Skip to content

Reject unsafe typeof suppression in defensive.null-assumption rule - #149

Merged
alxxjohn merged 1 commit into
mainfrom
alexj/propose-fix-for-nullable-param-bypass
Aug 19, 2026
Merged

Reject unsafe typeof suppression in defensive.null-assumption rule#149
alxxjohn merged 1 commit into
mainfrom
alexj/propose-fix-for-nullable-param-bypass

Conversation

@alxxjohn

Copy link
Copy Markdown
Contributor

Motivation

  • The previous change treated any whole-function occurrence of typeof <param> ===/== as a null guard, which allows unsafe patterns like typeof x === "object" (note typeof null === "object") or non-dominating checks to suppress defensive.null-assumption findings.

Description

  • Remove the broad "typeof <name> ===" / "typeof <name> ==" entries from the nullable-parameter guard list in nullableParamGuarded so arbitrary whole-function typeof occurrences no longer count as guards.
  • Tighten nullableStatementUsesOnlyNullSafeOperators to preserve only safe, same-statement TypeScript narrowing patterns by matching a typeof-based ternary narrowing that directly dereferences the narrowed value in the same expression.
  • Add a regression test TestDefensiveNullAssumptionRejectsUnsafeTypeofGuards in tests/checks/quality_precision_followup_retune_test.go that asserts unsafe typeof usages (e.g. typeof user === 'object' and a late typeof after an unsafe dereference) still trigger defensive.null-assumption.
  • Modified files: internal/codeguard/checks/quality/quality_defensive.go and tests/checks/quality_precision_followup_retune_test.go.

Testing

  • Ran the focused test group with go test ./tests/checks -run 'TestDefensiveNullAssumption(CreditsTypeScriptNarrowing|RejectsUnsafeTypeofGuards)$' -count=1, which passed.
  • Ran full test suite with go test ./... after fixing test assertions, which completed successfully for the repository packages that include tests.
  • Applied gofmt -w to the modified files and validated git diff --check produced no whitespace issues during the edit cycle.

Codex Task

@alxxjohn
alxxjohn merged commit 1b6583b into main Aug 19, 2026
16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant