From 01cd838a4c631fb444281ed57d8f82b372cb347b Mon Sep 17 00:00:00 2001 From: Brian Gianforcaro Date: Sat, 12 Feb 2022 07:14:41 -0800 Subject: [PATCH] Meta: Suppress rule V1076 in PVS-Studio Static Analysis This rule attempts to flag invisible Unicode characters which would potentially be used by an attacker to hide code that humans can't see. https://pvs-studio.com/en/docs/warnings/v1076/ AKA the "Trojan Source" attack: https://arxiv.org/abs/2111.00169 Unfortunately our `LibUnicode` source code contains these hidden characters as they are part of the Unicode character set that the library exposes. So we have, and will always have 100s of false positives. --- .github/workflows/pvs-studio-static-analysis.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pvs-studio-static-analysis.yml b/.github/workflows/pvs-studio-static-analysis.yml index e036e0af2d..c1d019bd87 100644 --- a/.github/workflows/pvs-studio-static-analysis.yml +++ b/.github/workflows/pvs-studio-static-analysis.yml @@ -101,11 +101,14 @@ jobs: # - We are the system headers: V677 Custom declaration of a standard '' type. The declaration from system header files should be used instead. # - We have no choice: V1061 Extending the 'std' namespace may result in undefined behavior. # - TRY(..) macro breaks this rule: V530 The return value of function 'release_value' is required to be utilized. - # - False positives: V1047 Lifetime of the lambda is greater than lifetime of the local variable captured by reference. + # - False positives: + # V1047 Lifetime of the lambda is greater than lifetime of the local variable captured by reference. + # V1076 Code contains invisible characters that may alter its logic. + # - name: Filter PVS Log working-directory: ${{ github.workspace }}/Build/${{ env.PVS_STUDIO_ANALYSIS_ARCH }} run: | - pvs-studio-analyzer suppress -v677 -v1061 -v530 -v1047 project.plog + pvs-studio-analyzer suppress -v677 -v1061 -v530 -v1047 -v1076 project.plog pvs-studio-analyzer filter-suppressed project.plog - name: Print PVS Log