github / github/codeql

False positive, java/unused-reference-type and JUnit 5 classes

Open
#11,989 2 comments 1 reaction 0 assignees View on GitHub
false-positive
Dominant language
CodeQL
Stars
10.1k
Forks
2.1k
Avg merge
2d 15h
Merged PRs (30d)
141

Description

JUnit Tests using JUnit 5 are reported as java/unused-reference-type. This is because the JUnit 5 convention is to use package scoped class and method names. This rule should be checking for methods with JUnit annotations (e.g. `@Test`, `@BeforeEach`, `@ParameterizedTest`). The [current check](https://github.com/github/codeql/blob/3059ce307009d40afb690aa712c96e422cf76753/java/ql/src/Violations%20of%20Best%20Practice/Dead%20Code/DeadRefTypes.ql#L44:L45) only looks for subsclassing of TestCase, which hasn't been applicable since JUnit 4.

**Code samples or links to source code**

Example test code that would be reported as unused.
```
class MyTest
{
@Test
void test()
{
// some test code.
}
}
```
Example false positive.
https://github.com/real-logic/aeron/security/code-scanning/1583

Contributor guide

Open the contributing guide

Research direction

Read java/ql/src/Violations of Best Practice/Dead Code/DeadRefTypes.ql around the current TestCase check, then inspect the query's existing tests and run the relevant CodeQL test suite. Done means JUnit 5 classes with annotations such as @Test, @BeforeEach, or @ParameterizedTest are no longer reported as unused reference types, while the existing detection still works.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
devtools, testing-qa
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.