Re: Proposal for deviations in static analyser findings

[Jan Beulich <jbeulich@xxxxxxxx>]

On 18.10.2022 17:49, Luca Fancellu wrote:
>> On 18 Oct 2022, at 16:29, Jan Beulich <jbeulich@xxxxxxxx> wrote:
>> On 18.10.2022 17:17, Luca Fancellu wrote:
>>>> On 13 Oct 2022, at 12:34, Jan Beulich <jbeulich@xxxxxxxx> wrote:
>>>> On 13.10.2022 12:11, Luca Fancellu wrote:
>>>>>> On 13 Oct 2022, at 08:50, Jan Beulich <jbeulich@xxxxxxxx> wrote:
>>>>>> Iirc at least Coverity ignores certain instances of what it might 
>>>>>> consider
>>>>>> violations (fall-through in switch() statements in particular) in case
>>>>>> _any_ comment is present. Therefore may I suggest that such comments be
>>>>>> deleted (really: replaced by a blank line, to maintain correct line
>>>>>> numbering) if there's no matching key-value pair?
>>>>>
>>>>> Yes the line won’t be altered if there is no match. This to ensure the 
>>>>> correct line
>>>>> numbering is not affected.
>>>>
>>>> "won't be altered" is the opposite of what I've been asking to consider:
>>>> Observing that comments _regardless_ of their contents may silence 
>>>> findings,
>>>> the suggestion is to remove comments (leaving a blank line) when there's no
>>>> entry for the targeted tool in the table entry.
>>>
>>> Why? The tag comment won’t do anything, it would act as a blank line from 
>>> the analyser
>>> perspective.
>>
>> The _tag_ won't do anything, but as said any _comment_ may have an effect.
> 
> Yes, any comment that is using a proprietary syntax for the tools we use:
> 
> /* cppcheck-suppress[proprietary_ID] */
> /* coverity[proprietary_ID] */
> /* -E> hide proprietary_ID 1 “" */
> 
> May have an effect.
> 
> If an entry in the database has no match with the used tool, then it would 
> stay as (for example):
> 
> /* SAF-X-safe [blablabla] */
> 
> Which has no effect on any tool, hence I don’t see the needs to replace it 
> with a blank line.

One more try: May I ask that you re-read the very beginning of the context
I've left in place? I did call out a case where, from all I know, a tool
would be silenced by the mere presence of a comment, regardless of comment
text. Hence by not purging SAF-X-... comments you may suppress findings.

Jan