Github Code Scanning - false positive: Contradictory type checks
- 主要言語
- CodeQL
- スター
- 10.1k
- フォーク
- 2.1k
- 平均マージ
- 2日 15時間
- マージ済み PR(30日)
- 141
説明
**Description of the false positive**
The alert indicates that the variable `response` cannot be of type `HttpServletResponse` here, since [this expression](https://github.com/ganeshkumarsv/dd-trace-java/blob/3954d6e79259ad9ef0781710057b3a3229df1b37/dd-java-agent/instrumentation/servlet/request-2/src/main/java/datadog/trace/instrumentation/servlet2/Servlet2Advice.java#L95) ensures that it is not of type `HttpServletResponse`.
I think there is a bug in the query/tool as it misunderstood this independent if block [here](https://github.com/ganeshkumarsv/dd-trace-java/blob/3954d6e79259ad9ef0781710057b3a3229df1b37/dd-java-agent/instrumentation/servlet/request-2/src/main/java/datadog/trace/instrumentation/servlet2/Servlet2Advice.java#L102) as else if block, thats why it says the expression is guaranteed to return false as it failed in [line 95](https://github.com/ganeshkumarsv/dd-trace-java/blob/3954d6e79259ad9ef0781710057b3a3229df1b37/dd-java-agent/instrumentation/servlet/request-2/src/main/java/datadog/trace/instrumentation/servlet2/Servlet2Advice.java#L95)
**URL to the Github Code Scanning alert**
https://github.com/ganeshkumarsv/dd-trace-java/security/code-scanning/61
コントリビューションガイド
評価
この issue はまだ評価されていません。