=== deprecates: S1956

=== on 8 Jan 2016, 16:14:26 Pierre-Yves Nicolas wrote:
The current message seems to imply that this rule should only be triggered if a SQL statement has a WHERE clause. However, if there is no WHERE clause, no index can be used.


Please note that we already have other rules (with a noticeable difference: they have no "threshold" parameter):

* RSPEC-1590 for DELETE and UPDATE with no WHERE clause (with a default severity set to major)
* RSPEC-1492 for SELECT with no WHERE clause (with a default severity set to critical)

=== on 8 Jan 2016, 17:19:24 Ann Campbell wrote:
\[~pierre-yves.nicolas] if this rule raises an issue on a missing ``++WHERE++`` clause, we'll get a double hit if RSPEC-1492 is also on (which is bad, IMO). But if we subsume RSPEC-1492 into this rule, then will ``++WHERE++``-less ``++SELECT++``s be found if no database information is available?


Regarding the differing severities of RSPEC-1590, and RSPEC-1492, ``++WHERE++``-less ``++SELECT++``s are widely regarded as security issues, but that's not the case for ``++WHERE++``-less ``++DELETE++`` and ``++UPDATE++`` statements. Unless I'm behind on my reading...

=== on 8 Jan 2016, 17:46:13 Pierre-Yves Nicolas wrote:
\[~ann.campbell.2] I'm fine to exclude statements without WHERE clause from this rule: I think that the description should then mention RSPEC-1492 and RSPEC-1590, perhaps in the "See also" section.



=== on 11 Jan 2016, 18:37:15 Ann Campbell wrote:
Done [~pierre-yves.nicolas] & assigning back to [~freddy.mallet] for his initial review.

