In the past we have discussed Static Analyzer suppression mechanisms in great length. They are extremely handy when needing to quash false positives that inevitably arise from using this tool.
Presently we don’t really have any mechanisms for suppression. The only way to do this is to turn off the analyzer for a block of code (#ifndef clang_analyzer).
I understand that the community is exploring a pragma based approach to silencing the SA. While this will work for most use cases it has one limitation: it involves making changes to the source file(s).
This can be problematic for:
- Analyzing projects that contain some amount of legacy code that can’t be changed. While making changes to security critical issues is possible, it is a tough sell to add pragmas that cater to an external tool.
- For teams / groups working on large projects (eg: Android) that involve building some amount of open source code that can’t be changed easily.
I am presently exploring an external file based mechanism for suppressing the Static Analyzer. What I’m proposing is that we have a compiler flag that can point to an external text or xml file that contains the suppression information. A first cut for the suppression information can contain the file name, function name and checker type to be silenced. The static analyzer can then read the file and silence warnings accordingly.
This will in essence solve the aforementioned problem. Note: I thought of function name and not line number because any small change to the code can break line number assumptions; silencing warnings by function name seems more stable.
Looking forward to hearing the communities thoughts on such a mechanism and it’s likelihood of getting accepted upstream.