Regexp FindAll With Zero Count
ID |
go.regexp_find_all_zero |
Severity |
low |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Reliability |
Language |
Go |
Tags |
CWE:1164, regexp, reliability |
Description
Reports a regexp.Regexp FindAll* method called with a literal count of 0. With n == 0 the
method always returns no matches, which is almost never the intent.
Rationale
The n parameter of the FindAll family limits how many matches are returned. A value of 0 means
"return zero matches", so the call can only ever produce an empty or nil result — a silent no-op
that looks like "no limit" but is the opposite. To return every match the count must be -1. The
check fires only on a literal 0 count passed to a FindAll* method on a regexp.Regexp, leaving
-1 and positive limits alone.
r.FindAll(b, 0) // FLAW — always returns no matches
r.FindAll(b, -1) // OK — returns all matches