|
|
|
# 4.0.241016 (October 2024)
|
|
|
|
|
|
|
|
## Major
|
|
|
|
|
|
|
|
* Added initial JavaScript analysis support.
|
|
|
|
* Added initial Visual Basic .NET analysis support.
|
|
|
|
* Updated supported languages versions:
|
|
|
|
* Java **21**.
|
|
|
|
* Go **1.23**.
|
|
|
|
* Kotlin **2.0**.
|
|
|
|
* Python **3.12**.
|
|
|
|
* JavaScript **ES6**.
|
|
|
|
* Visual Basic .NET **16.9**.
|
|
|
|
|
|
|
|
## General
|
|
|
|
|
|
|
|
* Added support for `NOLINTNEXTLINE` comment suppression.
|
|
|
|
* Fixed results generation in SARIF format to properly have single primary location for each warning.
|
|
|
|
* Added filtering by CWE type to `svace warning` tool.
|
|
|
|
* Option `SVRES_RELATIVE_PATHS` enables using relative (from the project root) instead of absolute paths in the svres analysis results file.
|
|
|
|
* Added "compilation module" identifier to the svres analysis results file and data about compilation module to provide additional information about where the warning has been found.
|
|
|
|
|
|
|
|
## Build
|
|
|
|
|
|
|
|
* [sup #828] Added ability to use `--` to separate `svace build` options and the build command.
|
|
|
|
* Fixed fails during interception of `dummy-tools/ld` in Linux kernel builds.
|
|
|
|
* Fixed escaped newline treatment for MSVC.
|
|
|
|
* Now Svace uses heap size from the original compiler JVM during Java compiler interception. This reduces number of out of memory build issues, where Svace used smaller heap size.
|
|
|
|
* [sup #868] Fixed nondeterministic crashes of `go build` under interception.
|
|
|
|
* [sup #1001] Fixed a bug with `GOFLAGS` environment variable processing during `go build` interception.
|
|
|
|
* Supported parameters `-tags`, `-mod`, `-modfile`, `-buildmode` of `go list` during interception.
|
|
|
|
* Reduced memory and file descriptor consumption during interception of C# projects build.
|
|
|
|
|
|
|
|
## Analysis
|
|
|
|
|
|
|
|
* Supported analysis with cache for Python.
|
|
|
|
* Taint analysis now propagates taint flags for casts between types.
|
|
|
|
* Added checking for invalid characters in the project name supplied as the `svace analyze --name` option argument.
|
|
|
|
* [sup #992] Removed limit for number of analyzed switch cases.
|
|
|
|
* [sup #741] Made analysis of function return values more stable. Previously in specific cases it was assumed that return value can be arbitrary (so it doesn't depend on the caller context).
|
|
|
|
* [sup #799] Support floating point variables in formulas for the SMT solver. As a result fixed common cause of false `DIVISION_BY_ZERO.EX.FLOAT` reports.
|
|
|
|
|
|
|
|
## Remote analysis
|
|
|
|
|
|
|
|
* Hidden server error stack trace from the server output. It is now written to a file in the `logs` folder.
|
|
|
|
* Added checks on the client side that the client has the same version as the server and that the project folder has been created using the same version too.
|
|
|
|
* Added checking of `svace remote analyze` command arguments on the client side.
|
|
|
|
* Added a `svace remote version` subcommand which prints the version of the remote server.
|
|
|
|
* Implemented command `svace server reboot` which requests a restart of the remote server. After such command the server accepts new analysis tasks but doesn't start them, waits while all currently running tasks have finished and restarts afterwards. When it comes online again the delayed tasks are processed.
|
|
|
|
* Added a `svace server admin cleanup-remote` command for cleaning up intermediate data on the remote analysis server.
|
|
|
|
|
|
|
|
## Checkers
|
|
|
|
|
|
|
|
* Warning type `DEREF_AFTER_NULL.COND` is disabled by default due to low reliability.
|
|
|
|
* Warning type `BUFFER_OVERFLOW.LOOP` was enabled by default.
|
|
|
|
* Fixed false positives for `UNUSED_VALUE.PARAM_ASSIGN`.
