False Negative: ConstantExpAppearsNonConstant.ql misses expressions that stay constant after trivial local rewrites.
- Ngôn ngữ chính
- CodeQL
- Star
- 10.1k
- Fork
- 2.1k
- Merge trung bình
- 2 ngày 15 giờ
- Pull request đã merge (30 ngày)
- 141
Mô tả
Version
codeql 2.24.3
## Checker
- Checker id: `Likely Bugs/Arithmetic/ConstantExpAppearsNonConstant.ql`
- Checker description: This checker detects expressions that always evaluate to the same constant value but are not recognized as compile-time constants by the compiler, often due to containing non-constant sub-expressions that don't affect the final result.
## Description of the false negative
These cases still reduce to a constant result at runtime. One multiplies by zero. The others use `true || condition`, which is still always true regardless of the non-constant boolean input.
The only change is that the constant-looking behavior is expressed through locals or a slightly different spelling.
## Affected test cases
### `PosCase1.java`
`nonConstant * 0` still evaluates to zero regardless of the non-constant operand.
### `PosCase3_Var1.java` and `PosCase3_Var2.java`
Both variants are still logical constants. `Boolean.TRUE || condition` and `alwaysTrue || condition` should both be recognized as always true.
## Cause analysis
This looks like a propagation gap. `Likely Bugs/Arithmetic/ConstantExpAppearsNonConstant.ql` appears to lose the constant result once the expression is one step less direct, even though the same algebraic reasoning still applies.
That makes the query miss a kind of bug it should be well suited to catch.
## Reproduction code
### `PosCase1.java`
```java
// Multiplication by zero with integer literal zero operand should be flagged as always evaluating to zero.
package scensct.core.pos;
public class PosCase1 {
public PosCase1() {
int nonConstant = getNonConstant(); // Non-constant subexpression
int result = nonConstant * 0; // Multiplication by zero, always zero
// Use result in a conditional to emphasize constant evaluation
if (result == 0) {
// This branch is always taken
System.out.println("Always zero");
}
}
private int getNonConstant() {
return (int) (Math.random() * 100); // Non-constant value
}
}
```
## References
None known.
Hướng dẫn đóng góp
Hướng nghiên cứu
Start with Likely Bugs/Arithmetic/ConstantExpAppearsNonConstant.ql and inspect how it propagates constant results through local variables and rewritten expressions. Review PosCase1.java, PosCase3_Var1.java, and PosCase3_Var2.java as the affected examples. Done means the query recognizes the described constant expressions without losing the existing detection behavior.
Do mô hình lập chỉ mục viết ra từ nội dung của issue.
Đánh giá
- Công nghệ
- java
- Lĩnh vực
- security
- Loại issue
- Lỗi
- Độ khó
- 4/5
- Thời gian dự kiến
- 3-5 ngày
- Mức độ hoạt động
- Ít trao đổi
- Độ rõ ràng
- Khá rõ ràng
- Mức phù hợp với người mới
- 48/100