Re:Disable comments make static analysis tools worse
by bluGill on Tuesday July 06, 2021 @09:17AM
(#27748097)
No, you need tools that recognize that those are third party and so should not be analyzed. You identified there is a missing feature in your tools, but not that right missing feature. This mistake is all too easy to make, and the results are costly when you get the wrong feature.
Re:Disable comments make static analysis tools worse
by gempir on Tuesday July 06, 2021 @09:43AM
(#27748391)
Why is the interface to a third party library not to be analyzed?
I'll have to use it anyway so this way at least I can be more sure when calling the API what I need to pass or not.
I mean all of that applies to any library you ever import. You still have control over it in the means of commit hashes etc, so it won't randomly break. So it makes sense documenting the API for yourself if there is no documentation.
Re:Disable comments make static analysis tools worse
by bluGill on Tuesday July 06, 2021 @10:20AM
(#27748965)
Because you can't safely change it and also take the next upstream release. Either you live with whatever interface they give you, or you don't use it at all. Any change you make will be lost when they release an update with something else you need (perhaps a security fix).
Now you can wrap the library if you want so that only the wrapper as to use the bad API. There are pros and cons to this.
You need disable comments, but they need to be very fine grained by default.
I'm thinking of several very relevant cases for disable comments. Like your first example of the camelCase issue is very real to me.
We are served JavaScript from a third party that we have little to no control over, I want to type that JS with Typescript. So I created some .d.ts files. But they use snake_case for their function names.
When I then type those functions, I get complains from my linter that it's not camel case. This is where I need my escape hatch.