|
|
|
|
* Checker `DEREF_OF_NULL.RET.STAT` is adapted for Java, Kotlin, Go.
|
|
|
|
* [sup #720] Improved message for `UNUSED_VALUE`.
|
|
|
|
* [sup #333] Fixed statistics generation for `UNCHECKED_FUNC_RES.STAT` checker by taking function definition into account to distinguish functions with the same name.
|
|
|
|
* [sup #912] Fixed false `OVERFLOW_UNDER_CHECK` reports, related to nested loops.
|
|
|
|
* [sup #936] Fixed false `DYNAMIC_OVERFLOW` reports for cases, where index value has bounds checking.
|
|
|
|
* [sup #965] Fixed false positive for `DIVISION_BY_ZERO.UNDER_CHECK` related to loop and unsigned values.
|
|
|
|
* Fixed false reports of `DEREF_OF_NULL.COND` and other null derefernce checkers for cases, where dereference happens conditionally in a function call.
|
|
|
|
* [sup #714] Fixed false positives for `NEGATIVE_CODE_ERROR.EX` and `TAINTED_INT`, caused by string concatenation.
|
|
|
|
* Removed excessive logging from example checkers.
|
|
|
|
* Fixed false positive `BAD_COPY_PASTE` reports for cases, where translator couldn't identify symbol.
|
|
|
|
* New checker `REDUNDANT_COMPARISON.MAP` for finding redundant code, related to maps.
|
|
|
|
* Fixed false negative for dereference checkers, for situations when a pointer is dereferenced in a function call on some path, but all other paths are unreachable due to call context.
|
|
|
|
* [sup #426] Fixed false `DEREF_AFTER_NULL` reports, related to asserts with complex conditions.
|
|
|
|
|
|
|
|
## C/C++
|
|
|
|
|
|
|
|
* Added suppression of specific warning reports in a single C/C++ source file, which is compiled for multiple target architectures, if such reports are generated for only some of those architectures. Such reports are usually seen as useless since the issues result from general code patterns having no effect on some architectures. Configuration option `SUPPRESS_TARGET_SPECIFIC_WARNINGS` allows to enable such behavior.
|
|
|
|
* [sup #893] Added ability to analyze only part of the project based on information about linking. The `ANALYZE_SUB_PROJECT_WITH_SOURCE_NAMES` and `ANALYZE_SUB_PROJECT_WITH_PATHS` configuration options can be used to enable this feature. They allow to analyze whole code of only those executables which were linked with the object files, created from the explicitly listed source files (using the former option) or from the source files, contained in explicitly listed subfolders (using the latter option). These options can be combined.
|
|
|
|
* Now specifications are applied to static functions too.
|
|
|
|
* [sup #776] Fixed occasional incorrect file positions in defect messages.
|
|
|
|
* Shortened occasional very long messages containing code snippets.
|
|
|
|
* [sup #955] Added information that result of `dynamic_cast` is `null` if argument is `null`.
|
|
|
|
* [sup #975] Added information that if result of `dynamic_cast` is not `null` then the argument is also not `null`.
|
|
|
|
* [sup #884] Improved traces for buffer overflow checkers. Definition locations for global arrays were added.
|
|
|
|
* [sup #317] Started to use file names instead of paths in names of anonymous structures, unions and enumerations to better match warning reports.
|
|
|
|
* New checker `MEMSET_TO_NON_TRIVIALLY_COPYABLE` for detecting copying of objects with non trivially copyable types using a `memset` function.
|
|
|
|
* [sup #593] Implemented new `POINTER_ZERO_COMPARISON` checker for detection of comparisons of pointers with a zero integer constant instead of `NULL`.
|
|
|
|
* [sup #834] Created subtype `DEREF_OF_NULL.RET.LIB.MINOR` for results of `localtime` and similar functions, which are commonly used in safe contexts where no `NULL` pointer can be returned.
|
|
|
|
* Obsolete C/C++ checkers `MISSING_ENCRYPTION` and `INFORMATION_EXPOSURE` were removed. Previously reported by these checkers issues are now reported by a more general `SENSITIVE_LEAK` checker.
