False Positive: DoNotCallFinalize.ql cannot detect 'finalize()' in the function call chain.
- 主要言語
- CodeQL
- スター
- 10.1k
- フォーク
- 2.1k
- 平均マージ
- 2日 15時間
- マージ済み PR(30日)
- 141
説明
**Version**
2.23.9
**Description of the false positive**
When I use java/Violations of Best Practice/Undesirable Calls/DoNotCallFinalize.ql to detect the code as below, it passes normally.
```java
public class NegCase2 {
@Override
protected void finalize() throws Throwable {
// Override of finalize with super.finalize call is allowed.
super.finalize();
}
}
```
However, when I put "super.finalize();" into another function for calling, DoNotCallFinalize.ql reported a problem.
```java
public class NegCase2_Var3 {
// Helper method to encapsulate the call
private void callSuperFinalize() throws Throwable {
super.finalize(); // [REPORTED LINE]
}
@Override
protected void finalize() throws Throwable {
// Delegate to helper
callSuperFinalize();
}
}
```
These two code snippets are essentially the same and should both pass the test.
コントリビューションガイド
調査の方向性
Start with java/Violations of Best Practice/Undesirable Calls/DoNotCallFinalize.ql and compare how it handles the direct super.finalize() call with the same call inside callSuperFinalize(). Run the query against both snippets; done means the helper-method version is treated consistently with the direct call and is no longer reported.
索引モデルが issue の本文から書いたものです。
評価
- 技術スタック
- java
- 領域
- security
- issue の種類
- バグ
- 難易度
- 3/5
- 見積もり時間
- 1〜2日
- 活発さ
- 停滞
- 明瞭さ
- 明確に書かれている
- 初心者へのやさしさ
- 55/100