C# - S2583 false positive in a for-loop

[urmel]

Hello, we use the following structure to bundle SQL-Queries. But the Linter says that the if-condition is always true or false. I think it’s because the rule isn’t consider the for-loop

• What language is this for? C#
• Which rule? S2583
• Why do you believe it’s a false-positive? Because the condition is not ALWAYS false or wrong.
• Are you using
  • SonarCloud? No
  • SonarQube - which version?No
  • SonarLint - which IDE/version? Yes, IDE Visual Studio 17.7.5 ; SonarLint 9.8.0.76515
    • in connected mode with SonarQube or SonarCloud? No
• How can we reproduce the problem? Give us a self-contained snippet of code (formatted text, no screenshots)

                for (int j = 0; j < 100; j++)
                {
                    // add sql-update
                    sql += "UPDATE XYZ";

                    iLoop++;
                    if (iLoop == 10)
                    {
                        // send sql update
                        iLoop = 0;
                    }
                }

[Mary_Georgiou]

Hello @urmel and thanks for reporting this.

I confirm this is a false positive and indeed it’s related to the for-loop.

Our symbolic execution engine explores loops only two times, and it cannot “learn” that iLoop > 2 can be true.

We already have similar issues to our backlog (for example see here, here and here), where you can read more information.

[urmel]

Hey @Mary_Georgiou ,
thank you for your quick answer!

Unfortunately, I only searched in the community and not in the repo.

Could you turn off the rule for the if’s in a for-loop when there is an incremetation of an var inside?

[Mary_Georgiou]

Hello again,

We already took that path, where we tried to apply exclusions in the loops but there were a lot of false negatives (more value was lost than noise being taken out).

However, we have a scheduled sprint to look into the symbolic execution engine and for-loops again with the goal of minimizing the false positives.

For now, unfortunately, there’s not a lot we can do.

[urmel]

Thank you!

I’m looking forward to that solution, and thank you for the tool.