github / github/codeql

Github Code Scanning - false positive: Contradictory type checks

Aberta
#6,638 1 comentário 0 reações 0 responsáveis Ver no GitHub
false-positive Java
Linguagem predominante
CodeQL
Estrelas
10.1k
Forks
2.1k
Merge médio
2d 15h
PRs com merge (30d)
141

Descrição

**Description of the false positive**
The alert indicates that the variable `response` cannot be of type `HttpServletResponse` here, since [this expression](https://github.com/ganeshkumarsv/dd-trace-java/blob/3954d6e79259ad9ef0781710057b3a3229df1b37/dd-java-agent/instrumentation/servlet/request-2/src/main/java/datadog/trace/instrumentation/servlet2/Servlet2Advice.java#L95) ensures that it is not of type `HttpServletResponse`.

I think there is a bug in the query/tool as it misunderstood this independent if block [here](https://github.com/ganeshkumarsv/dd-trace-java/blob/3954d6e79259ad9ef0781710057b3a3229df1b37/dd-java-agent/instrumentation/servlet/request-2/src/main/java/datadog/trace/instrumentation/servlet2/Servlet2Advice.java#L102) as else if block, thats why it says the expression is guaranteed to return false as it failed in [line 95](https://github.com/ganeshkumarsv/dd-trace-java/blob/3954d6e79259ad9ef0781710057b3a3229df1b37/dd-java-agent/instrumentation/servlet/request-2/src/main/java/datadog/trace/instrumentation/servlet2/Servlet2Advice.java#L95)

**URL to the Github Code Scanning alert**
https://github.com/ganeshkumarsv/dd-trace-java/security/code-scanning/61

Guia de contribuição

Abrir o guia de contribuição

Avaliação

Esta issue ainda não foi avaliada.

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.