Integer To String

ID

go.integer_to_string

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Go

Tags

reliability, suspicious-conversion

Description

Reports a string(intExpr) conversion whose operand is a signed integer. Such a conversion does not stringify the number — it returns the one-rune string at that Unicode code point.

Rationale

string(65) is "A", not "65". Converting an integer with string(…​) interprets the value as a code point and yields a single-rune string, which is almost never what the author intended when stringifying a number. The correct conversion is strconv.Itoa(n) (or strconv.FormatInt). Modern Go toolchains warn on the constant form, but the rule also catches integer variables.

var i int = 65
_ = string(i)   // FLAW — yields "A", not "65"
_ = string(65)  // FLAW — integer literal
var b byte = 65
_ = string(b)   // OK — byte-to-rune string is a valid code-point conversion
var r rune = 'A'
_ = string(r)   // OK — rune-to-string is valid

Remediation

Use strconv.Itoa(n) for an int, or strconv.FormatInt(n, 10) for a wider integer. Keep the string(…​) conversion only when you genuinely mean the code point of a rune or byte.

References