github / github/codeql

Java: Record components (and their annotations) are not extracted

未關閉
#7,727 1 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
Java
主要語言
CodeQL
星號
10.1k
分支
2.1k
平均合併
2 天 15 小時
30 天內合併 PR
141

描述

The components of a Record class are currently not modeled by CodeQL, and their annotations are not extracted. Therefore it is not possible to test for annotations which only use `ElementType.RECORD_COMPONENT`, or for annotations with `ElementType.METHOD` which only exist in source but not in the class file because the corresponding accessor method is overridden.

The backing private field as well as the implicit accessor method are extracted.

Example:
```java
import static java.lang.annotation.RetentionPolicy.RUNTIME;

import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.Target;

record RecordTest(
@RecordComponentAnnotation
int i
) {
@Retention(RUNTIME)
@Target(ElementType.RECORD_COMPONENT)
@interface RecordComponentAnnotation { }
}
```

The following query does not find any usage of `@RecordComponentAnnotation`, and does not have any element modeling the Record component as result:
```ql
import java

from Top t
where t.getLocation().getFile().getBaseName().matches("RecordTest%")
select t, t.getLocation().getStartLine(), t.getPrimaryQlClasses()
```

Interestingly CodeQL reports a `FieldDeclaration` at the location of the component.
This issue might be solvable by modeling the component using the internal field (pretending the field is also the component), but this can cause inaccuracies for annotations, e.g.:
- In the byte code (and accessible through reflection) an annotation with `ElementType.RECORD_COMPONENT` is only present on the component, and `ElementType.FIELD` is only present on the internal field. With this approach both would be present on the field.
- It would not be possible to model an annotation with `ElementType.METHOD` on the component, or it would at least be weird that a `Field` has a method annotation

貢獻指南

開啟貢獻指南

研究方向

Start by tracing how CodeQL currently models the record's backing field and implicit accessor, then compare that behavior with the supplied Java record and query. Model record components and preserve the distinct RECORD_COMPONENT, FIELD, and METHOD annotation targets; the example query should find the component and its annotations when done.

由索引模型根據 Issue 內容生成。

評估

技術堆疊
java
領域
devtools
Issue 類型
功能
難度
4/5
預估耗時
3-5 天
活躍度
停滯
描述清晰度
基本清楚
新手友好度
35/100

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。