Merge pull request #17101 from owen-mc/java/dead-ref-types-junit-4-5

Java: Fix FPs in `java/unused-reference-type` for JUnit 4-style tests

java/ql/src/Violations of Best Practice/Dead Code/DeadRefTypes.ql

@@ -49,6 +49,7 @@ predicate dead(RefType dead) {
   not dead instanceof AnonymousClass and
   // Exclude classes that look like they may be reflectively constructed.
   not dead.getAnAnnotation() instanceof ReflectiveAccessAnnotation and
+  not dead.getAMethod().getAnAnnotation() instanceof ReflectiveAccessAnnotation and
   // Insist all source ancestors are dead as well.
   forall(RefType t | t.fromSource() and t = getASuperTypePlus(dead) | dead(t)) and
   // Exclude compiler generated classes (e.g. declaring type of adapter functions in Kotlin)

java/ql/src/change-notes/2024-07-30-unused.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The query "Unused classes and interfaces" (`java/unused-reference-type`) now recognizes that if a method of a class has an annotation then it may be accessed reflectively. This should remove false positive alerts, especially for JUnit 4-style tests annotated with `@test`.

java/ql/test/query-tests/DeadCode/DeadRefTypes/ClassWithAnnotatedMethod.java

@@ -0,0 +1,4 @@
+class ClassWithAnnotatedMethod {
+    @MyAnnotation
+    void doNothing() { }
+}

java/ql/test/query-tests/DeadCode/DeadRefTypes/ClassWithAnnotation.java

@@ -0,0 +1,3 @@
+@MyAnnotation
+class ClassWithAnnotation {
+}

java/ql/test/query-tests/DeadCode/DeadRefTypes/DeadRefTypes.expected

@@ -0,0 +1 @@
+| UnusedClass.java:1:7:1:17 | UnusedClass | Unused class: UnusedClass is not referenced within this codebase. If not used as an external API it should be removed. |

java/ql/test/query-tests/DeadCode/DeadRefTypes/DeadRefTypes.qlref

@@ -0,0 +1 @@
+Violations of Best Practice/Dead Code/DeadRefTypes.ql

java/ql/test/query-tests/DeadCode/DeadRefTypes/MyAnnotation.java

@@ -0,0 +1,2 @@
+public @interface MyAnnotation {
+}

java/ql/test/query-tests/DeadCode/DeadRefTypes/UnusedClass.java

@@ -0,0 +1 @@
+class UnusedClass {}