Regular expression in Javascript

SonarQube
1

Hi,

I’m using the sonarqube developer edition 8.1 and after sonarqube scans I see 46 instances of Make sure that using a regular expression is safe here error as Security Hotspots.

  1. Why Don’t I see any severity for security hotspots ?
  2. How do I conclude if it’s really an error or false-positive?

Thank you
Farheen

2

Hi Farheen,

I like to describe Security Hotspots as Shroedinger’s Vulnerabilities: you won’t know if there’s a problem or not until you look. And since they’re only potential problems, we don’t assign a severity.

In later versions (we’re on 8.7 now; you might want to catch up :wink:) we’ve crafted a special interface around Security Hotspot review. I guess in 8.1 you simply want to consult the rule description; it should give you what you need.

 
Ann

3

Thank you for your response Ann,

Are there any major differences between 81. and 8.7? Could you please share release notes if possible. Are there any functions deprecated?

Regards,
Farheen

4

Hi Farheen,

You’ll find release notes links for each version on the Downloads page.

 
Ann