Filtering Embedded String Errors via Methods

The String Method Filters category provides another means of filtering certain strings from the embedded strings errors reports. Instead of filtering them based upon patterns they contain, this category filters strings from the report based on methods, functions or constructors into which they are passed.

Your code is likely contains many method or functions that are passed string arguments. When you are sure that any string passed into function X is never displayed to the user, you can add the name of function X within the Method/Function Filters list and whenever Globalyzer sees that a string literal is passed as an argument to function X, it will ignore that string. In other words, it won't list it as a string that should be externalized into a resource file.

For example, the Java method:

javax.servlet.http.HTTPServletRequest.getParameter(String s)

is in the list above, because although it takes a string argument, this string would never appear as text visible to an end user.

To deselect a method filter, uncheck the box and click the Save button at the bottom of the page.

To edit an existing method filter, click on its Filter Pattern hyperlink. To add a customized method filter, click the Add New button at the bottom of the page. The result from either of these two operations is that the Add/Edit String Method Filter page displays.

The Add/Edit page that displays contains three fields that are used to describe a rule: Name, Pattern, and Description. In the case of an existing Method Filter, you'll only be able to modify the Name and Description fields. Use the Name field to give your pattern a brief, meaningful name. Use the Description field to (1) enter a more indepth explanation of the pattern, (2) understand the reason for its inclusion in the scan, and/or (3) describe a process to correct the problem.

The method-name rules added to this category are technically regular expressions, but Globalyzer uses internal algorithms along with the expression to determine whether strings are being passed into these methods. For this reason there are rules that must be followed when adding to the list.

• Do not add trailing parenthesis or any text after the method name itself.
• Globalyzer matches the exact text of the rule. So if you need to include the calling object, it must be the variable name exactly as it exists in the code, not the class name or fully qualified class name.

Let's say you have a class called ShoppingCart and it has a member method setKey. This method takes a string argument and you want to make sure Globalyzer ignores strings passed to the ShoppingCart.setKey method. You first need to confirm that ShoppingCart is instantiated with the same variable name throughout the code that you are scanning or create a separate rule for each ShoppingCart variable name. If in your code you have:

ShoppingCart cart = new ShoppingCart();
cart.setKey("books");

The pattern that you would enter in Add/Edit String Method Filter page would be:

cart\.setKey

The image above shows the complete entry for the new setKey Method Filter.

• Note that when you include a variable name prior to the method name, you must escape any regex special characters such as the dot in this example.
• This type of filtering is available for JavaScript but it is much more efficient and accurate if you use semicolons as statement delimiters in your javascript code.
• For more information on Regular Expression syntax, click here.

Once you've added or modified a String Method Filter, click the OK button. The Method/Function Filters List redisplays, showing your changes.

In this example, the new method filter appears in the list with its checkbox selected. Click the Save button for the changes to take effect, and then the Back to Summary link to return to the Configure I18N Rule Set page.