|
|
|
|
* [sup #951] Removed `UNINIT_HEAP.ASSIGN_OP` checker due to bad quality.
|
|
|
|
* [sup #950] Removed part of `UNINIT_HEAP.CCTOR` functionality that caused a lot of false positives and adjusted its parameters (Severity: _Major -\> Minor_, Reliability: _Unknown -\> Average_)
|
|
|
|
* Fixed processing of enumerations in structure fields. This led to increased number of `UNREACHABLE_CODE.ENUM` reports and removed false positive `DEREF_OF_NULL.EX` and `UNINIT.LOCAL_VAR` reports, related to enumerations.
|
|
|
|
* [sup #835] Extended specification for OpenSSL `PKCS12_parse`: it inits memory, pointed to by its arguments.
|
|
|
|
* [sup #799] Extended STL `istream` specifications to mark read floating-point values as tainted.
|
|
|
|
* [sup #946] Fixed false positive `DEREF_AFTER_NULL.EX` reports, related to member pointers.
|
|
|
|
* [sup #860] Fixed false positive `TAINTED_INT.MIGHT` on project iputils.
|
|
|
|
* Fixed false positive `ADDR_OF_LOCAL_ESCAPES_SCOPE` reports, related to range-based `for` loop.
|
|
|
|
* [sup #952] Fixed template-related false positives for `SIMILAR_BRANCHES`.
|
|
|
|
* [sup #939] Fixed template-related false positives for `NO_EFFECT`.
|
|
|
|
* [sup #903] Suppressed `SIGN_EXTENSION` reports when a widened expression is not stored in a larger lvalue.
|
|
|
|
* [sup #435] Fixed an issue with `INVARIANT_RESULT` report message.
|
|
|
|
* [sup #87] Extracted subtype `VARIABLE_IS_NOT_ARRAY.VA_ARG` for functions with variable arguments number.
|
|
|
|
* [sup #974] Fixed false positives for `VARIABLE_IS_NOT_ARRAY`.
|
|
|
|
* [sup #680][sup #838] Fixed multiple causes of false `BUFFER_OVERLAP` reports.
|
|
|
|
* Improved message for `DEREF_OF_NULL.RET.LIB` reports. Now it doesn't contain references to a `memcpy` function call, generated by the compiler for composite assignments.
|
|
|
|
* [sup #909] Clarified message for `UNINIT.LIB` warning type reports.
|
|
|
|
* [sup #969] Expanded `MEMORY_LEAK` reports traces with additional location, where a variable, holding an allocated memory address, is reassigned.
|
|
|
|
* Fixed false positive for `USER.BAD_PRIVILEGE`: If neither `O_CREAT` nor `O_TMPFILE` is specified in `flags`, then `mode` is ignored (and can thus be specified as `0`, or simply omitted).
|
|
|
|
* [sup #941] Fixed false `INVARIANT_RESULT` reports, related to `static_assert`.
|
|
|
|
* Improved messages for `SIZEOF_POINTER_TYPE` to better describe issues.
|
|
|
|
* [sup #119] Improved quality of `MISSING_COPY_CTOR_ASSIGN_OP` checker.
|
|
|
|
* Fixed certain false `UNSPECIFIED_CHAR_IN_COND` reports.
|
|
|
|
* Improved handling of more sophisticated templates in `BAD_ITERATOR.INVALID` checker.
|
|
|
|
* Fixed calculation of buffer size in messages for `BUFFER_OVERFLOW.SPRINTF` warning type reports.
|
|
|
|
* Fixed false `DOUBLE_OPEN` reports, when between two opens the path variable is changed.
|
|
|
|
* Fixed false `INT_OVERFLOW` reports, related to big unsigned variables.
|
|
|
|
* [sup #829] Fixed false `DEREF_OF_NULL.ASSIGN` reports, related to unreachable code.
|
|
|
|
* Checker `LONG_TIME_IN_LOCK` now works for wrappers for sleep functions too.
|
|
|
|
* Fix false `NONTERMINATED_STRING` reports, where `strlen` result is compared with the buffer size.
