stil4m/elm-analyse

False positive: Regex check

Closed this issue · 5 comments

felixLam commented

The regex check falsely identifies the following regex builder as "non-static", which is correct but might be considered a false positive for dynamic regex patterns:

regexStringComment : String -> Regex
regexStringComment key =
    Regex.regex ("\\{-\\| ([^\\}]*)\\n-\\}\\n" ++ key ++ "\\s+:")
stil4m commented

I believe this is not a false positive: When regexStringComment "[+" is invoked you will get a runtime exception.

felixLam commented

Ok, then I misread the analyser warning. I thought the issue is about performance not safety. Maybe there should be two different warnings: one if regex is used without static where the pattern is not dynamic and another warning about potential sanitization issues.

stil4m commented

Check. Good point. Can you create a new issue for the potential sanitisation?

felixLam commented

Not really clear how you would check that the string is correctly sanitized.

stil4m commented

I'll think about this. Should be possible to check this. I'll close this ticket though.

  • 👍1