github / github/codeql

Java: `java/ineffective-annotation-present-check` should cover more cases

未關閉
#6,244 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
Java question
主要語言
CodeQL
星號
10.1k
分支
2.1k
平均合併
2 天 15 小時
30 天內合併 PR
141

描述

Currently the query [`java/ineffective-annotation-present-check`](https://github.com/github/codeql/blob/main/java/ql/src/Likely%20Bugs/Reflection/AnnotationPresentCheck.ql) only covers calls to `isAnnotationPresent(Class)`.

It would be good to cover the other methods of [`AnnotatedElement`](https://docs.oracle.com/en/java/javase/16/docs/api/java.base/java/lang/reflect/AnnotatedElement.html) (and methods overriding them) taking an annotation class as parameter as well.

Note that [JLS 16 §9.6.3](https://docs.oracle.com/javase/specs/jls/se16/html/jls-9.html#jls-9.6.3) permits for the containing annotation interface to have a higher `RetentionPolicy`, e.g.:
```java
import java.util.*;
import java.lang.annotation.*;

public class AnnTest {
@Repeatable(AnnContainer.class)
// Only visible in source
@Retention(RetentionPolicy.SOURCE)
@interface Ann { String value(); }

// Visible during runtime
@Retention(RetentionPolicy.RUNTIME)
@interface AnnContainer { Ann[] value(); }

@AnnContainer({
@Ann("c1"),
@Ann("c2")
})
@Ann("s")
public static class Test { }

public static void main(String... args) throws Exception {
// Finds repeated annotations even though they have RetentionPolicy.SOURCE
System.out.println(Arrays.toString(Test.class.getAnnotationsByType(Ann.class)));
}
}
```

Though accounting for this special case when checking method calls which consider these 'indirect' annotations (e.g. `getAnnotationsByType(Class)`) is probably not worth it.

----

There is also [`AnnotatedConstruct`](https://docs.oracle.com/en/java/javase/16/docs/api/java.compiler/javax/lang/model/AnnotatedConstruct.html), but if I understand it correctly it is used for processing source code and therefore `Retention` restrictions do not apply.

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。