|
|
|
|
* [sup #830] Fixed false `DIVISION_BY_ZERO.UNDER_CHECK` reports for cases, when the zero comparison is in a macro. Additionally improved interprocedural trace.
|
|
|
|
* Added new trace with the tainted value source and path for `TAINTED.SPRINTF` reports.
|
|
|
|
* Fixed false `BUFFER_OVERFLOW.SPRINTF` reports, related to two dimensional arrays.
|
|
|
|
|
|
|
|
## Java/Kotlin
|
|
|
|
|
|
|
|
* [sup #882] Java 21 is supported.
|
|
|
|
* Now analysis engine considers unknown exceptions as unchecked. As a result many false reports, related to exceptions, have been fixed.
|
|
|
|
* Added information that `ArrayIndexOutOfBoundsException`, `IndexOutOfBoundsException` and `StringIndexOutOfBoundsException` are `RuntimeException`s.
|
|
|
|
* Implemented devirtualization of bridge method calls.
|
|
|
|
* New checker `BITWISE_INSTEAD_OF_LOGICAL` for situations when a bitwise and/or operator is used for operands of boolean type.
|
|
|
|
* New checker `COLLECTION.THIS_ARG` for detecting situations when method of a collection is called with itself as an argument, potentially leading to unexpected behavior.
|
|
|
|
* New checker `COLLECTION.WRONG_ARG_TYPE` (enabled by default) for situations when a collection method is invoked with an argument of a type which is not a subtype of the items in the collection, which may lead to unexpected results.
|
|
|
|
* New checker `COLLECTION.MODIFICATION_DURING_ITERATION` for modification of a collection during iteration over it.
|
|
|
|
* [sup #753] New checker `TAINTED_PTR.SSRF` for finding SSRF vulnerabilities.
|
|
|
|
* [sup #760] Implemented new checker `TAINTED_PTR.COOKIE` for finding cookie spoofing.
|
|
|
|
* New checkers for working with records `RECORD.NO_EQUALS` for Java and `DATA_CLASS.NO_EQUALS` for Kotlin.
|
|
|
|
* New checker `UNSAFE_ARRAY_CAST` for casting of `java.util.Collection::toArray` call result to other array type, causing `ClassCastException`.
|
|
|
|
* Extended checker `COMPARE_RESULT_OF_NEW` to Java/Kotlin too.
|
|
|
|
* New checkers for working with regular expressions: `REGEX.BAD_FLAGS`, `REGEX.CONFUSING_ALTERNATIVE_PRECEDENCE`, `REGEX.EMPTY_GROUP`, `REGEX.GRAPHEME_CLUSTER_IN_CHAR_CLASS`, `REGEX.MULTIPLE_SPACES`, `REGEX.REDUNDANT_ALTERNATIVE`, `REGEX.REDUNDANT_CHAR_CLASS`, `REGEX.REDUNDANT_GROUP`, `REGEX.REPETITION_IN_CHAR_CLASS`, `REGEX.SINGLE_ALTERNATIVE`, `REGEX.UNBALANCED_PARENS`, `REGEX.UNESCAPED_SPEC_CHARS`, `REGEX.WRONG_ANCHORS`, `REGEX.WRONG_QUANTIFIER`.
|
|
|
|
* New checkers for test frameworks: `TEST.COMPETING_ANNOTATIONS`, `TEST.CONTEXT_AFTER_ASSERTION`, `TEST.FAIL_IN_CATCH`, `TEST.INCOMPLETE_ASSERTION`, `TEST.INCORRECT_MODIFIERS`, `TEST.MULTIPLE_EXCEPTIONAL_CALLS`, `TEST.SIMPLIFICATION`, `TEST.SWAPPED_ACTUAL_EXPECTED`, `TEST.UNREACHABLE_ASSERTION`.
|
|
|
|
* Fixed false positives for `FORMAT_STRING.PARAM_LACK`.
|
|
|
|
* Stopped emitting `REDUNDANT_COMPARISON` for results of abstract classes methods calls. Such methods may be overloaded by children classes.
