False Negative: ConstantExpAppearsNonConstant.ql misses expressions that stay constant after trivial local rewrites.
- Lingua principale
- CodeQL
- Stelle
- 10.1k
- Fork
- 2.1k
- Merge medio
- 2g 15h
- PR unite (30g)
- 141
Descrizione
Version
codeql 2.24.3
## Checker
- Checker id: `Likely Bugs/Arithmetic/ConstantExpAppearsNonConstant.ql`
- Checker description: This checker detects expressions that always evaluate to the same constant value but are not recognized as compile-time constants by the compiler, often due to containing non-constant sub-expressions that don't affect the final result.
## Description of the false negative
These cases still reduce to a constant result at runtime. One multiplies by zero. The others use `true || condition`, which is still always true regardless of the non-constant boolean input.
The only change is that the constant-looking behavior is expressed through locals or a slightly different spelling.
## Affected test cases
### `PosCase1.java`
`nonConstant * 0` still evaluates to zero regardless of the non-constant operand.
### `PosCase3_Var1.java` and `PosCase3_Var2.java`
Both variants are still logical constants. `Boolean.TRUE || condition` and `alwaysTrue || condition` should both be recognized as always true.
## Cause analysis
This looks like a propagation gap. `Likely Bugs/Arithmetic/ConstantExpAppearsNonConstant.ql` appears to lose the constant result once the expression is one step less direct, even though the same algebraic reasoning still applies.
That makes the query miss a kind of bug it should be well suited to catch.
## Reproduction code
### `PosCase1.java`
```java
// Multiplication by zero with integer literal zero operand should be flagged as always evaluating to zero.
package scensct.core.pos;
public class PosCase1 {
public PosCase1() {
int nonConstant = getNonConstant(); // Non-constant subexpression
int result = nonConstant * 0; // Multiplication by zero, always zero
// Use result in a conditional to emphasize constant evaluation
if (result == 0) {
// This branch is always taken
System.out.println("Always zero");
}
}
private int getNonConstant() {
return (int) (Math.random() * 100); // Non-constant value
}
}
```
## References
None known.
Guida per i contributori
Apri la guida per i contributori
Direzione di ricerca
Inizia con Likely Bugs/Arithmetic/ConstantExpAppearsNonConstant.ql e analizza come propaga i risultati costanti attraverso le variabili locali e le espressioni riscritte. Esamina PosCase1.java, PosCase3_Var1.java e PosCase3_Var2.java come esempi interessati. Il lavoro è completato quando la query riconosce le espressioni costanti descritte senza perdere il comportamento di rilevamento esistente.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Valutazione
- Stack tecnologico
- java
- Ambito
- security
- Tipo di issue
- Bug
- Difficoltà
- 4/5
- Tempo stimato
- 3-5 giorni
- Stato di attività
- Tranquilla
- Chiarezza
- Abbastanza chiara
- Idoneità per principianti
- 48/100