github / github/codeql

False positive for `go/incomplete-hostname-regexp` and `\Q`

Abierto
#15,894 1 comentario 0 reacciones 0 asignados Ver en GitHub
false-positive Go
Lenguaje dominante
CodeQL
Estrellas
10.1k
Forks
2.1k
Merge medio
2 d 15 h
PR fusionados (30 d)
141

Descripción

**Description of the false positive**

```go
var todoRE = regexp.MustCompile(`^// TODO (\Qhttps://github.com/FerretDB/\E([-\w]+)/issues/(\d+))$`)
```

That line is annotated with: "This regular expression has an unescaped dot before 'com', so it might match more hosts than expected when the regular expression is used."

What it misses is [`\Q...\E` escape syntax](https://pkg.go.dev/regexp/syntax).

**Code samples or links to source code**

https://github.com/FerretDB/FerretDB/blob/ea9c5bda8f3f80a9263e006995d4257084a600a5/tools/checkcomments/checkcomments.go#L32

**URL to the alert on GitHub code scanning (optional)**

https://github.com/FerretDB/FerretDB/security/code-scanning/9

Guía de contribución

Abrir la guía de contribución

Línea de trabajo

Start with tools/checkcomments/checkcomments.go at the linked location and review the regexp/syntax documentation for \Q...\E escaping. Trace where the incomplete-hostname-regexp alert is produced in CodeQL, then verify that the supplied Go expression is no longer reported as a false positive.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
go
Área
security
Tipo de issue
Error
Dificultad
4/5
Tiempo estimado
3-5 días
Estado de actividad
Estancado
Claridad
Bastante claro
Aptitud para principiantes
42/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.