|
|
|
|
* Improved detection of stub methods.
|
|
|
|
* Fixed emitting false `TAINTED_PTR` reports for `java.io.File` and `java.net.URL` constructors. Instead tainted status is transferred further and an issue is reported only if respective object is used in an incorrect context (e.g., for opening files).
|
|
|
|
* [sup #730] Fixed absence of source code navigation data in projects that use Lombok and similar annotation processors.
|
|
|
|
* Fixed resolving of static methods inherited from base classes.
|
|
|
|
* Fixed false `DIVISION_BY_ZERO.FLOAT` reports, related to using `Float.isNaN` and `Double.isNaN` functions.
|
|
|
|
* Fixed false positives for `SENSITIVE_LEAK`, related to `static final` fields and `boolean` fields.
|
|
|
|
* Fixed emitting `FB.UCF_USELESS_CONTROL_FLOW`.
|
|
|
|
* Fixed incorrect suppression of warnings whose traces lead to JAR files with sources or binaries.
|
|
|
|
* Fixed code generation for kotlin-value classes. As a result multiple false positive reports of null-dereference checkers were removed.
|
|
|
|
* Prevented propagation of synthetic parameters of inline functions with default parameters. This fixed exceptions during analysis.
|
|
|
|
* Improved naming for objects not explicitly present in the source code (e.g. temporary variables).
|
|
|
|
* Fixed false positive `UNREACHABLE_CODE.EXCEPTION` reports, related to method stubs.
|
|
|
|
* Improved message for `HANDLE_LEAK`. Made it easier to understand which function call is the handle source and where the handle is stored.
|
|
|
|
* [sup #717] Fixed return interval for function `Random.nextInt` with a `bound` parameter.
|
|
|
|
* Fixed false `NO_LOCK.STAT.EX` reports, which were related to imported static constants.
|
|
|
|
* [sup #751] Added specifications for standard `java.util.Base64.Decoder` and `java.util.Base64.Encoder` classes.
|
|
|
|
* [sup #751] Added constructors of `ByteArrayInputStream`, `CharArrayReader`, `DataInputStream`, `StringBufferInputStream`, `StringReader` to the sinks list for `TAINTED_PTR` checker.
|
|
|
|
* Added specification for `java.sql.DriverManager.getConnection()`. Now it is a source of tainted data.
|
|
|
|
* [sup #1002] Fixed specification of standard `java.net.URL` class constructor to allow `null` arguments other than `spec`.
|
|
|
|
* Improved checker `NO_LOCK.GUARD`: Added trace with lock, improved message, supported annotation `@GuardedBy`.
|
|
|
|
* Suppressed false positive `WRONG_LOCK.STATIC` reports, related to singletons.
|
|
|
|
* [sup #738] Now result of conversion from a string to an integer is not tainted if the string is constant (it means that it's not controlled by a user).
|
|
|
|
* Improved text and traces for checkers `DEREF_OF_NULL.EX`, `DEREF_OF_NULL.ANNOT.EX`, `DEREF_OF_NULL.ASSIGN` and `DEREF_OF_NULL.ANNOT.ASSIGN`. Created new text pattern for cases, where `null` value is stored in a temporary variable without name.
|
|
|
|
* Improved message for `DIVISION_BY_ZERO` warning group reports for Kotlin: removed duplicated text and removed package name from the constructor name.
|
|
|
|
|
|
|
|
## Go
|
|
|
|
|
|
|
|
* Go version 1.23 is supported.
|
|
|
|
* Now assembler functions are handled as unknown functions instead of empty (without any side effects).
|
|
|
|
* New checker `NO_EFFECT.CALL` for function calls that have no effects.
|
|
|
|
* Checker `DEREF_OF_NULL.EX.COND` is enabled for Go.
|
|
|
|
* Checker `DEREF_AFTER_NULL.MIGHT` now is working for Go too.
|
|
|
|
* `DOUBLE_CLOSE` now emits warning only for closing channels and ignores closing files and resources.
|
|
|
|
* [sup #455] Svace now doesn't emit `USE_AFTER_RELEASE` warnings for reading from channels.
