From cb7f1ae838c828515aefee67cc9c0e0b547dbcfc Mon Sep 17 00:00:00 2001 From: Niels Lohmann Date: Thu, 9 Jul 2026 21:22:32 +0200 Subject: [PATCH] Avoid strlen() in test container to fix Codacy CWE-126 flag Suppressing the strlen()-based CWE-126 warning with NOLINT/nosec comments only silenced clang-tidy and the standalone Flawfinder Action; Codacy's own analysis (which also flags this pattern and doesn't honor those suppression comments) still reported it as a new issue, plus flagged the near-duplicate begin/end pair as cloned code. Store the buffer's size explicitly in MyContainerNonConstADL instead of computing it via strlen() in end(), which removes the flagged pattern outright and also de-duplicates the struct from the existing MyContainer's char*-based begin/end pair. Signed-off-by: Niels Lohmann --- tests/src/unit-user_defined_input.cpp | 41 +++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/tests/src/unit-user_defined_input.cpp b/tests/src/unit-user_defined_input.cpp index 56446ea94..91539476d 100644 --- a/tests/src/unit-user_defined_input.cpp +++ b/tests/src/unit-user_defined_input.cpp @@ -54,6 +54,47 @@ TEST_CASE("Custom container non-member begin/end") } +struct MyContainerNonConstADL +{ + char* data; + std::size_t size; +}; + +char* begin(MyContainerNonConstADL& c) +{ + return c.data; +} + +char* end(MyContainerNonConstADL& c) +{ + return c.data + c.size; // NOLINT(cppcoreguidelines-pro-bounds-pointer-arithmetic) +} + +TEST_CASE("Custom container non-member non-const begin/end") +{ + // Container with lvalue-only non-const ADL begin/end (bug reproduction) + char raw_data[] = "[1,2,3,4]"; + MyContainerNonConstADL data{raw_data, sizeof(raw_data) - 1}; + const json as_json = json::parse(data); + CHECK(as_json.at(0) == 1); + CHECK(as_json.at(1) == 2); + CHECK(as_json.at(2) == 3); + CHECK(as_json.at(3) == 4); + + // Same container with accept() + CHECK(json::accept(data)); +} + +TEST_CASE("Custom container non-member begin/end, rvalue") +{ + // Regression check: rvalue container parsing should still work + const json as_json = json::parse(MyContainer{"[1,2,3,4]"}); + CHECK(as_json.at(0) == 1); + CHECK(as_json.at(1) == 2); + CHECK(as_json.at(2) == 3); + CHECK(as_json.at(3) == 4); +} + TEST_CASE("Custom container member begin/end") { struct MyContainer2