Rule S6328: Replacement strings should reference existing regular expression groups

Description

The rule should raise whenever a reference to a nonexistent group is made in the "replacement" argument passed to replace/replaceAll from String.

Important note: the behavior for Java is slightly different from JS/PHP: it will throw an IndexOutOfBoundsException when the group does not exist, the result string will not be erroneous (as in JS/PHP). There is therefore little chance that the program goes fine at runtime. (We do not consider the value that could be added by supporting dynamic String building since it is any way out of scope for this rule.)
We are in the situation where the rule could make sense in SL context, but if an issue reaches SQ, it is most probably an FP. We implemented a few rules with such behavior (see mockito rules), and it ends up really noisy. We should make sure to either carefully consider this rule, or not implement it at all.

Activity

Show:

Quentin Jaquier May 2, 2022 at 9:41 AM

After a second look at this rule, I think that it does not make sense to go forward with it. In addition to the note in the ticket, the rule is not implemented on Analyzers Commons, it has a specific implementation for JS and PHP. Implementing it on our side is probably not trivial, therefore not worth the effort.

Won't Do
Pinned fields
Click on the next to a field label to start pinning.

Details

Assignee

Reporter

Labels

Components

Priority

Sentry

Created February 2, 2022 at 9:18 AM
Updated October 29, 2024 at 5:02 PM
Resolved May 2, 2022 at 9:42 AM