diff --git a/java/ql/src/experimental/semmle/code/java/security/StaticInitializationVectorQuery.qll b/java/ql/src/experimental/semmle/code/java/security/StaticInitializationVectorQuery.qll index 66ebb38a521..fe75c1df1fb 100644 --- a/java/ql/src/experimental/semmle/code/java/security/StaticInitializationVectorQuery.qll +++ b/java/ql/src/experimental/semmle/code/java/security/StaticInitializationVectorQuery.qll @@ -28,7 +28,12 @@ private class StaticByteArrayCreation extends ArrayCreationExpr { } } -/** Defines a sub-set of expressions that update an array. */ +/** + * Defines a sub-set of expressions that update either content of an array or an array reference. + * There sub-set covers only methods that are likely to set a non-static IV. + * For example, `java.util.Arrays.fill()` is not covered because it assigns the same value + * to each element of the array. + */ private class ArrayUpdate extends Expr { Expr array;