# \[SonarLint\]\[S2259\]\[C#\] False Positive - SonarLint is trying to solve the halting problem

**URL:** <https://community.sonarsource.com/t/sonarlint-s2259-c-false-positive-sonarlint-is-trying-to-solve-the-halting-problem/57800>\
**Category:** Report False-positive / False-negative...\
**Tags:** csharp, dotnet\
**Created:** [February 7, 2022, 2:46pm UTC](https://community.sonarsource.com/t/sonarlint-s2259-c-false-positive-sonarlint-is-trying-to-solve-the-halting-problem/57800 "2022-02-07T14:46:49Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![JJungner](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/jjungner/32/30048_2.png) [@JJungner](https://community.sonarsource.com/u/JJungner)\
**Post date:** [February 7, 2022, 2:46pm UTC](https://community.sonarsource.com/t/sonarlint-s2259-c-false-positive-sonarlint-is-trying-to-solve-the-halting-problem/57800/1 "2022-02-07T14:46:50Z")

</div>

- SonarLint 5.1.0.39724, installed as extensions to Visual Studio 2019, Scanning C#-code.

```auto
      public void DemoProblem()
      {
         ConnectionStringSettings chosenConnection = AskUserToPickConnection();

         if (null == chosenConnection) ShutDownHard(0);

         ConnectUsingSettings(chosenConnection.ConnectionString); // reports S2259 'chosenConnection' is null on at least one execution path.
      }

```

ShutDownHard does an Environment.Exit() with the given exitCode, so the problem line is never reached if chosenConnection is null.

SonarLint can’t really know this without analyzing ReallyShutDown, which in turn is equivalent to  
[the halting problem](https://en.wikipedia.org/wiki/Halting_problem).

What is extra vexing is that the S2259 disappears if I remove the null check.  
I.e. it doesn’t warn if the code is _actually_ vulnerable.

---

<div class="post-metadata">

**Author:** ![JJungner](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/jjungner/32/30048_2.png) [@JJungner](https://community.sonarsource.com/u/JJungner)\
**Post date:** [February 9, 2022, 11:57am UTC](https://community.sonarsource.com/t/sonarlint-s2259-c-false-positive-sonarlint-is-trying-to-solve-the-halting-problem/57800/2 "2022-02-09T11:57:55Z")

</div>

Looked around and found these topics about the same rule, but different pieces of code.

> [@False positive in rule: is null on at least one execution path](https://community.sonarsource.com/t/false-positive-in-rule-is-null-on-at-least-one-execution-path/1221):
>
> Sonar Qube Version 7.2.1 this sentence is a valid and suggested, when we use recent versions of C# if ((keys?.Count ?? 0) \> 0) { int min = Math.Min(chunkSize, keys.Count // \<---------- ... } we check for Nulls on the if using the operator ?. and the ?? together .

> [@Object is null on at least one execution path](https://community.sonarsource.com/t/object-is-null-on-at-least-one-execution-path/5939):
>
> Version: 6.7.6.38781, scaner: 7.10 (build 7896) Message: 'ex' is null on at least one execution path. Reproduce: void Foo(Exception ex) { switch (ex) { // Particular case: case ArgumentException e: // --snip-- break; // General case: case Exception e: // --snip-- break; // If exception is null, nothing to do: default: return; } // 'ex' cannot be null, but SonarQ…

As well as this blog post about False Positives, where it is apparent the problem is very well understood.

> **[False positives are our enemies, but may still be your friends](https://www.sonarsource.com/blog/false-positives-our-enemies-but-maybe-your-friends/)**
>
> When writing a rule for static analysis, it’s possible that in some cases, the rule does not give the results that were expected. Unfortunately, naming a false positive is often far easier than fixing it. In this post, I’ll discuss how the different...

Aggregating here for future reference. Both for test cases if/when the rule is up for adjustment, and for other users to see what has happened before, and the official policy on false positives.

---

<div class="post-metadata">

**Author:** ![Caba\_Sagi](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/caba_sagi/32/17409_2.png) [@Caba\_Sagi](https://community.sonarsource.com/u/Caba_Sagi)\
**Post date:** [February 25, 2022, 5:00pm UTC](https://community.sonarsource.com/t/sonarlint-s2259-c-false-positive-sonarlint-is-trying-to-solve-the-halting-problem/57800/3 "2022-02-25T17:00:27Z")

</div>

Hello @JJungner and welcome to our community!

I can confirm this as a false positive, however for the time being we don’t support cross method analysis. Because of that our analyzer does not know what `ShutDownHard(0)` does.

Unfortunately the only thing for now you can do is to resolve the issue as a false positive.

