FormatString not raised for non final variable?
- Dominant language
- Java
- Stars
- 7.2k
- Forks
- 820
- Avg merge
- 5h 9m
- Merged PRs (30d)
- 50
Description
The following code (focus on `final`) is detected by the `FormatString` rule.
```
public String bugDemo() {
final String a = "e = %++10.4f";
return String.format(a, Math.E);
}
```
However, if we remove the `final`, and only declare `String a = "e = %++10.4f";`, then `FormatString` is not detected.
Now, to detect the final variable, it is still required to track the value of `a` to the `String.format` call, right? Then, why removing the final variable no longer works? Is it a desired behaviour or a bug?
I think if error_prone can track the value when declared as a final variable, it should be able to track whether the non-final String is also a hard-coded bad format string. It may not raise the warning if the value is returned from a method call (if inter-method data-flow analysis is not feasible). But if the hard-coded value comes from inside the method, it seems to me error_prone can detect it since it can detect the final variable version.
By the way, `InlineFormatString` is raised (correctly) on both occasions.
ErrorProne: `2.40.0`
Dataflow-ErrorProne: `3.42.0`
Java: `JDK 21`
Run Method: `CLI`
Contributor guide
Assessment
This issue has not been assessed yet.