github / github/codeql

False positive - cs/unused-reftype - C#

未關閉
#15,278 1 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
acknowledged C# false-positive not security
主要語言
CodeQL
星號
10.1k
分支
2.1k
平均合併
2 天 15 小時
30 天內合併 PR
141

描述

Hello! Here an explanation of the false positive found in our C# projects.

**Description of the false positive**

The false positives involve cs/unused-reftype, with specific query DeadRefTypes.ql. This query should search for NON public and NON used reference types (classes or interfaces).
Looking at the query, we can find that the filter is properly well formed https://github.com/github/codeql/blob/main/csharp/ql/src/Dead%20Code/DeadRefTypes.ql with the line "not (t.isPublic() or t.isProtected())".

The fact is that codeql creates a lot of issues with this query that are absolutely not compliant with these specifications (they are public or internal classes/interfaces and also used).

Another strange thing is that some reference types are written as array "[]". For example, there is a public class Foo that is used, the report says "Unused reference type Foo[]." that is completely wrong.

**Code samples**

`public class SomeClass`

Report: "Unused reference type SomeClass[]."

Also:

`public class AnotherClass`

Report: "Unused reference type AnotherClass"

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。