CWE(s) in Kotlin not being detected by java-kotlin queries?

CWE-1204 のクエリヘルプと、そこからリンクされている java/ql/test/query-tests/security/CWE-1204/StaticInitializationVector.java のテストから始め、次にその Java のケースを issue 内の Kotlin の例と比較します。java/telemetry/unsupported-external-api の SARIF エントリを調べ、Kotlin ByteArray の処理がカバーされているか確認します。互換性のギャップを明らかにし、必要なクエリまたはドキュメントの変更を特定できれば完了です。

Hi!

I recently did a test with CodeQL on a new Kotlin project, and I included CWE-1204 to get a detection.

I copied the example from documentation and test case. I then used IntelliJ IDEA to convert it from Java to Kotlin.

@Throws(Exception::class)  
fun encryptWithZeroStaticIvByteArray(key: ByteArray?, plaintext: ByteArray?): ByteArray {  
  val iv = ByteArray(16) // $Source  
  
  val ivSpec = GCMParameterSpec(128, iv)  
  val keySpec = SecretKeySpec(key, "AES")  
  
  val cipher = Cipher.getInstance("AES/GCM/PKCS5PADDING")  
  cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec) // $Alert  
  cipher.update(plaintext)  
  return cipher.doFinal()  
}

I got no detections, and assumed it was an issue with Actions setup, after debugging I decided to test out CWE-117 which I've heard works on Kotlin. After I ran the CI/CD setup it was detected.

I was recommended to try out example from CWE-1204 using a new Java project. After running the CI/CD setup, it was detected.

I spent some time trying to figure out why, decompiling the code, looking at logs. I then looked at sarif file, and I found following rule:

"ruleId": "java/telemetry/unsupported-external-api", 
"value": 4, 
"message": { "text": "kotlin.ByteArray#ByteArray(int)" } 

Questions:

• Is there a known list which queries have been tested and works with Kotlin?
  • or a list of queries that is not working with Kotlin?
• Is there anything I can do while waiting for queries to be fully compatible with Kotlin?__