github / github/codeql

Github Code Scanning - false positive: Contradictory type checks

Aperta
#6,638 1 commento 0 reazioni 0 assegnatari Vedi su GitHub
false-positive Java
Lingua principale
CodeQL
Stelle
10.1k
Fork
2.1k
Merge medio
2g 15h
PR unite (30g)
141

Descrizione

**Description of the false positive**
The alert indicates that the variable `response` cannot be of type `HttpServletResponse` here, since [this expression](https://github.com/ganeshkumarsv/dd-trace-java/blob/3954d6e79259ad9ef0781710057b3a3229df1b37/dd-java-agent/instrumentation/servlet/request-2/src/main/java/datadog/trace/instrumentation/servlet2/Servlet2Advice.java#L95) ensures that it is not of type `HttpServletResponse`.

I think there is a bug in the query/tool as it misunderstood this independent if block [here](https://github.com/ganeshkumarsv/dd-trace-java/blob/3954d6e79259ad9ef0781710057b3a3229df1b37/dd-java-agent/instrumentation/servlet/request-2/src/main/java/datadog/trace/instrumentation/servlet2/Servlet2Advice.java#L102) as else if block, thats why it says the expression is guaranteed to return false as it failed in [line 95](https://github.com/ganeshkumarsv/dd-trace-java/blob/3954d6e79259ad9ef0781710057b3a3229df1b37/dd-java-agent/instrumentation/servlet/request-2/src/main/java/datadog/trace/instrumentation/servlet2/Servlet2Advice.java#L95)

**URL to the Github Code Scanning alert**
https://github.com/ganeshkumarsv/dd-trace-java/security/code-scanning/61

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.