Consider the following Java code: import org.bouncycastle.asn1.ASN1ObjectIdentifier; ... public static final ASN1ObjectIdentifier BasicConstraints = new ASN1ObjectIdentifier("2.5.29.19"); This reports S1313 (IP addresses should not be hardcoded), but this isn’t an IP address, it is an ASN.1 OID th…

Thank you, Simon. We’ll have an internal talk about what we could do to improve the rule and let you know of our decision once we take it. Regards, Andrei

S1313 false-positive with ASN.1 OID

Rules and Languages Report False-positive / False-negative...

Andrei_Epure (Andrei Epure) June 18, 2018, 2:09pm 4

Hi, Simon. We’ve opened SONARJAVA-2798 to avoid FPs in such a situation.

Regards,
Andrei

Topic		Replies	Views
python:S1313 false positive on OIDs Report False-positive / False-negative... python	1	866	June 29, 2018
False positive example for S2589 Report False-positive / False-negative... java	2	1531	April 3, 2020
S1313 false positive on hardcoded IPs from the exception list Report False-positive / False-negative...	4	647	January 23, 2023
[Narrowed down] False positive for rule java:S2583 Report False-positive / False-negative... java , intellij , false-positive	1	494	August 28, 2023
False positive or false negative? I don't care which but consistency would be real nice as a minimum SonarQube Server / Community Build java , sonarqube , security	3	1270	August 31, 2020

S1313 false-positive with ASN.1 OID

Related topics