search

github / codeql

CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security
https://codeql.github.com
MIT License
7.51k stars 1.49k forks source link

LGTM.com - false positive / #2742

Open ahus1 opened 4 years ago

ahus1 commented 4 years ago

Description of the false positive

Using next() and myBuilder.eof() will advance the cursor, and will trigger the callback setWhitespaceSkippedCallback, that will increment newLines, therefore this is a false positive.

https://lgtm.com/projects/g/asciidoctor/asciidoctor-intellij-plugin/snapshot/4f6083a0115577e6f8b12b0fbc95fe67e2263673/files/src/main/java/org/asciidoc/intellij/parser/AsciiDocParserImpl.java?sort=name&dir=ASC&mode=heatmap#xa2e95b28c87f047c:1

aschackmull commented 4 years ago

Thank you for your report. When building the SSA representation for fields, we try to account for any call-chain that can end up modifying the field. Unfortunately, callbacks that happen from library code that isn't part of the analyzed code currently aren't handled, which leads to the FP. This is a known problem and something that we're looking into, but the correct fix involves control-flow analysis of the bytecode of the referenced libraries, so it isn't something that we'll have a quick fix for, as we don't analyze bytecode yet.