False negative: DoubleCheckedLocking.ql cannot detect scenarios with ternary expressions.
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 38/100
Research direction
Start with java/Likely Bugs/Concurrency/DoubleCheckedLocking.ql and reproduce the two Java snippets from the issue to compare query results. Done means the query reports the unsafe ternary-based double-checked locking scenario while continuing to report the existing direct pattern.
Written by the indexing model from the issue text.
Description
Version
codeql 2.23.9
Description of the issue
When I detect the code like this using java/Likely Bugs/Concurrency/DoubleCheckedLocking.ql, the problem is reported normally:
public class PosCase1 {
private Object instance; // Non-volatile field
public Object getInstance() {
if (instance == null) { // First null check
synchronized (this) { // [REPORTED LINE]
if (instance == null) { // Second null check inside synchronized block
instance = new Object(); // Initialization
}
}
}
return instance; // Return after double-checked locking
}
}
However, when ternary expressions are introduced into the code, DoubleCheckedLocking.ql fails to detect the problem:
public class PosCase1_Var1 {
private Object instance; // Non-volatile field
public Object getInstance() {
// Use ternary for outer check, but preserve unsafe pattern
return (instance != null) ? instance : createInstance();
}
private Object createInstance() {
synchronized (this) {
if (instance == null) {
instance = new Object();
}
return instance;
}
}
}
These two code snippets are semantically identical, only using a ternary expression with some transformations, which is why DoubleCheckedLocking.ql cannot detect the problem.
- Dominant language
- CodeQL
- Stars
- 10.1k
- Forks
- 2.1k
- Avg merge
- 2d 16h
- Merged PRs (30d)
- 143
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from github/codeql
-
agentic-workflows
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
false-positive javascript
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
C#: cs/simplifiable-boolean-expression false positive on Nullable<bool> compared with a literal Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
false-positive
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Similar issues
-
ZCode 3.14.3 に対応する Open
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
supermomonga/zcode-acp#24 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
learningequality/ricecooker#747 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
KhronosGroup/glTF-Blender-IO#2769 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100