Sonar-dotnet: S2583 on 'is' condition

[marco6]

Description

C# sonar analyzer reports S2583 even if it is no the case.

Repro steps

public static string Test(object value) {
  if (value is bool boolValue && !boolValue) {
    return "Valid";
  }
  return "Not Valid";
}

Expected behavior

The condition can be true, depending on input. It should not be a bug.

Actual behavior

The condition is marked as a bug.

Known workarounds

Please provide a description of any known workarounds.

Related information

• C#/VB.NET Plugins Version

• Visual Studio Version
  Visual Studio Community 19

• MSBuild / dotnet version
  16.5.0.12403
• If running through the Scanner for MSBuild, its version
  sonar-scanner-msbuild-4.7.1.2311-net46
• Operating System
  windows

[costin-zaharia-sonarsource]

Hi @marco6,

Rule S2255 is a security hotspot related to cookies: "Writing cookies is security-sensitive" but the code from the repro steps doesn't seem related to cookies nor does it raises issues for this rule. Could it be that you used a wrong id?

Thank you

[marco6]

Sure I have! That was the code line... I will edit asap: the real code was S2583...

[costin-zaharia-sonarsource]

Hi @marco6

Thanks for the quick reply. I can confirm the problem and the fact that we generate a false positive in this case.

Since we have already a very similar issue: https://github.com/SonarSource/sonar-dotnet/issues/3110 I will close this one as a duplicate.

[marco6]

Yeah, I missed that because I had the issue id wrong. Thank you for your time!

[costin-zaharia-sonarsource]

Thank you for taking time to report this. Feedback is appreciated and considered since we try to prioritize first the issues with biggest impact (e.g. the ones which affect more users).