Sonar Scanner - resource allocation for UCFG simulation

[Colin]

Hey there.

@samb

This doesn’t
prevent the scan from completing, or analysis succeeding, but it does mean that
there are findings that are missed (confirmed via manual code review).

It’s a bit of a leap to say that’s why certain findings may be missing. Can you provide an example?

In any case, here you can read more about what the message means, and why it’s not configurable:

How to avoid "High simulation costs for sink in" error

Hi @tnoiret, the scanner performs a complex taint analysis that attempts to trace all possible user inputs through all possible paths of the program. Such an analysis can, in theory and under certain conditions, explode exponentially. The engine has some built-in mechanics that allow it to detect when the analysis of some parts of the code starts to consume too much memory, in order to cut branches and focus analysis time and memory on the parts of the code where it is most likely to find probl…