|
|
|
|
* Fixed locations for warning reports in loop headers.
|
|
|
|
* [sup #737] Fixed locations for warning reports in conditional operators.
|
|
|
|
* Reduced size of Go compiler in Svace distribution.
|
|
|
|
* [sup #920] Now Svace ignores minor versions when compiling Go sources.
|
|
|
|
* [sup #901] Fixed false `HANDLE_LEAK.EX` reports, related to `defer`.
|
|
|
|
* [sup #655] Fixed false `DEREF_AFTER_NULL.EX` reports on the podman project.
|
|
|
|
* [sup #921] Fixed false `DEREF_AFTER_NULL.EX` reports on the prometheus project.
|
|
|
|
* [sup #932] Fixed false `OVERFLOW_UNDER_CHECK` reports, related to reading array elements.
|
|
|
|
* [sup #933] Fixed false `OVERFLOW_UNDER_CHECK.PROC` reports, related to reading array elements.
|
|
|
|
* [sup #937] Fixed false `DYNAMIC_OVERFLOW` reports for for slices, where length has been checked.
|
|
|
|
* Fixed false reports for nil dereference checkers, related to uninitialized arrays.
|
|
|
|
* Checker `NO_RECOVER_FOR_PANIC` now emits reports only if `main` or `init` functions are reached without cathing the exception. For other cases `NO_RECOVER_FOR_PANIC.STRICT` warning type is reported.
|
|
|
|
* [sup #822] Updated documentation for `UNCHECKED_TUPLE.RET`.
|
|
|
|
|
|
|
|
## Python
|
|
|
|
|
|
|
|
* Python version 3.12 is supported.
|
|
|
|
* Improved performance of building python projects.
|
|
|
|
* [sup #966] Fixed failing of `opencv` builds.
|
|
|
|
* [sup #999] Fixed failing of `patroni` builds.
|
|
|
|
* [sup #869] Function information in analysis results now is more stable that allows better warning reports matching.
|
|
|
|
* [sup #811] Fixed exception during analysis.
|
|
|
|
|
|
|
|
## C#/Visual Basic .NET
|
|
|
|
|
|
|
|
* Added a workaround for analysis hang by forcing the analysis to continue without waiting for a method which has exceeded the specified limit more than 3 times.
|
|
|
|
* [sup #626] Fixed false `SIMILAR_BRANCHES` reports.
|
|
|
|
* [sup #672] Inverted the logic of `UNSAFE_DESERIALIZATION` for validation inside a callback.
|
|
|
|
* [sup #784] Excluded `CredentialCache.Add` from collection propagators for taint analysis.
|
|
|
|
* [sup #632] Fixed `HANDLE_LEAK` false reports with disposable of non-disposable type.
|
|
|
|
* [sup #642], [sup #653] Fixed `UNREACHABLE_CODE` false reports when an external function which modifies an object is called from a user function called from a user function.
|
|
|
|
* [sup #889] Improved `WEAK_ENCRYPTION` message.
|
|
|
|
* [sup #902] Fixed symlink resolution for analysis results on Windows.
|
|
|
|
* [sup #910] `LOCK_OBJECT_REASSIGNMENT` is now not reported on volatile lock objects.
|
|
|
|
* [sup #633] Added tracepoint at the location where the scope is conditionally exited in `HANDLE_LEAK`.
|
|
|
|
* [sup #914] Fixed `DEREF_OF_NULL` false reports when converting `null` to a function pointer.
|
|
|
|
* [sup #960] Allowed abstract methods to be pure to fix `DEREF_OF_NULL` false reports.
|
|
|
|
* [sup #639] Fixed `DEREF_OF_NULL.RET.USER.PROC` false reports with oversized condition.
|
|
|
|
* [sup #663] Fixed `DEREF_OF_NULL.RET.USER.PROC [STATISTICAL]` false positive when a function which cannot return `null` is analyzed after its caller.
|
|
|
|
* [sup #648] Improved delegate devirtualization when target functions are always known and not modifiable from outside.
|
|
|
|
* NUnit 4 `ClassicAssert` is now supported in testcases checkers and conditions.
