github / github/codeql

False Negative: ConstantExpAppearsNonConstant.ql misses expressions that stay constant after trivial local rewrites.

Open
#21,536 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
CodeQL
Stars
10.1k
Forks
2.1k
Avg merge
2d 15h
Merged PRs (30d)
141

Description

Version
codeql 2.24.3

## Checker
- Checker id: `Likely Bugs/Arithmetic/ConstantExpAppearsNonConstant.ql`
- Checker description: This checker detects expressions that always evaluate to the same constant value but are not recognized as compile-time constants by the compiler, often due to containing non-constant sub-expressions that don't affect the final result.

## Description of the false negative
These cases still reduce to a constant result at runtime. One multiplies by zero. The others use `true || condition`, which is still always true regardless of the non-constant boolean input.

The only change is that the constant-looking behavior is expressed through locals or a slightly different spelling.

## Affected test cases
### `PosCase1.java`
`nonConstant * 0` still evaluates to zero regardless of the non-constant operand.

### `PosCase3_Var1.java` and `PosCase3_Var2.java`
Both variants are still logical constants. `Boolean.TRUE || condition` and `alwaysTrue || condition` should both be recognized as always true.

## Cause analysis
This looks like a propagation gap. `Likely Bugs/Arithmetic/ConstantExpAppearsNonConstant.ql` appears to lose the constant result once the expression is one step less direct, even though the same algebraic reasoning still applies.

That makes the query miss a kind of bug it should be well suited to catch.

## Reproduction code
### `PosCase1.java`
```java
// Multiplication by zero with integer literal zero operand should be flagged as always evaluating to zero.
package scensct.core.pos;

public class PosCase1 {
public PosCase1() {
int nonConstant = getNonConstant(); // Non-constant subexpression
int result = nonConstant * 0; // Multiplication by zero, always zero
// Use result in a conditional to emphasize constant evaluation
if (result == 0) {
// This branch is always taken
System.out.println("Always zero");
}
}

private int getNonConstant() {
return (int) (Math.random() * 100); // Non-constant value
}
}
```

## References
None known.

Contributor guide

Open the contributing guide

Research direction

Start with Likely Bugs/Arithmetic/ConstantExpAppearsNonConstant.ql and inspect how it propagates constant results through local variables and rewritten expressions. Review PosCase1.java, PosCase3_Var1.java, and PosCase3_Var2.java as the affected examples. Done means the query recognizes the described constant expressions without losing the existing detection behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.