mirror of
https://github.com/github/codeql.git
synced 2026-03-25 09:01:47 +01:00
1.5 KiB
1.5 KiB
Improvements to Java analysis
New queries
| Query | Tags | Purpose |
|---|
Changes to existing queries
| Query | Expected impact | Change |
|---|---|---|
Implicit conversion from array to string (java/print-array) |
Fewer false positive results | Results in slf4j logging calls are no longer reported as slf4j supports array printing. |
Result of multiplication cast to wider type (java/integer-multiplication-cast-to-long) |
Fewer false positive results | Range analysis is now used to exclude results involving multiplication of small values that cannot overflow. |
Changes to QL libraries
- The
Guardslibrary has been extended to account for method calls that check conditions by conditionally throwing an exception. This includes thecheckArgumentandcheckStatemethods incom.google.common.base.Preconditions, theisTrueandvalidStatemethods inorg.apache.commons.lang3.Validate, as well as any similar custom methods. This means that more guards are recognized yielding precision improvements in a number of queries includingjava/index-out-of-bounds,java/dereferenced-value-may-be-null, andjava/useless-null-check.