Numerous checker options let you adjust the checker's behavior. The most common reason for using these options is to reduce the number of false positives or false negatives.
Use case: Set the CSRF checker's filter option to detect
Java servlet and ASP.NET MVC filters.
For example, in analyses of Java source, the CSRF checker has been returning false
positives because it fails to detect filters that validate cross-site request tokens. By
explicitly naming the filters that do so, the filter option eliminates
these kinds of false positives.
Use case: Turn off the BAD_FREE checker's allow_first_field
option so the checker will report the freeing of a C/C++ structure's first
field.
Freeing the address of the first field of a C/C++ structure causes no harm, as the pointer is
equivalent to a pointer to the entire structure. However, it might indicate an error in logic.
Turning off allow_first_field enables reporting such an occurrence as a defect, so
developers can double check these situations.
Learn more: The chapter "Coverity Analysis checkers" in the Coverity Checker Reference describes each built-in checker and the options that the checker can use. For more information about tainted data options, see Tainted data overview.