github / github/codeql

False Negative: ConstantExpAppearsNonConstant.ql misses expressions that stay constant after trivial local rewrites.

未关闭
#21,536 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
CodeQL
星标
10.1k
派生
2.1k
平均合并
2 天 15 小时
30 天内合并 PR
141

描述

Version
codeql 2.24.3

## Checker
- Checker id: `Likely Bugs/Arithmetic/ConstantExpAppearsNonConstant.ql`
- Checker description: This checker detects expressions that always evaluate to the same constant value but are not recognized as compile-time constants by the compiler, often due to containing non-constant sub-expressions that don't affect the final result.

## Description of the false negative
These cases still reduce to a constant result at runtime. One multiplies by zero. The others use `true || condition`, which is still always true regardless of the non-constant boolean input.

The only change is that the constant-looking behavior is expressed through locals or a slightly different spelling.

## Affected test cases
### `PosCase1.java`
`nonConstant * 0` still evaluates to zero regardless of the non-constant operand.

### `PosCase3_Var1.java` and `PosCase3_Var2.java`
Both variants are still logical constants. `Boolean.TRUE || condition` and `alwaysTrue || condition` should both be recognized as always true.

## Cause analysis
This looks like a propagation gap. `Likely Bugs/Arithmetic/ConstantExpAppearsNonConstant.ql` appears to lose the constant result once the expression is one step less direct, even though the same algebraic reasoning still applies.

That makes the query miss a kind of bug it should be well suited to catch.

## Reproduction code
### `PosCase1.java`
```java
// Multiplication by zero with integer literal zero operand should be flagged as always evaluating to zero.
package scensct.core.pos;

public class PosCase1 {
public PosCase1() {
int nonConstant = getNonConstant(); // Non-constant subexpression
int result = nonConstant * 0; // Multiplication by zero, always zero
// Use result in a conditional to emphasize constant evaluation
if (result == 0) {
// This branch is always taken
System.out.println("Always zero");
}
}

private int getNonConstant() {
return (int) (Math.random() * 100); // Non-constant value
}
}
```

## References
None known.

贡献指南

打开贡献指南

调研方向

Start with Likely Bugs/Arithmetic/ConstantExpAppearsNonConstant.ql and inspect how it propagates constant results through local variables and rewritten expressions. Review PosCase1.java, PosCase3_Var1.java, and PosCase3_Var2.java as the affected examples. Done means the query recognizes the described constant expressions without losing the existing detection behavior.

由索引模型根据 Issue 内容生成。

评估

技术栈
java
领域
security
Issue 类型
缺陷
难度
4/5
预计耗时
3-5 天
活跃度
冷清
描述清晰度
基本清楚
新手友好度
48/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。