Go Warning Classes Corresponding to Staticcheck Checks

• Introduction
• Go Warning Classes from Staticcheck Checks
• Built-in Go Warning Classes
• Enabling and Disabling

Introduction

This page describes the CodeSonar warning classes that are assigned to Go warnings imported from a SARIF file produced by Staticcheck.

For information on setting up your CodeSonar project to incorporate Go source code and the corresponding Staticcheck results, see Including Go Components in a CodeSonar Project.

Go Warning Classes from Staticcheck Checks

Example

Suppose the imported SARIF file includes a rule object like the following.

# ...
    "rules":[
        # ...
      {
        "id": "SA2001",
        # SARIF produced by Staticcheck does not include a "name"
        # ...
      },
      # ...
    ],
# ...

(This corresponds to the Staticcheck Empty critical section, did you mean to defer the unlock? check.)

1. CodeSonar computes the corresponding warning class name: "Empty Critical Section, Did You Mean to Defer the Unlock? (Staticcheck)".
2. If there is not already a warning class with this name, CodeSonar creates the warning class. The class categories will be
   • GO.CONCURRENCY.ECSDYM (the mnemonic)
     • Staticcheck describes the set of checks whose ID begins with "SA2" as "Concurrency issues".
   • Staticcheck:SA2001
3. CodeSonar creates a "Empty Critical Section, Did You Mean to Defer the Unlock? (Staticcheck)" warning instance for each result entry in the SARIF that has "ruleId":"SA2001".

SARIF files produced by Staticcheck

CodeSonar will consider a SARIF file to be produced by Staticcheck in the following cases.

• The SARIF file was produced and imported via a codesonar go_scan.py invocation.
• The file is imported with a codesonar import_sarif.py invocation that specifies -analyzer staticcheck.
• The file is imported with a codesonar import_sarif.py invocation that does not specify -analyzer, and the SARIF importer can determine from the file contents that it was produced by Staticcheck.

Built-in Go Warning Classes

These warning classes correspond to checks from Staticcheck version 2023.1.6.

Enabling and Disabling

You have multiple degrees of control over reporting for the warnings issued by Staticcheck.

• To enable a specific Staticcheck check (and thus checking for the corresponding CodeSonar warning class), specify and configure that check in your Staticcheck configuration file.
  Similarly, you can disable specified Staticcheck checks in the configuration file.

  See the Staticcheck Configuration File documentation for details.

• To selectively disable submission to the hub for a warning or set of warnings, define a WARNING_FILTER discard rule in a suitable CodeSonar configuration file.

  You can also specify a combination of WARNING_FILTER discard and WARNING_FILTER allow rules, if that is the most convenient way to characterize a specific set. When you specify warning class names (or parts of names) in your WARNING_FILTER rules, make sure you are using the generated CodeSonar warning class name as described above.