cschantz/Linux-Server-Management-Toolkit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Reduce false positives in integer comparison check

Browse Source 
Improvements:
- Added more common integer variable patterns (crit, high, med, low, severity, line_num, port, pid, uid, gid, attempt, tries)
- Skip variables with default value syntax ${var:-0}
- Reduces false positives for counters, IDs, severity levels, and line numbers

This significantly reduces noise in QA output while maintaining detection
of genuinely unsafe integer comparisons.
This commit is contained in:
cschantz
2025-12-31 21:57:31 -05:00
parent 37fea20ba5
commit f4c921bea0
1 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/toolkit-qa-check.sh
+8 -3
View File
@@ -296,12 +296,17 @@ while IFS=: read -r file line_num line_content; do
# Skip if variable is known to be integer from source
[ "${SAFE_INTEGER_VARS[$var_name]}" = "1" ] && continue
# Skip common safe patterns (boolean flags, counters, status codes)
if [[ "$var_name" =~ ^(count|num|total|exit_code|status|i|j|k|index|ret|rc|has_|shown|found|enabled|disabled|flag|issues|errors|warnings)$ ]] || \
[[ "$var_name" =~ (has_|_count|_num|_total|_exit|_status|_flag|_shown|_found|_enabled|_disabled|_issues|_errors|_warnings) ]]; then
# Skip common safe patterns (boolean flags, counters, status codes, line numbers, IDs)
if [[ "$var_name" =~ ^(count|num|total|exit_code|status|i|j|k|index|ret|rc|has_|shown|found|enabled|disabled|flag|issues|errors|warnings|crit|high|med|low|severity|line_num|port|pid|uid|gid|attempt|tries)$ ]] || \
[[ "$var_name" =~ (has_|_count|_num|_total|_exit|_status|_flag|_shown|_found|_enabled|_disabled|_issues|_errors|_warnings|_crit|_high|_med|_low|_severity|_line|_port|_pid|_uid|_gid|_attempt|_tries) ]]; then
continue # Likely safe (common integer/boolean variable patterns)
fi
# Skip if used with default value syntax ${var:-0}
if echo "$line_content" | grep -qE '\$\{[^}]+:-[0-9]+\}'; then
continue # Has default value, safe
fi
echo "HIGH|$file|$line_num|Integer comparison: $var (verify not empty before comparison)"
count_issue "HIGH"
((count++))