Provide a mechanism by which false positives may be suppressed. about go-flow-levee

[PurelyApplied]

I think, for the scope of the 1.0 Milestone, we exclusion introduced by #127 satisfies this Issue. I've opened #198 as a continuation outside the scope of the milestone, if we wish to proceed with finer-grained, comment-based suppression.

[mlevesquedion]

I'm having a hard time seeing exactly how users would define an allowlist. Would users write source code positions in a file? It sounds like that would probably lead to a fair amount of toil for users. Did you have a different idea in mind?

To me code comments make the most sense because I think they are simpler for users to introduce and to maintain. I think out-of-scope findings will be avoided via #88. I'm not sure how false positives in generated code would be handled though. Perhaps we could provide users with a way to exclude files via some naming pattern.

[mlevesquedion]

Whatever mechanism we choose, I'm concerned that allowing users to suppress false positives may lead to some issues going undetected, e.g. if levee reports a false positive on a given line of code, the user suppresses it through e.g. a comment, and later on the line of code is changed and becomes a true positive, but because of the suppression levee does not report it.

[mlevesquedion]

A built-in way for users to suppress false positives would be to use a sanitizer. We may choose to advertise this or not. Some pros and cons to using sanitizers to suppress false positives:

Pros:

• Requires no extra work from us, since this is already supported.
• Simple for users, since they don't need to learn a new concept/mechanism.

Cons:

• Suppressing false positives is not what sanitizers are intended for. Users may create a "do nothing" sanitizer that does not actually do any sanitization and is intended merely to suppress false positives, which could lead to true positives being missed if it is used improperly. (We cannot prevent users from doing this, but we could warn against doing this in the documentation).
• We don't currently have a way to report that using a sanitizer in a given piece of code was not necessary, and I think it is unlikely that we will develop such a feature. Over time, a code base could accumulate unnecessary sanitizing calls.

[mlevesquedion]

The staticcheck tool uses code comments to suppress false positives. Details here. Summary:

• False positives on a line can be suppressed via a code comment on the preceding line. Unnecessary suppressions are reported.
• False positives in an entire file can similarly be suppressed via a code comment. This is especially helpful for generated code.