github / github/codeql

False positive - cs/unused-reftype - C#

Aberta
#15,278 1 comentário 0 reações 0 responsáveis Ver no GitHub
acknowledged C# false-positive not security
Linguagem predominante
CodeQL
Estrelas
10.1k
Forks
2.1k
Merge médio
2d 15h
PRs com merge (30d)
141

Descrição

Hello! Here an explanation of the false positive found in our C# projects.

**Description of the false positive**

The false positives involve cs/unused-reftype, with specific query DeadRefTypes.ql. This query should search for NON public and NON used reference types (classes or interfaces).
Looking at the query, we can find that the filter is properly well formed https://github.com/github/codeql/blob/main/csharp/ql/src/Dead%20Code/DeadRefTypes.ql with the line "not (t.isPublic() or t.isProtected())".

The fact is that codeql creates a lot of issues with this query that are absolutely not compliant with these specifications (they are public or internal classes/interfaces and also used).

Another strange thing is that some reference types are written as array "[]". For example, there is a public class Foo that is used, the report says "Unused reference type Foo[]." that is completely wrong.

**Code samples**

`public class SomeClass`

Report: "Unused reference type SomeClass[]."

Also:

`public class AnotherClass`

Report: "Unused reference type AnotherClass"

Guia de contribuição

Abrir o guia de contribuição

Avaliação

Esta issue ainda não foi avaliada.

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.