github / github/codeql

Java: `java/ineffective-annotation-present-check` should cover more cases

未关闭
#6,244 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
Java question
主要语言
CodeQL
星标
10.1k
派生
2.1k
平均合并
2 天 15 小时
30 天内合并 PR
141

描述

Currently the query [`java/ineffective-annotation-present-check`](https://github.com/github/codeql/blob/main/java/ql/src/Likely%20Bugs/Reflection/AnnotationPresentCheck.ql) only covers calls to `isAnnotationPresent(Class)`.

It would be good to cover the other methods of [`AnnotatedElement`](https://docs.oracle.com/en/java/javase/16/docs/api/java.base/java/lang/reflect/AnnotatedElement.html) (and methods overriding them) taking an annotation class as parameter as well.

Note that [JLS 16 §9.6.3](https://docs.oracle.com/javase/specs/jls/se16/html/jls-9.html#jls-9.6.3) permits for the containing annotation interface to have a higher `RetentionPolicy`, e.g.:
```java
import java.util.*;
import java.lang.annotation.*;

public class AnnTest {
@Repeatable(AnnContainer.class)
// Only visible in source
@Retention(RetentionPolicy.SOURCE)
@interface Ann { String value(); }

// Visible during runtime
@Retention(RetentionPolicy.RUNTIME)
@interface AnnContainer { Ann[] value(); }

@AnnContainer({
@Ann("c1"),
@Ann("c2")
})
@Ann("s")
public static class Test { }

public static void main(String... args) throws Exception {
// Finds repeated annotations even though they have RetentionPolicy.SOURCE
System.out.println(Arrays.toString(Test.class.getAnnotationsByType(Ann.class)));
}
}
```

Though accounting for this special case when checking method calls which consider these 'indirect' annotations (e.g. `getAnnotationsByType(Class)`) is probably not worth it.

----

There is also [`AnnotatedConstruct`](https://docs.oracle.com/en/java/javase/16/docs/api/java.compiler/javax/lang/model/AnnotatedConstruct.html), but if I understand it correctly it is used for processing source code and therefore `Retention` restrictions do not apply.

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。