google / google/error-prone

FormatString not raised for non final variable?

Open
#5,151 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
7.2k
Forks
820
Avg merge
5h 9m
Merged PRs (30d)
50

Description

The following code (focus on `final`) is detected by the `FormatString` rule.
```
public String bugDemo() {
final String a = "e = %++10.4f";
return String.format(a, Math.E);
}
```
However, if we remove the `final`, and only declare `String a = "e = %++10.4f";`, then `FormatString` is not detected.

Now, to detect the final variable, it is still required to track the value of `a` to the `String.format` call, right? Then, why removing the final variable no longer works? Is it a desired behaviour or a bug?
I think if error_prone can track the value when declared as a final variable, it should be able to track whether the non-final String is also a hard-coded bad format string. It may not raise the warning if the value is returned from a method call (if inter-method data-flow analysis is not feasible). But if the hard-coded value comes from inside the method, it seems to me error_prone can detect it since it can detect the final variable version.

By the way, `InlineFormatString` is raised (correctly) on both occasions.

ErrorProne: `2.40.0`
Dataflow-ErrorProne: `3.42.0`
Java: `JDK 21`
Run Method: `CLI`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.