github / github/codeql

False negative: DoubleCheckedLocking.ql cannot detect scenarios with ternary expressions.

Abierto
#21,395 2 comentarios 0 reacciones 0 asignados Ver en GitHub
question
Lenguaje dominante
CodeQL
Estrellas
10.1k
Forks
2.1k
Merge medio
2 d 15 h
PR fusionados (30 d)
141

Descripción

**Version**
codeql 2.23.9
**Description of the issue**
When I detect the code like this using java/Likely Bugs/Concurrency/DoubleCheckedLocking.ql, the problem is reported normally:
```java

public class PosCase1 {
private Object instance; // Non-volatile field
public Object getInstance() {
if (instance == null) { // First null check
synchronized (this) { // [REPORTED LINE]
if (instance == null) { // Second null check inside synchronized block
instance = new Object(); // Initialization
}
}
}
return instance; // Return after double-checked locking
}
}
```

However, when ternary expressions are introduced into the code, DoubleCheckedLocking.ql fails to detect the problem:
```java
public class PosCase1_Var1 {
private Object instance; // Non-volatile field
public Object getInstance() {
// Use ternary for outer check, but preserve unsafe pattern
return (instance != null) ? instance : createInstance();
}
private Object createInstance() {
synchronized (this) {
if (instance == null) {
instance = new Object();
}
return instance;
}
}
}
```
These two code snippets are semantically identical, only using a ternary expression with some transformations, which is why DoubleCheckedLocking.ql cannot detect the problem.

Guía de contribución

Abrir la guía de contribución

Línea de trabajo

Start with java/Likely Bugs/Concurrency/DoubleCheckedLocking.ql and reproduce the two Java snippets from the issue to compare query results. Done means the query reports the unsafe ternary-based double-checked locking scenario while continuing to report the existing direct pattern.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
java
Área
devtools, security
Tipo de issue
Error
Dificultad
4/5
Tiempo estimado
3-5 días
Estado de actividad
Estancado
Claridad
Bastante claro
Aptitud para principiantes
38/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.