java/unused-reference-type and java/unused-container: silenced by any annotation, even an empty one

Abierto
  • ¿Algo no está bien?
#22,984 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
35/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
java
Área
devtools

Línea de trabajo

Start with the java/unused-reference-type query and the ReflectiveAccessAnnotation check it uses, which treats any annotation other than Override, Deprecated, SuppressWarnings and SafeVarargs as reflective access. Reproduce with the seed/ and variant/ samples in the issue, one database per directory. Done means an empty, program-declared annotation no longer silences the unused-class and container alerts, or the help pages document the exemption.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Description of the issue

seed/WRAnnotatedType.java declares an unused private nested class and seed/WRAnnotatedContainer.java a private list that's only written to, and the queries report both. Each file also declares an empty annotation type @interface Tag {}, with no retention and no meaning to any framework. Putting @Tag on the class and on the list (variant/) silences both alerts, though nothing else changed.

The queries treat every annotation except Override, Deprecated, SuppressWarnings and SafeVarargs as a sign of reflective access (ReflectiveAccessAnnotation), even one the program declares itself and nothing reads. The help pages don't mention any annotation exemption.

Query: java/unused-reference-type (codeql/java-queries 1.1.10)

CodeQL CLI: 2.27.2

Code samples

seed/WRAnnotatedContainer.java:

import java.util.ArrayList;
import java.util.List;

class WRAnnotatedContainer {
    @interface Tag {
    }

    private List<String> names = new ArrayList<>();

    void m() {
        names.add("x");
    }
}

seed/WRAnnotatedType.java:

class WRAnnotatedType {
    @interface Tag {
    }

    private class Unused {
    }

    void m() {
    }
}

variant/WRAnnotatedContainer.java:

import java.util.ArrayList;
import java.util.List;

class WRAnnotatedContainer {
    @interface Tag {
    }

    @Tag
    private List<String> names = new ArrayList<>();

    void m() {
        names.add("x");
    }
}

variant/WRAnnotatedType.java:

class WRAnnotatedType {
    @interface Tag {
    }

    @Tag
    private class Unused {
    }

    void m() {
    }
}

How to reproduce

codeql database create db --language=java --build-mode=none \
    --source-root=<one directory> --overwrite
codeql database analyze db \
    codeql/java-queries:codeql-suites/java-security-and-quality.qls \
    --format=csv --output=out.csv
# one database per directory

Expected result

"Unused class" on the annotated Unused in variant/WRAnnotatedType.java and "The contents of this container are never accessed" on names in variant/WRAnnotatedContainer.java, as on the seed/ files. Or, if any annotation is meant to be an exemption, the help pages should say so.

Output of the commands above:

### CodeQL 2.27.2  query: java/unused-reference-type
### suite: java-security-and-quality.qls, --build-mode=none, per-file isolated databases
### extraction JDK: openjdk version "21.0.11" 2026-04-21 LTS

--- SEED -- expected: query fires (seed/)
"Unused classes and interfaces","A non-public class or interface that is not used anywhere in the program wast
"Unused classes and interfaces","A non-public class or interface that is not used anywhere in the program wast
"Unused classes and interfaces","A non-public class or interface that is not used anywhere in the program wast
"Container contents are never accessed","A collection or map whose contents are never queried or accessed is u

--- VARIANT -- expected: query fires, actual: not reported (the bug) (variant/)
    (query reported nothing)
Lenguaje dominante
CodeQL
Estrellas
10.3k
Forks
2.1k
Merge medio
1 d 22 h
PR fusionados (30 d)
126

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de github/codeql

Todos los issues de github/codeql

Issues similares

Más issues de DevTools

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.