github / github/codeql

False positive - cs/unused-reftype - C#

Abierto
#15,278 1 comentario 0 reacciones 0 asignados Ver en GitHub
acknowledged C# false-positive not security
Lenguaje dominante
CodeQL
Estrellas
10.1k
Forks
2.1k
Merge medio
2 d 15 h
PR fusionados (30 d)
141

Descripción

Hello! Here an explanation of the false positive found in our C# projects.

**Description of the false positive**

The false positives involve cs/unused-reftype, with specific query DeadRefTypes.ql. This query should search for NON public and NON used reference types (classes or interfaces).
Looking at the query, we can find that the filter is properly well formed https://github.com/github/codeql/blob/main/csharp/ql/src/Dead%20Code/DeadRefTypes.ql with the line "not (t.isPublic() or t.isProtected())".

The fact is that codeql creates a lot of issues with this query that are absolutely not compliant with these specifications (they are public or internal classes/interfaces and also used).

Another strange thing is that some reference types are written as array "[]". For example, there is a public class Foo that is used, the report says "Unused reference type Foo[]." that is completely wrong.

**Code samples**

`public class SomeClass`

Report: "Unused reference type SomeClass[]."

Also:

`public class AnotherClass`

Report: "Unused reference type AnotherClass"

Guía de contribución

Abrir la guía de contribución

Línea de trabajo

Start by reading csharp/ql/src/Dead Code/DeadRefTypes.ql, especially the DeadRefTypes.ql query and its public/protected filter. Reproduce the reported cases with public or used reference types, including the SomeClass[] output, and verify that the query reports only genuinely unused non-public reference types without incorrect array names.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
csharp
Área
devtools
Tipo de issue
Error
Dificultad
3/5
Tiempo estimado
1-2 días
Estado de actividad
Estancado
Claridad
Bastante claro
Aptitud para principiantes
35/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.