Xiaoven / codegex

A light-weight tools like spotbugs
GNU Lesser General Public License v2.1
1 stars 0 forks source link

False positive for BIT_SIGNED_CHECK #66

Closed Xiaoven closed 3 years ago

Xiaoven commented 3 years ago

fastjson/src/main/java/com/alibaba/fastjson/util/UTF8Decoder.java

int uc = ((b1 & 0x07) << 18) | ((b2 & 0x3f) << 12) | ((b3 & 0x3f) << 06) | (b4 & 0x3f);

原因

现在的 pattern 为

\(\s*([~-]?(?:(?P<aux1>\((?:[^()]++|(?&aux1))*\))|[\w.-])++)\s*&\s*([~-]?(?:(?&aux1)|[\w.])++)\s*\)\s*([><=!]+)\s*0

它匹配上述例子中的 (b3 & 0x3f) << 0 部分。应在逻辑中加入判断 ([><=!]+) 部分提取到的是否是 >, <, >=, <=, ==, != 之一,如果不是,则返回