Java: `java/ineffective-annotation-present-check` should cover more cases
- 主要语言
- CodeQL
- 星标
- 10.1k
- 派生
- 2.1k
- 平均合并
- 2 天 15 小时
- 30 天内合并 PR
- 141
描述
Currently the query [`java/ineffective-annotation-present-check`](https://github.com/github/codeql/blob/main/java/ql/src/Likely%20Bugs/Reflection/AnnotationPresentCheck.ql) only covers calls to `isAnnotationPresent(Class)`.
It would be good to cover the other methods of [`AnnotatedElement`](https://docs.oracle.com/en/java/javase/16/docs/api/java.base/java/lang/reflect/AnnotatedElement.html) (and methods overriding them) taking an annotation class as parameter as well.
Note that [JLS 16 §9.6.3](https://docs.oracle.com/javase/specs/jls/se16/html/jls-9.html#jls-9.6.3) permits for the containing annotation interface to have a higher `RetentionPolicy`, e.g.:
```java
import java.util.*;
import java.lang.annotation.*;
public class AnnTest {
@Repeatable(AnnContainer.class)
// Only visible in source
@Retention(RetentionPolicy.SOURCE)
@interface Ann { String value(); }
// Visible during runtime
@Retention(RetentionPolicy.RUNTIME)
@interface AnnContainer { Ann[] value(); }
@AnnContainer({
@Ann("c1"),
@Ann("c2")
})
@Ann("s")
public static class Test { }
public static void main(String... args) throws Exception {
// Finds repeated annotations even though they have RetentionPolicy.SOURCE
System.out.println(Arrays.toString(Test.class.getAnnotationsByType(Ann.class)));
}
}
```
Though accounting for this special case when checking method calls which consider these 'indirect' annotations (e.g. `getAnnotationsByType(Class)`) is probably not worth it.
----
There is also [`AnnotatedConstruct`](https://docs.oracle.com/en/java/javase/16/docs/api/java.compiler/javax/lang/model/AnnotatedConstruct.html), but if I understand it correctly it is used for processing source code and therefore `Retention` restrictions do not apply.
贡献指南
评估
这个 Issue 还没有评估数据。