Skip to content

Commit 23a1ea7

Browse files
authored
Merge pull request github#17717 from owen-mc/go/update-incorrect-integer-conversion-qhelp
Go: Update `go/incorrect-integer-conversion` qhelp to explain possible source of FPs
2 parents 9ef1a9c + 500992c commit 23a1ea7

File tree

1 file changed

+5
-0
lines changed

1 file changed

+5
-0
lines changed

go/ql/src/Security/CWE-681/IncorrectIntegerConversionQuery.qhelp

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,11 @@ the bit size you specified when parsing the number.
2727
If this is not possible, then add upper (and lower) bound checks specific to each type and
2828
bit size (you can find the minimum and maximum value for each type in the <code>math</code> package).
2929
</p>
30+
<p>
31+
Note that CodeQL is only able to identify bounds checks that compare against a constant value. When a variable
32+
is used in the comparison, CodeQL is unable to determine the value of the variable at runtime and will not
33+
recognize the bounds check.
34+
</p>
3035
</recommendation>
3136

3237
<example>

0 commit comments

Comments
 (0)