github / github/codeql

False positive: Dereferenced variable may be null ignore NRT attributes

未關閉
#20,828 2 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
C# false-positive
主要語言
CodeQL
星號
10.1k
分支
2.1k
平均合併
2 天 15 小時
30 天內合併 PR
141

描述

**Description of the false positive**

NRT attributes appear to be ignored by CodeQL. This results in lots of noise as we have to explicitly mark each point of use as a false positive and so safe.

**Code samples or links to source code**

```cs
if (TryConvertContractState(tradingPhase, state, out Models.ContractState? contractState))
return contractState.Value;
```
when it is defined as:
```cs
private static bool TryConvertContractState(
string tradingPhase, string state,
[NotNullWhen(true)] out PersistedModels.ContractState? cdmState)
{}
```

**URL to the alert on GitHub code scanning (optional)**

Private Repo, but the view query source goes to: https://github.com/github/codeql/blob/aa3000df1310b332ba1c84afec3bacb0aeb4dbbd/csharp/ql/src/CSI/NullMaybe.ql

貢獻指南

開啟貢獻指南

研究方向

Start with csharp/ql/src/CSI/NullMaybe.ql, the query source linked in the report, and review how it handles the C# sample using [NotNullWhen(true)]. Reproduce the reported alert with the provided TryConvertContractState example; done means the valid contractState.Value dereference is no longer reported as a nullability issue.

由索引模型根據 Issue 內容生成。

評估

技術堆疊
csharp
領域
security
Issue 類型
缺陷
難度
4/5
預估耗時
3-5 天
活躍度
停滯
描述清晰度
基本清楚
新手友好度
38/100

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。