install Bandit:
pip install banditRun Bandit o
Is your feature request related to a problem? Please describe.
I would love it if I could just point revive to a specific configuration file, and have it automatically pick up the include and exclude directories from that configuration file. I have some directories that are used for test helpers (multiple directories) with 50+ files and it is annoying to have to pass in the --exclude fl
The docs pages for the rules should mention each rule's default.
Otherwise the only way to know is to inspect the code.
reviewdog/reviewdog#405 introduced the -tee option, but there is no mention of the feature in the readme. This would be helpful info for us who are trying to implement/debug this tool
From the docs:
If you want to count the number of results from a relationship without actually loading them you may use the withCount method, which will place a {relation}_count column on your resulting models.
We should add support for this. It should be simple check. If a property named {relation}_count is a
https://docs.docker.com/docker-for-mac/osxfs-caching/
it seems that adding :cached to the /code, config, and cached volumes and :delegated to the /tmp/cc volume may improve performance on OSX machines at least.
I wrote some of the code to do this in a branch https://github.com/python-security/pyt/compare/class_based_views, but since I'm working on other things and this feature seems cool and important I'm making this issue
Let me know if you would like any help in implementing.
Inspired by comment spotbugs/spotbugs#797 (comment) on #797
implement a new detector which finds faulty regex patterns.
The detector should find faulty regexes in standard library methods
Pattern.compile(String regex)
Pattern.compile(String regex, int flags)
String.replaceFirst(String regex, String replacement)
String.replaceAll(String regex, String re
What version of this package are you using?
"eslint-config-standard": "^14.1.0"
What operating system, Node.js, and npm version?
node.js is 10.18.0 and npm version is 6.13.4
What happened?
when i use this npm with eslint, it get something wrong to notice me the errors in the javascript file of my project.like this error:
1:1 error Definition for rule 'no-async-promise-ex
Given this code:
# foobar.html.slim
= select_tag :foobar, options_for_select([]),
data: {\
"blank-option-label" => t(\
'form.blank_option_label',
),
}when i run i18n-tasks unused i see that form.blank_option_label isn't used. When i write it like this it works:
# foobar.html.slim
= select_tag :foobar, options_for_select([]),
dataAdd copy command
I like yoda for 3 === $foo (instead of $foo === 3), but I don't like yoda for 3 === \my_method().
The main reasons for yoda is to avoid accidental assignments which can not happen on method calls.
Is it possible to either only suggest yodo for variable comparisons or to make it configurable in which cases it is suggested?
Justification
As a convenience to aid support issues, the "friendly" name of the Windows installation should be looked up from the raw version number.
Description
Currently, the RD logs OS version shows as a raw number, e.g.
Operating System: Microsoft Windows NT 6.2.9200.0 x64
Whilst this is technically correct, it's not particular
-
Updated
Dec 19, 2018 - C++
Is your feature request related to a problem? Please describe.
Want to use package like zxcvbn as part of the filtering. Motivating Golang is gosec hardcoded config check
Describe the solution you'd like
- pattern-where-python: |
import zxcvbn
zxcvbn.PasswordStrength(vars["$MYVAR"]) > 80.0
-
Updated
Jun 8, 2020 - Python
-
Updated
Jun 29, 2020 - Go
It took me a while to debug a use of HeaderMatchesChecker which wasn't working as expected, and eventually I tracked it down to this place in the code which uses Regex(). This means that the given regexp should not do any capturing.
A quick fix for this will be to just
Improve this page
Add a description, image, and links to the static-code-analysis topic page so that developers can more easily learn about it.
Add this topic to your repo
To associate your repository with the static-code-analysis topic, visit your repo's landing page and select "manage topics."
https://eslint.org/docs/rules/use-isnan
This is a proposal to modify the
use-isnanrule.Current rule setting:
Proposed rule setting:
The
switchstatement internally uses the===comparison to match the expression's value to a case clause.Therefore, it can never match _
case NaN. Also, `swit