Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

False positive in G-9501 when using assignment in variable of declare section #56

Closed
PhilippSalvisberg opened this issue Dec 8, 2022 · 0 comments · Fixed by #60
Closed
Assignees
Labels
bug Something isn't working

Comments

@PhilippSalvisberg
Copy link
Collaborator

The following code detects a violation of "G-9501: Never use parameter in string expression of dynamic SQL. Use asserted local variable instead.":

create or replace procedure exec_sql(in_sql in varchar2) is
   l_sql          varchar2(1000 char) := in_sql;
   l_sql_asserted varchar2(1000 char);
begin
   l_sql_asserted := sys.dbms_assert.noop(l_sql);
   execute immediate l_sql_asserted;
end exec_sql;
/

It works when rewritten this way:

create or replace procedure exec_sql(in_sql in varchar2) is
   l_sql          varchar2(1000 char) := sys.dbms_assert.noop(in_sql);
begin
   execute immediate l_sql;
end exec_sql;
/

However, this detects a "G-2160: Avoid initializing variables using functions in the declaration section.". Which is correct.

The assignment in the declare section honors guideline "G-8310: Always validate input parameter size by assigning the parameter to a size limited variable in the declaration section of program unit."

This issue is related to #55.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
1 participant