github / codeql

CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security
https://codeql.github.com
MIT License
7.57k stars 1.52k forks source link

Java: `Annotation` has no source location for repeated annotation with implicit container #6236

Open Marcono1234 opened 3 years ago

Marcono1234 commented 3 years ago

Version

CodeQL CLI version: 2.5.7

Description

When a repeatable annotation is used multiple times on an element (therefore creating an implicit container annotation), the respective Annotation elements have no source location. This prevents writing queries reasoning about the location of these annotations, and also renders them unusable for query result output. Similarly they are not displayed in the AST viewer of the CodeQL VSCode extension either.

Reproduction steps

  1. Create a Java database for the following source code

    import java.lang.annotation.*;
    
    class RepeatableAnnotationTest {
        @Repeatable(Markers.class)
        @interface Marker { }
    
        @interface Markers {
            Marker[] value();
        }
    
        // These don't have source locations
        @Marker
        @Marker
        String implicitContainer;
    
        // Though explicitly using a container annotation works
        // The @Marker annotations have source locations
        @Markers({
            @Marker,
            @Marker
        })
        String explicitContainer;
    }
  2. Run this CodeQL query:

    import java
    
    from Annotation a
    where a.getCompilationUnit().fromSource()
    select a

    :x: The annotations with implicit container annotation have no source location; they do not appear in the result set

Note however, that for the implicit container annotation itself the current behavior of not having a source location is expected and desired (to differentiate between implicit and explicit container annotations).

smowton commented 3 years ago

Thanks for the report. In the meantime you can work around by returning something like a.getAnnotatedElement(), a.toString() to avoid our trying to pull the location. I will try to get this fixed though.