All the best,  
Čaba

---

<div class="post-metadata">

**Author:** ![JJungner](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/jjungner/32/30048_2.png) [@JJungner](https://community.sonarsource.com/u/JJungner)\
**Post date:** [February 25, 2022, 9:58pm UTC](https://community.sonarsource.com/t/sonarlint-s2259-c-false-positive-sonarlint-is-trying-to-solve-the-halting-problem/57800/4 "2022-02-25T21:58:37Z")

</div>

Thank you for your reply.

I read the blog post referred to earlier, so I am aware of the official policy.

However, I’ve also been thinking a bit about it since.

The code contains a statement on the form

```auto
      if (<variable> == null) <do something>

```

This is an obvious null check. Yet the rule triggers.

And when I remove the null check, the rule _doesn’t_ trigger. I.e. the rule somehow assumes that since there is no null check, the variable can’t be null.

So it’s worse than a false positive. It’s a **flipped** result.

The logical conclusion from seeing the null check there, should be that the code handles nulls in that particular variable.

Not the other way around.

Especially if you don’t bother parsing the \<do something\>-part

(In my not so humble opinion.)

---

<div class="post-metadata">

**Author:** ![Caba\_Sagi](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/caba_sagi/32/17409_2.png) [@Caba\_Sagi](https://community.sonarsource.com/u/Caba_Sagi)\
**Post date:** [March 7, 2022, 3:02pm UTC](https://community.sonarsource.com/t/sonarlint-s2259-c-false-positive-sonarlint-is-trying-to-solve-the-halting-problem/57800/5 "2022-03-07T15:02:04Z")

</div>

@JJungner I understand that at the first look it might look like a flipped result but let me explain you how it works trough an example and you will see it is not.

First example:

```auto
if(variable == null)
  Console.WriteLine("Variable is null");
variable.ToString(); // Noncompliant

```

As you can see in this example in case the variable is null we just do some logging. After the if block the `ToString` call will cause some trouble in the form of a NullReferenceException.

Second example:

```auto
if(variable == null)
  variable = Sanitize();
variable.ToString();

```

In this example in case the variable is null, it will be assigned a new value. Now after this point we are not sure anymore if the variable has a null value or not, so no issue will be raised for the `variable.ToString()` invocation.

For your code snippet the case is that we don’t support cross method analysis and our engine does not understand what will `ShutDownHard(0)` do, hence the false positive.

And to understand why the issue is only triggered in case there is a null check…  
Our engine does no know what `AskUserToPickConnection` method returns. It might be null but it might be the case that it does not return null in any case. In order to avoid noise and a lot of false positives, we assume it does not have the null value. Once the null check is done we now that the value can be null for at least one execution path, so the rule raises an issue.

---

<div class="post-metadata">

**Author:** ![Corniel](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/corniel/32/10101_2.png) [@Corniel](https://community.sonarsource.com/u/Corniel)\
**Post date:** [March 31, 2022, 5:21pm UTC](https://community.sonarsource.com/t/sonarlint-s2259-c-false-positive-sonarlint-is-trying-to-solve-the-halting-problem/57800/6 "2022-03-31T17:21:00Z")

</div>

May be staying the obvious, but:

```auto
 public void DemoProblem()
      {
         ConnectionStringSettings chosenConnection = AskUserToPickConnection();

         if (chosenConnection is null) { ShutDownHard(0); }
         else { ConnectUsingSettings(chosenConnection.ConnectionString); }
      }

```

will not longer raise the issue. It also helps understanding the code: without having to know what `ShutDownHard()` does, it is now clear, that the second part only is executed if the `chosenConnection` is not `null`.

---

<div class="post-metadata">

**Author:** ![JJungner](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/jjungner/32/30048_2.png) [@JJungner](https://community.sonarsource.com/u/JJungner)\
**Post date:** [April 12, 2022, 7:33am UTC](https://community.sonarsource.com/t/sonarlint-s2259-c-false-positive-sonarlint-is-trying-to-solve-the-halting-problem/57800/7 "2022-04-12T07:33:15Z")

</div>

Thanks, @Corniel . I did change the code similarly to your suggestion.

I was initially upset by SonarLint trying to solve the halting problem.  
Then I was upset because they assumed that a ‘check for null’ meant ‘not handled’.  
Then I went back and changed the code.

I still think ‘check for null’ = ‘not handled’ is beyond stupid, but I have moved on.

Will mark your code as the answer.

---

<div class="post-metadata">

**Author:** ![system](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/system/32/31083_2.png) [@system](https://community.sonarsource.com/u/system)\
**Post date:** [April 19, 2022, 7:33am UTC](https://community.sonarsource.com/t/sonarlint-s2259-c-false-positive-sonarlint-is-trying-to-solve-the-halting-problem/57800/8 "2022-04-19T07:33:25Z")

</div>

Closed on April 19, 2022, 7:33am UTC

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.