github / github/codeql

Java: `ReflectiveMethodAccess::inferAccessedMethod()` ignores parameters

未关闭
#13,490 2 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
question
主要语言
CodeQL
星标
10.1k
派生
2.1k
平均合并
2 天 15 小时
30 天内合并 PR
141

描述

The Java predicate `ReflectiveMethodAccess::inferAccessedMethod()` only checks the name of the method but ignores the parameters:
https://github.com/github/codeql/blob/04a7ff7f762cd11d9cba0ab864cc6bb909a830c8/java/ql/lib/semmle/code/java/Reflection.qll#L363-L366

This leads to incorrect results when a class declares multiple methods with the same name but different signature.

贡献指南

打开贡献指南

调研方向

Start in java/ql/lib/semmle/code/java/Reflection.qll at ReflectiveMethodAccess::inferAccessedMethod(), especially lines 363-366, and read how the predicate identifies methods. Check its behavior against a class with multiple methods sharing a name but having different signatures. Done means the inferred method distinguishes those overloads by their parameters rather than only by name.

由索引模型根据 Issue 内容生成。

评估

技术栈
java
领域
security, tooling
Issue 类型
缺陷
难度
3/5
预计耗时
1-2 天
活跃度
停滞
描述清晰度
描述清楚
新手友好度
45/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。