|
|
|
|
* Added more details to no escape tracepoints in `HANDLE_LEAK`.
|
|
|
|
* Added step tracepoints in `USE_AFTER_DISPOSE`.
|
|
|
|
* Added interprocedural tracepoints in `DIVISION_BY_ZERO` for non-explicit case.
|
|
|
|
* Added tracepoints for operator method declaration in `DEREF_AFTER_NULL` with overloaded comparison operator.
|
|
|
|
* Added new checker `API.CSHARP.CANCELLATION_TOKEN` for situations, when a method takes `CancellationToken` as a parameter and calls another method with optional `CancellationToken` parameter, but does not forward it.
|
|
|
|
* Added new checker `TERNARY_OPERATOR_PRECEDENCE` for probably wrong operator precedence (missing parentheses) in a conditional operator expression. When the whole expression is in parentheses a `TERNARY_OPERATOR_PRECEDENCE.PARENTHESIZED` subtype is reported.
|
|
|
|
* Added new checker `LOGICAL_OPERATOR_PRECEDENCE` for probably wrong operator precedence (missing parentheses) in a logical expression with `&&` and `||`.
|
|
|
|
* Added new checker `COALESCING_OPERATOR_PRECEDENCE` for a probably wrong operator precedence (missing parentheses) in a null coalescing operator expression.
|
|
|
|
|
|
|
|
## Svace API
|
|
|
|
|
|
|
|
* Added possibility to set up information about a SEI CERT Coding Standards mapping of a warning type.
|
|
|
|
|
|
|
|
## JavaScript
|
|
|
|
|
|
|
|
Following checkers are implemented for JavaScript:
|
|
|
|
|
|
|
|
* `INVARIANT_RESULT` - the expression always takes a constant value regardless of the operand values (e.g., `x + 0`).
|
|
|
|
* `SIMILAR_BRANCHES` - the branches of a conditional or ternary operator are identical.
|
|
|
|
* `SIMILAR_BRANCHES.SWITCH` - the branches of the switch statement are identical.
|
|
|
|
* `DEFAULT_CASE_MISSING` - the switch statement is missing a default branch.
|
|
|
|
* `CATCH.NO_BODY` - the catch block lacks statements.
|
|
|
|
* `CATCH.EXCEPTION_ASSIGN` - assigning a value to the exception parameter passed to the catch block, which leads to ignoring the exception.
|
|
|
|
* `BAD_COPY_PASTE` - a partial clone of code where some parts may have been accidentally left unchanged (e.g., not all instances of one variable have been replaced with another).
|
|
|
|
* `WRONG_ARGUMENTS_ORDER` - calling a function with potentially wrong order of arguments.
|
|
|
|
* `RETURN_IN_FINALLY` - using the `return` statement in a `finally` block, which may lead to ignoring the exception.
|
|
|
|
* `INAPPROPRIATE_FOR_IN` - using a `for ... in` loop when it would be more appropriate to use `for ... of`.
|
|
|
|
* `INCORRECT_NAN_COMPARE` - checking for `NaN` using comparison similar to `x == NaN` instead of calling the built-in `isNaN` function.
|
|
|
|
* `INCORRECT_TYPE_OF_COMPARE` - comparing the result of a `typeof` expression with the name of a non-existent type.
|
|
|
|
* `GETTER_WITHOUT_RETURN` - absence of a `return` statement in a getter.
|
|
|
|
* `SETTER_WITH_RETURN` - presence of a `return` statement in a setter.
|
|
|
|
* `CONSTRUCTOR_WITH_RETURN` - presence of a `return` statement in a constructor.
|
|
|
|
* `EMPTY_DESTRUCTURING_PATTERN` - an empty pattern during destructuring.
|
|
|
|
* `CALLBACK_WITHOUT_RETURN` - absence of a return value in a callback function passed to a higher-order function that expects a return value (e.g., passing a `void` function to `Array.filter`).
|
|
|
|
* `CALLBACK_WITH_RETURN` - presence of a return value in a callback function passed to the higher-order function `forEach`. |
|
|
|
\ No newline at end of file |
