github / github/codeql

False positive: Dereferenced variable may be null ignore NRT attributes

Ouverte
#20,828 2 commentaires 0 réactions 0 personnes assignées Voir sur GitHub
C# false-positive
Langage dominant
CodeQL
Étoiles
10.1k
Forks
2.1k
Merge moyen
2 j 15 h
PR mergées (30 j)
141

Description

**Description of the false positive**

NRT attributes appear to be ignored by CodeQL. This results in lots of noise as we have to explicitly mark each point of use as a false positive and so safe.

**Code samples or links to source code**

```cs
if (TryConvertContractState(tradingPhase, state, out Models.ContractState? contractState))
return contractState.Value;
```
when it is defined as:
```cs
private static bool TryConvertContractState(
string tradingPhase, string state,
[NotNullWhen(true)] out PersistedModels.ContractState? cdmState)
{}
```

**URL to the alert on GitHub code scanning (optional)**

Private Repo, but the view query source goes to: https://github.com/github/codeql/blob/aa3000df1310b332ba1c84afec3bacb0aeb4dbbd/csharp/ql/src/CSI/NullMaybe.ql

Guide de contribution

Ouvrir le guide de contribution

Piste de recherche

Start with csharp/ql/src/CSI/NullMaybe.ql, the query source linked in the report, and review how it handles the C# sample using [NotNullWhen(true)]. Reproduce the reported alert with the provided TryConvertContractState example; done means the valid contractState.Value dereference is no longer reported as a nullability issue.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Évaluation

Stack technique
csharp
Domaine
security
Type d'issue
Bug
Difficulté
4/5
Temps estimé
3-5 jours
Activité
À l'abandon
Clarté
Plutôt claire
Accessibilité débutants
38/100

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.