hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 01:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

java: address review comments

Browse Source 
- do not use `getQualifiedName`
- use camelCase
- rework alert predicates
This commit is contained in:
yoff
2025-10-21 12:49:07 +02:00
parent 715acefacc
commit de05bfbce3
3 changed files with 57 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
java/ql/src/Likely Bugs/Concurrency/ThreadSafe.ql
View File

@@ -14,43 +14,38 @@
import java
import semmle.code.java.ConflictingAccess
predicate unmonitored_access(
ClassAnnotatedAsThreadSafe cls, ExposedFieldAccess a, Expr entry, string msg, string entry_desc
) {
exists(ExposedField f |
cls.unlocked_public_access(f, entry, _, a, true)
predicate unmonitoredAccess(ExposedFieldAccess a, string msg, Expr entry, string entry_desc) {
exists(ClassAnnotatedAsThreadSafe cls, ExposedField f |
cls.unlockedPublicAccess(f, entry, _, a, true)
or
cls.unlocked_public_access(f, entry, _, a, false) and
cls.has_public_write_access(f)
cls.unlockedPublicAccess(f, entry, _, a, false) and
cls.hasPublicWriteAccess(f)
) and
msg =
"This field access (publicly accessible via $@) is not protected by any monitor, but the class is annotated as @ThreadSafe." and
entry_desc = "this expression"
}
predicate not_fully_monitored_field(
ClassAnnotatedAsThreadSafe cls, ExposedField f, string msg, string cls_name
predicate notFullyMonitoredField(
ExposedField f, string msg, ClassAnnotatedAsThreadSafe cls, string cls_name
) {
(
// Technically there has to be a write access for a conflict to exist.
// But if you are locking your reads with different locks, you likely made a typo,
// so in this case we alert without requiring `cls.has_public_write_access(f)`
cls.single_monitor_mismatch(f)
cls.singleMonitorMismatch(f)
or
cls.not_fully_monitored(f) and
cls.has_public_write_access(f)
cls.notFullyMonitored(f) and
cls.hasPublicWriteAccess(f)
) and
msg =
"This field is not properly synchronized in that no single monitor covers all accesses, but the class $@ is annotated as @ThreadSafe." and
cls_name = cls.getName()
}
from
ClassAnnotatedAsThreadSafe cls, Top alert_element, Top alert_context, string alert_msg,
string context_desc
from Top alert_element, Top alert_context, string alert_msg, string context_desc
where
unmonitored_access(cls, alert_element, alert_context, alert_msg, context_desc)
unmonitoredAccess(alert_element, alert_msg, alert_context, context_desc)
or
not_fully_monitored_field(cls, alert_element, alert_msg, context_desc) and
alert_context = cls
notFullyMonitoredField(alert_element, alert_msg, alert_context, context_desc)
select alert_element, alert_msg, alert_context, context_desc