Fix #100 - Added new rule G-9040: Try using FX in string to date/time conversion format model to avoid fuzzy conversion.

Author: kibeha

docs/4-language-usage/9-function-usage/g-9010.md

@@ -32,7 +32,7 @@ create package body employee_api is
                     ,in_dob_str     in varchar2) is
    begin
       update employees
-         set date_of_birth = to_date(in_dob_str,'YYYY-MM-DD')
+         set date_of_birth = to_date(in_dob_str,'FXYYYY-MM-DD')
        where employee_id = in_employee_id;
    end set_dob;
 end employee_api;

docs/4-language-usage/9-function-usage/g-9040.md

@@ -0,0 +1,42 @@
+# G-9040: Try using FX in string to date/time conversion format model to avoid fuzzy conversion.
+
+!!! tip "Minor"
+    Reliability, Testability
+
+## Reason
+
+The default [string-to-date conversion rules](https://docs.oracle.com/en/database/oracle/oracle-database/21/sqlrf/Format-Models.html#GUID-5B755E80-3CB2-4901-BBCF-F0FC764E0BB5) allow fuzzy conversion when converting from strings to `date` or `timestamp` datatypes (using `to_date`, `to_timestamp`, `to_timestamp_tz` or `cast` to any of those datatypes). For example you can omit punctuation characters, use any non-alphanumeric character for punctuation, use month name instead of number, or various other rules.
+
+In practice you almost always expect a truly fixed format and want the database to enforce the format model and raise an error if the data does not match the format model. This you can achieve by adding the format modifier FX (format exact).
+
+The exception to this rule can be if you are converting textual input typed by a user, in which case the fuzzy conversion may be what you want.
+
+## Example (bad)
+
+``` sql
+create package body employee_api is
+   procedure set_dob(in_employee_id in employees.employee_id%type
+                    ,in_dob_str     in varchar2) is
+   begin
+      update employees
+         set date_of_birth = to_date(in_dob_str,'YYYY-MM-DD')
+       where employee_id = in_employee_id;
+   end set_dob;
+end employee_api;
+/
+```
+
+## Example (good)
+
+``` sql
+create package body employee_api is
+   procedure set_dob(in_employee_id in employees.employee_id%type
+                    ,in_dob_str     in varchar2) is
+   begin
+      update employees
+         set date_of_birth = to_date(in_dob_str,'FXYYYY-MM-DD')
+       where employee_id = in_employee_id;
+   end set_dob;
+end employee_api;
+/
+```

docs/9-appendix/appendix.md

@@ -130,3 +130,4 @@ n/a | 8510 | Always use dbms_application_info to track program process transient
 n/a | 9010 | Always use a format model in string to date/time conversion functions. | Major | ✘ |  | ✘ |  | ✘ |  | ✘ | ✘
 n/a | 9020 | Try to use a format model and NLS_NUMERIC_CHARACTERS in string to number conversion functions. | Major | ✘ |  | ✘ |  | ✘ |  | ✘ | ✘
 n/a | 9030 | Try to define a default value on conversion errors. | Minor |  |  | ✘ |  | ✘ |  |  | ✘
+n/a | 9040 | Try using FX in string to date/time conversion format model to avoid fuzzy conversion. | Minor |  |  |  |  | ✘ |  |  | ✘