github / github/codeql

[Java] WildcardTypeAccess.hasNoBound() returns wrong result for array bounds

未關閉
#4,005 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
question
主要語言
CodeQL
星號
10.1k
分支
2.1k
平均合併
2 天 15 小時
30 天內合併 PR
141

描述

`WildcardTypeAccess.hasNoBound()` returns for wildcards bounded by an array type, that they have no bound.
Example query:
```ql
import java

from WildcardTypeAccess w
where
exists (w.getUpperBound())
and w.hasNoBound()
select w
```
[Query console link](https://lgtm.com/query/1406379471933943968/)

The issue appears to be that this predicate only checks for `TypeAccess` children, however `ArrayTypeAccess` is not a subclass of `TypeAccess`:
https://github.com/github/codeql/blob/595ab442e66a0911f836ae859faebcd3f4f0177d/java/ql/src/semmle/code/java/Expr.qll#L1589-L1590

Maybe it would suffice checking that any child expression at index 0 or 1 exists (or would that also match annotations somehow)?

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。