java/unused-reference-type and java/unused-container: silenced by any annotation, even an empty one

Aperta
  • Qualcosa non va?
#22,984 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
java
Ambito
devtools

Direzione di ricerca

Start with the java/unused-reference-type query and the ReflectiveAccessAnnotation check it uses, which treats any annotation other than Override, Deprecated, SuppressWarnings and SafeVarargs as reflective access. Reproduce with the seed/ and variant/ samples in the issue, one database per directory. Done means an empty, program-declared annotation no longer silences the unused-class and container alerts, or the help pages document the exemption.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Description of the issue

seed/WRAnnotatedType.java declares an unused private nested class and seed/WRAnnotatedContainer.java a private list that's only written to, and the queries report both. Each file also declares an empty annotation type @interface Tag {}, with no retention and no meaning to any framework. Putting @Tag on the class and on the list (variant/) silences both alerts, though nothing else changed.

The queries treat every annotation except Override, Deprecated, SuppressWarnings and SafeVarargs as a sign of reflective access (ReflectiveAccessAnnotation), even one the program declares itself and nothing reads. The help pages don't mention any annotation exemption.

Query: java/unused-reference-type (codeql/java-queries 1.1.10)

CodeQL CLI: 2.27.2

Code samples

seed/WRAnnotatedContainer.java:

import java.util.ArrayList;
import java.util.List;

class WRAnnotatedContainer {
    @interface Tag {
    }

    private List<String> names = new ArrayList<>();

    void m() {
        names.add("x");
    }
}

seed/WRAnnotatedType.java:

class WRAnnotatedType {
    @interface Tag {
    }

    private class Unused {
    }

    void m() {
    }
}

variant/WRAnnotatedContainer.java:

import java.util.ArrayList;
import java.util.List;

class WRAnnotatedContainer {
    @interface Tag {
    }

    @Tag
    private List<String> names = new ArrayList<>();

    void m() {
        names.add("x");
    }
}

variant/WRAnnotatedType.java:

class WRAnnotatedType {
    @interface Tag {
    }

    @Tag
    private class Unused {
    }

    void m() {
    }
}

How to reproduce

codeql database create db --language=java --build-mode=none \
    --source-root=<one directory> --overwrite
codeql database analyze db \
    codeql/java-queries:codeql-suites/java-security-and-quality.qls \
    --format=csv --output=out.csv
# one database per directory

Expected result

"Unused class" on the annotated Unused in variant/WRAnnotatedType.java and "The contents of this container are never accessed" on names in variant/WRAnnotatedContainer.java, as on the seed/ files. Or, if any annotation is meant to be an exemption, the help pages should say so.

Output of the commands above:

### CodeQL 2.27.2  query: java/unused-reference-type
### suite: java-security-and-quality.qls, --build-mode=none, per-file isolated databases
### extraction JDK: openjdk version "21.0.11" 2026-04-21 LTS

--- SEED -- expected: query fires (seed/)
"Unused classes and interfaces","A non-public class or interface that is not used anywhere in the program wast
"Unused classes and interfaces","A non-public class or interface that is not used anywhere in the program wast
"Unused classes and interfaces","A non-public class or interface that is not used anywhere in the program wast
"Container contents are never accessed","A collection or map whose contents are never queried or accessed is u

--- VARIANT -- expected: query fires, actual: not reported (the bug) (variant/)
    (query reported nothing)
Lingua principale
CodeQL
Stelle
10.3k
Fork
2.1k
Merge medio
1g 22h
PR unite (30g)
126

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di github/codeql

Tutte le issue di github/codeql

Issue simili

Altre issue su DevTools

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.