Path reachability check
Decides whether the triggering state can reach the flagged line on this code path, given guards, early returns and types.
Sub-techniques
2
| ID | Name | Description |
|---|---|---|
V1043.001 | Guard analysis | Find early returns, enclosing conditions and defaults that exclude the trigger. |
V1043.002 | Caller analysis | Find a real caller, config or workflow that produces the triggering state. |
Craft it
- For each finding, list the callers of the flagged function.
- Check each caller for guards that exclude the trigger.
- Mark findings with no established producer as unestablished, not confirmed.
Reverse engineer it
Signs that a codebase already runs this technique, and where to read how it is configured.
- Static analyzer configs with path-sensitive checks enabled.