From b595a70384d4e118dd5fdb94afbb73e27474fb40 Mon Sep 17 00:00:00 2001 From: Kaixuan Li Date: Sun, 29 Mar 2026 11:45:27 +0800 Subject: [PATCH] Update java/ql/lib/change-notes/2026-03-28-tainted-arithmetic-bounds-check.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- .../change-notes/2026-03-28-tainted-arithmetic-bounds-check.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/java/ql/lib/change-notes/2026-03-28-tainted-arithmetic-bounds-check.md b/java/ql/lib/change-notes/2026-03-28-tainted-arithmetic-bounds-check.md index 238b1e2978f..0688815c822 100644 --- a/java/ql/lib/change-notes/2026-03-28-tainted-arithmetic-bounds-check.md +++ b/java/ql/lib/change-notes/2026-03-28-tainted-arithmetic-bounds-check.md @@ -1,4 +1,4 @@ --- category: minorAnalysis --- -* The `java/tainted-arithmetic` query no longer flags arithmetic expressions that are used directly as an operand of a comparison in bounds-checking patterns. For example, `if (off + len > array.length)` is now recognized as a bounds check rather than a potentially vulnerable computation, reducing false positives. +* The `java/tainted-arithmetic` query no longer flags arithmetic expressions that are used directly as an operand of a comparison in `if`-condition bounds-checking patterns. For example, `if (off + len > array.length)` is now recognized as a bounds check rather than a potentially vulnerable computation, reducing false positives.