github / github/codeql

False Negative: ConstantExpAppearsNonConstant.ql misses expressions that stay constant after trivial local rewrites.

未關閉
#21,536 1 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
主要語言
CodeQL
星號
10.1k
分支
2.1k
平均合併
2 天 15 小時
30 天內合併 PR
141

描述

Version
codeql 2.24.3

## Checker
- Checker id: `Likely Bugs/Arithmetic/ConstantExpAppearsNonConstant.ql`
- Checker description: This checker detects expressions that always evaluate to the same constant value but are not recognized as compile-time constants by the compiler, often due to containing non-constant sub-expressions that don't affect the final result.

## Description of the false negative
These cases still reduce to a constant result at runtime. One multiplies by zero. The others use `true || condition`, which is still always true regardless of the non-constant boolean input.

The only change is that the constant-looking behavior is expressed through locals or a slightly different spelling.

## Affected test cases
### `PosCase1.java`
`nonConstant * 0` still evaluates to zero regardless of the non-constant operand.

### `PosCase3_Var1.java` and `PosCase3_Var2.java`
Both variants are still logical constants. `Boolean.TRUE || condition` and `alwaysTrue || condition` should both be recognized as always true.

## Cause analysis
This looks like a propagation gap. `Likely Bugs/Arithmetic/ConstantExpAppearsNonConstant.ql` appears to lose the constant result once the expression is one step less direct, even though the same algebraic reasoning still applies.

That makes the query miss a kind of bug it should be well suited to catch.

## Reproduction code
### `PosCase1.java`
```java
// Multiplication by zero with integer literal zero operand should be flagged as always evaluating to zero.
package scensct.core.pos;

public class PosCase1 {
public PosCase1() {
int nonConstant = getNonConstant(); // Non-constant subexpression
int result = nonConstant * 0; // Multiplication by zero, always zero
// Use result in a conditional to emphasize constant evaluation
if (result == 0) {
// This branch is always taken
System.out.println("Always zero");
}
}

private int getNonConstant() {
return (int) (Math.random() * 100); // Non-constant value
}
}
```

## References
None known.

貢獻指南

開啟貢獻指南

研究方向

從 Likely Bugs/Arithmetic/ConstantExpAppearsNonConstant.ql 開始,檢查它如何透過區域變數和重寫後的表達式傳播常數結果。查看 PosCase1.java、PosCase3_Var1.java 和 PosCase3_Var2.java,作為受影響的範例。完成的標準是查詢能夠辨識所描述的常數表達式,同時不遺失現有的偵測行為。

由索引模型根據 Issue 內容生成。

評估

技術堆疊
java
領域
security
Issue 類型
缺陷
難度
4/5
預估耗時
3-5 天
活躍度
冷清
描述清晰度
基本清楚
新手友好度
48/100

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。