Merge remote-tracking branch 'upstream/master' into mergeback-2018-10-11

java/ql/src/Likely Bugs/Statements/PartiallyMaskedCatch.java

@@ -1,11 +1,10 @@
-FileInputStream fis = null;
+FileOutputStream fos = null;
 try {
-	fis = new FileInputStream(new File("may_not_exist.txt"));
-	// read from input stream
+	fos = new FileOutputStream(new File("may_not_exist.txt"));
 } catch (FileNotFoundException e) {
 	// ask the user and try again
 } catch (IOException e) {
 	// more serious, abort
 } finally {
-	if (fis!=null) { try { fis.close(); } catch (IOException e) { /*ignore*/ } }
+	if (fos!=null) { try { fos.close(); } catch (IOException e) { /*ignore*/ } }
 }

java/ql/src/Likely Bugs/Statements/PartiallyMaskedCatch.qhelp

@@ -45,7 +45,13 @@ than one of the <code>catch</code> clauses, only the first matching clause is ex
 </recommendation>
 <example>
 
-<p>In the following example, the second <code>catch</code> clause is unreachable, and can be removed.</p>
+<p>
+In the following example, the second <code>catch</code> clause is unreachable.
+The code is incomplete because a <code>FileOutputStream</code> is opened but
+no methods are called to write to the stream. Such methods typically throw
+<code>IOException</code>s, which would make the second <code>catch</code> clause
+reachable.
+</p>
 
 <sample src="PartiallyMaskedCatch.java" />
 

java/ql/src/Likely Bugs/Statements/PartiallyMaskedCatch.ql

@@ -47,7 +47,10 @@ RefType getAThrownExceptionType(TryStmt t) {
     t.getBlock() = call.getEnclosingStmt().getParent*() or
     t.getAResourceDecl() = call.getEnclosingStmt()
     |
-    call.getCallee().getAnException() = e and
+    (
+      call.getCallee().getAnException() = e or
+      call.(GenericCall).getATypeArgument(call.getCallee().getAnException().getType()) = e.getType()
+    ) and
     not caughtInside(t, call.getEnclosingStmt(), e.getType()) and
     result = e.getType()
   ) or