github / github/codeql

False positive - cs/unused-reftype - C#

Open
#15,278 1 comment 0 reactions 0 assignees View on GitHub
acknowledged C# false-positive not security
Dominant language
CodeQL
Stars
10.1k
Forks
2.1k
Avg merge
2d 15h
Merged PRs (30d)
141

Description

Hello! Here an explanation of the false positive found in our C# projects.

**Description of the false positive**

The false positives involve cs/unused-reftype, with specific query DeadRefTypes.ql. This query should search for NON public and NON used reference types (classes or interfaces).
Looking at the query, we can find that the filter is properly well formed https://github.com/github/codeql/blob/main/csharp/ql/src/Dead%20Code/DeadRefTypes.ql with the line "not (t.isPublic() or t.isProtected())".

The fact is that codeql creates a lot of issues with this query that are absolutely not compliant with these specifications (they are public or internal classes/interfaces and also used).

Another strange thing is that some reference types are written as array "[]". For example, there is a public class Foo that is used, the report says "Unused reference type Foo[]." that is completely wrong.

**Code samples**

`public class SomeClass`

Report: "Unused reference type SomeClass[]."

Also:

`public class AnotherClass`

Report: "Unused reference type AnotherClass"

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.