java/unused-reference-type and java/unused-container: silenced by any annotation, even an empty one

Ouverte
  • Quelque chose ne va pas ?
#22,984 1 commentaire 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
4/5
Temps estimé
3-5 jours
Accessibilité débutants
35/100
Type d'issue
Bug
Clarté
Clairement spécifiée
Activité
Active
Stack technique
java
Domaine
devtools

Piste de recherche

Start with the java/unused-reference-type query and the ReflectiveAccessAnnotation check it uses, which treats any annotation other than Override, Deprecated, SuppressWarnings and SafeVarargs as reflective access. Reproduce with the seed/ and variant/ samples in the issue, one database per directory. Done means an empty, program-declared annotation no longer silences the unused-class and container alerts, or the help pages document the exemption.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Java

Description of the issue

seed/WRAnnotatedType.java declares an unused private nested class and seed/WRAnnotatedContainer.java a private list that's only written to, and the queries report both. Each file also declares an empty annotation type @interface Tag {}, with no retention and no meaning to any framework. Putting @Tag on the class and on the list (variant/) silences both alerts, though nothing else changed.

The queries treat every annotation except Override, Deprecated, SuppressWarnings and SafeVarargs as a sign of reflective access (ReflectiveAccessAnnotation), even one the program declares itself and nothing reads. The help pages don't mention any annotation exemption.

Query: java/unused-reference-type (codeql/java-queries 1.1.10)

CodeQL CLI: 2.27.2

Code samples

seed/WRAnnotatedContainer.java:

import java.util.ArrayList;
import java.util.List;

class WRAnnotatedContainer {
    @interface Tag {
    }

    private List<String> names = new ArrayList<>();

    void m() {
        names.add("x");
    }
}

seed/WRAnnotatedType.java:

class WRAnnotatedType {
    @interface Tag {
    }

    private class Unused {
    }

    void m() {
    }
}

variant/WRAnnotatedContainer.java:

import java.util.ArrayList;
import java.util.List;

class WRAnnotatedContainer {
    @interface Tag {
    }

    @Tag
    private List<String> names = new ArrayList<>();

    void m() {
        names.add("x");
    }
}

variant/WRAnnotatedType.java:

class WRAnnotatedType {
    @interface Tag {
    }

    @Tag
    private class Unused {
    }

    void m() {
    }
}

How to reproduce

codeql database create db --language=java --build-mode=none \
    --source-root=<one directory> --overwrite
codeql database analyze db \
    codeql/java-queries:codeql-suites/java-security-and-quality.qls \
    --format=csv --output=out.csv
# one database per directory

Expected result

"Unused class" on the annotated Unused in variant/WRAnnotatedType.java and "The contents of this container are never accessed" on names in variant/WRAnnotatedContainer.java, as on the seed/ files. Or, if any annotation is meant to be an exemption, the help pages should say so.

Output of the commands above:

### CodeQL 2.27.2  query: java/unused-reference-type
### suite: java-security-and-quality.qls, --build-mode=none, per-file isolated databases
### extraction JDK: openjdk version "21.0.11" 2026-04-21 LTS

--- SEED -- expected: query fires (seed/)
"Unused classes and interfaces","A non-public class or interface that is not used anywhere in the program wast
"Unused classes and interfaces","A non-public class or interface that is not used anywhere in the program wast
"Unused classes and interfaces","A non-public class or interface that is not used anywhere in the program wast
"Container contents are never accessed","A collection or map whose contents are never queried or accessed is u

--- VARIANT -- expected: query fires, actual: not reported (the bug) (variant/)
    (query reported nothing)
Langage dominant
CodeQL
Étoiles
10.3k
Forks
2.1k
Merge moyen
2 j 6 h
PR mergées (30 j)
137

Préparer son environnement

Ouvrir dans Codespaces

Lance le conteneur de développement du projet dans votre navigateur, avec votre propre compte GitHub.

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de github/codeql

Toutes les issues de github/codeql

Issues similaires

Plus d'issues DevTools

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.