Regexp FindAll With Zero Count

ID

go.regexp_find_all_zero

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Go

Tags

CWE:1164, regexp, reliability

Description

Reports a regexp.Regexp FindAll* method called with a literal count of 0. With n == 0 the method always returns no matches, which is almost never the intent.

Rationale

The n parameter of the FindAll family limits how many matches are returned. A value of 0 means "return zero matches", so the call can only ever produce an empty or nil result — a silent no-op that looks like "no limit" but is the opposite. To return every match the count must be -1. The check fires only on a literal 0 count passed to a FindAll* method on a regexp.Regexp, leaving -1 and positive limits alone.

r.FindAll(b, 0)   // FLAW — always returns no matches
r.FindAll(b, -1)  // OK — returns all matches

Remediation

Pass -1 to return all matches, or a positive limit for a real cap.