Merge pull request #10718 from tamasvajk/kotlin-internal-repr

Kotlin: ignore properties in `java/internal-representation-exposure` check

java/ql/src/Violations of Best Practice/Implementation Hiding/ExposeRepresentation.ql

@@ -120,8 +120,12 @@ predicate exposesByStore(Callable c, Field f, Expr why, string whyText) {
 
 from Callable c, Field f, Expr why, string whyText
 where
-  exposesByReturn(c, f, why, whyText) or
-  exposesByStore(c, f, why, whyText)
+  (
+    exposesByReturn(c, f, why, whyText) or
+    exposesByStore(c, f, why, whyText)
+  ) and
+  // Kotlin properties expose internal representation, but it's not accidental, so ignore them
+  not exists(Property p | p.getBackingField() = f)
 select c,
   c.getName() + " exposes the internal representation stored in field " + f.getName() +
     ". The value may be modified $@.", why.getLocation(), whyText

java/ql/test/kotlin/query-tests/ExposeRepresentation/ExposeRepresentation.qlref

@@ -0,0 +1 @@
+Violations of Best Practice/Implementation Hiding/ExposeRepresentation.ql

java/ql/test/kotlin/query-tests/ExposeRepresentation/ExposesRep.kt

@@ -0,0 +1,3 @@
+class ExposesRep {
+    val strings: Array<String?> = arrayOfNulls(1)
+}

java/ql/test/kotlin/query-tests/ExposeRepresentation/User.kt

@@ -0,0 +1,5 @@
+class User {
+    fun test1(er: ExposesRep) {
+        er.strings[0] = "Hello world"
+    }
+}