github / github/codeql

False Negative : CloseSql.ql cannot detect bugs in the Try-Catch block.

Aperta
#21,393 2 commenti 0 reazioni 0 assegnatari Vedi su GitHub
question
Lingua principale
CodeQL
Stelle
10.1k
Fork
2.1k
Merge medio
2g 15h
PR unite (30g)
141

Descrizione

**Version**
codeql 2.23.9
**Description of the issue**
When I used java/Likely Bugs/Resource Leaks/CloseSql.ql to check the following code, it correctly reported an issue of improper use of createStatement.
```java

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.SQLException;
import java.sql.Statement;
public class PosCase3 {
public void test() throws SQLException {
// Scenario 3: Primary resource assigned
Connection conn = DriverManager.getConnection("url", "user", "pass");
// Secondary created from primary, not assigned, not closed
conn.createStatement(); // [REPORTED LINE]
// Secondary Statement leak -> Positive detection.
}
}

```

However, when using CloseSql.ql to detect the following code, no bug were detected and no bug were reported.

```java
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.SQLException;
import java.sql.Statement;
import java.util.function.Supplier;
public class PosCase3_Var3 {
public void test() throws SQLException {
// Variant 3: Use Supplier to defer creation, then discard
Connection conn = DriverManager.getConnection("url", "user", "pass");
Supplier supplier = () -> {
try {
return conn.createStatement();
} catch (SQLException e) {
throw new RuntimeException(e);
}
};
supplier.get(); // Statement created and leaked
}
}

```

Guida per i contributori

Apri la guida per i contributori

Direzione di ricerca

Start by reading the Java resource-leak query in CloseSql.ql and compare its handling of the direct createStatement case with the Supplier example's try-catch block. Done means the query reports the discarded Statement created by supplier.get() while preserving the existing detection.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
java
Ambito
security
Tipo di issue
Bug
Difficoltà
4/5
Tempo stimato
3-5 giorni
Stato di attività
Ferma
Chiarezza
Abbastanza chiara
Idoneità per principianti
48/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.