github / github/codeql

Java: Generic Class Methods not connected when type parameter is unknown (build-mode=none)

未關閉
#19,538 4 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
question
主要語言
CodeQL
星號
10.1k
分支
2.1k
平均合併
2 天 15 小時
30 天內合併 PR
141

描述

The introduction of `build-mode=none` has been very helpful for us. This allows us to create (partial) CodeQL databases, without being forced to fully resolve (maven) dependencies. Sometimes this is convenient because some dependencies might not be easily resolvable.

That said, we also see many examples of Generic Classes and Methods in our codebases. Unfortunately, we cannot analyse (calls to) Generic Methods that are instantiated with type parameters that are unknown.

Note that, while the code of the type parameter `T` is unavailable, the code of the `GenericClass` *is* available.

## Example pseudo code
```
class GenericClass {
public method() { ... };
};

GenericClass i1 = new GenericClass<>();
i1.method(); // not connected
GenericClass i2 = new GenericClass<>();
i2.method(); // connected
```

See attached [codeql_issue.zip](https://github.com/user-attachments/files/20345107/codeql_issue.zip) zip file for a more thorough analysis of the issue.

貢獻指南

開啟貢獻指南

研究方向

先解壓附加的 codeql_issue.zip,並在 build-mode=none 下比較已連接的 Boolean 實體化與未連接的未知型別實體化。該 issue 未列出原始碼檔案或測試,因此請從重現案例追蹤相關的 Java 分析進入點。當對 GenericClass.method() 的呼叫能像帶有已知型別參數的呼叫一樣建立連接時,即表示完成。

由索引模型根據 Issue 內容生成。

評估

技術堆疊
java
領域
devtools
Issue 類型
缺陷
難度
4/5
預估耗時
3-5 天
活躍度
停滯
描述清晰度
基本清楚
新手友好度
35/100

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。