False Negative: ContinueInFalseLoop.ql misses `do ... while(false)` loops once `false` is stored in a local.
- 主要語言
- CodeQL
- 星號
- 10.1k
- 分支
- 2.1k
- 平均合併
- 2 天 15 小時
- 30 天內合併 PR
- 141
描述
# False Negative: ContinueInFalseLoop.ql misses `do ... while(false)` loops once `false` is stored in a local.
Version
codeql 2.24.3
## Checker
- Checker id: `Likely Bugs/Statements/ContinueInFalseLoop.ql`
- Checker description: This checker detects a 'continue' statement inside a 'do' loop whose condition is always false, meaning the continue will never actually re-run the loop body.
## Description of the false negative
Both samples are still `do` loops whose condition is false and therefore cannot loop back after `continue`. The only difference is that the literal `false` is first assigned to a local variable.
That should still be a direct hit for `Likely Bugs/Statements/ContinueInFalseLoop.ql`.
## Affected test cases
### `PosCase1_Var1.java`
`never` is a constant false value, so the `continue` still cannot re-enter the loop body.
```java
// A do loop with a literal false condition contains a continue statement targeting that same loop should be flagged as a positive case.
package scensct.var.pos;
public class PosCase1_Var1 {
public static void main(String[] args) {
final boolean never = false;
do {
// continue inside do with false condition
continue;
} while (never);
}
}
```
### `PosCase1_Var5.java`
`flag` is initialized from `Boolean.FALSE` and never changed. This is still the same impossible loop-back case.
```java
// A do loop with a literal false condition contains a continue statement targeting that same loop should be flagged as a positive case.
package scensct.var.pos;
public class PosCase1_Var5 {
public static void main(String[] args) {
boolean flag = Boolean.FALSE;
do {
// continue inside do with false condition
continue;
} while (flag);
}
}
```
## Cause analysis
The miss is surprisingly basic. The query appears to require a literal `false` at the loop condition and loses the result as soon as that same value is stored in a local.
For developers, these are the same bug. Whether the condition is written as `while (false)` or `while (never)` should not matter.
## References
None known.
貢獻指南
研究方向
從 Likely Bugs/Statements/ContinueInFalseLoop.ql 開始,檢查它在 false 儲存於區域變數中時如何評估 do-loop 條件。查看受影響的 PosCase1_Var1.java 和 PosCase1_Var5.java 案例,然後執行 checker 測試,以確認兩個案例都會被標記,同時現有的字面值 false 行為仍然得到涵蓋。
由索引模型根據 Issue 內容生成。
評估
- 技術堆疊
- java
- 領域
- devtools
- Issue 類型
- 缺陷
- 難度
- 3/5
- 預估耗時
- 1-2 天
- 活躍度
- 冷清
- 描述清晰度
- 描述清楚
- 新手友好度
- 68/100